Forum Discussion
superblue1999_8
Nimbostratus
NimbostratusHow does the IP forwarding works ?
Hi everyone,
I got a BIGIP LTM VE working after countless hours, however I still don't quite understand how come it works in terms of routing ... I hope some one can help me to understand the IP forwarding of this platform.
Here is my setup, all the VM are on a single ESX server with vswitch
Web_server1------vlan 52-----BIGIP --------Vlan 52--------IP cloud -----------Vlan 100 -------Testing Client
|
Web_server1------vlan52---------
All the three NIC on BIGIP is in Vlan 52 network.
I configured 192.168.1.1 as the selfip on 1.1 interface, and two web servers are using it as the default gateway, it is working, but how come it works ?
1. All the web servers and self IP are in 192.168.1.0/24 network
2. the virtual IP is in 10.0.0.0/24 network, there is no other route configured
3. the management IP is in 10.0.0.0/24 network, with a default route
When I send a HTTP request to the webserver, my source IP is not in any of the subnet that BIGIP is aware of, so I guess it needs a default route to return to me, but I didn't configure it anywhere, the only default route configuration is for the management port.
How come it works ?
Thanks a lot
Harry.
4 Replies
hoolioCirrostratus
Hi Harry,
If all of the NICs are on the same subnet, you should be able to define a single VLAN and add the port(s) to the VLAN. You probably don't need to use multiple VM interfaces unless that's somehow adding resilience on the physical network.
On a normal LTM appliance, you wouldn't be able to define a virtual server on the management subnet. I assumed that would also be the case for the LTM virtual edition. I'd guess your scenario is working because TMM is using the management default route.
I would suggest defining the virtual servers on a switch port (vlan 52) and not using the management subnet. You can define a TMM route via the GUI under Networking >> Routes. For details on mgmt and TMM routing, you can check SOL
SOL3669: Overview of management interface routing
http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3669.html
Aaron
superblue1999_8Hi Aron,
Thanks for the reply.
I modified my lab, now I have separate VLANs for internal, external and management, now my lab is broken if I access the virtual IP from another subnet other than the external VLAN.
I configured the default route, and now the routing table look like this:
[root@test-f5:Active] config bigpipe route show
ROUTE default inet
| VLAN External static
ROUTE 10.0.0.0/24
| VLAN External connected
ROUTE 127.1.1.0/24
| VLAN tmm0 connected
ROUTE 192.168.1.0/24
| VLAN Internal connected
ROUTE fe80::/64
| VLAN tmm0 connected
ROUTE fe80::%vlan4093/64
| VLAN External connected
ROUTE fe80::%vlan4094/64
| VLAN Internal connected
ROUTE ff02::/64
| VLAN tmm0 auto
ROUTE ff02::%vlan4093/64
| VLAN External auto
ROUTE ff02::%vlan4094/64
| VLAN Internal auto
if it is a Cisco router, I expect the default route should have a next-hop IP, so when it forwards the traffic, it knows where to forward to, in F5 routing table, it looks there is no next hop, only the VLAN, how can the F5 box knows the mac-address to encap the packet ?
Sorry if this question is too obvious, I am digging F5 from scratch, and have no background what so ever : -0
Harry.- superblue1999_8hmm, it looks it can work without any routing configured, I removed all the routing and only leave with connected interface, and I can still access the VIP from outside.
is this some kind of F5 magic ?
[root@test-f5:Active] config bigpipe route show
ROUTE 10.0.0.0/24
| VLAN External connected
ROUTE 127.1.1.0/24
| VLAN tmm0 connected
ROUTE 192.168.1.0/24
| VLAN Internal connected
ROUTE fe80::/64
| VLAN tmm0 connected
ROUTE fe80::%vlan4093/64
| VLAN External connected
ROUTE fe80::%vlan4094/64
| VLAN Internal connected
ROUTE ff02::/64
| VLAN tmm0 auto
ROUTE ff02::%vlan4093/64
| VLAN External auto
ROUTE ff02::%vlan4094/64
| VLAN Internal auto
there is no management route configured, but it seems still work. - viks_96432Did you manage to crack this ? I am also in a similar fix. I can't understand how F5 is routing requests for subnets that it's not aware of :(
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
