Forum Discussion

superblue1999_8's avatar
superblue1999_8
Icon for Nimbostratus rankNimbostratus
Dec 14, 2010

How does the IP forwarding works ?

Hi everyone,

 

 

I got a BIGIP LTM VE working after countless hours, however I still don't quite understand how come it works in terms of routing ... I hope some one can help me to understand the IP forwarding of this platform.

 

 

Here is my setup, all the VM are on a single ESX server with vswitch

 

 

Web_server1------vlan 52-----BIGIP --------Vlan 52--------IP cloud -----------Vlan 100 -------Testing Client

 

|

 

Web_server1------vlan52---------

 

 

All the three NIC on BIGIP is in Vlan 52 network.

 

 

I configured 192.168.1.1 as the selfip on 1.1 interface, and two web servers are using it as the default gateway, it is working, but how come it works ?

 

 

1. All the web servers and self IP are in 192.168.1.0/24 network

 

2. the virtual IP is in 10.0.0.0/24 network, there is no other route configured

 

3. the management IP is in 10.0.0.0/24 network, with a default route

 

 

When I send a HTTP request to the webserver, my source IP is not in any of the subnet that BIGIP is aware of, so I guess it needs a default route to return to me, but I didn't configure it anywhere, the only default route configuration is for the management port.

 

 

How come it works ?

 

 

Thanks a lot

 

 

Harry.

 

ve
virtualization

4 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 14, 2010
    Hi Harry,

     

     

    If all of the NICs are on the same subnet, you should be able to define a single VLAN and add the port(s) to the VLAN. You probably don't need to use multiple VM interfaces unless that's somehow adding resilience on the physical network.

     

     

    On a normal LTM appliance, you wouldn't be able to define a virtual server on the management subnet. I assumed that would also be the case for the LTM virtual edition. I'd guess your scenario is working because TMM is using the management default route.

     

     

    I would suggest defining the virtual servers on a switch port (vlan 52) and not using the management subnet. You can define a TMM route via the GUI under Networking >> Routes. For details on mgmt and TMM routing, you can check SOL

     

     

    SOL3669: Overview of management interface routing

     

    http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3669.html

     

     

    Aaron
  • superblue1999_8's avatar
    superblue1999_8
    Icon for Nimbostratus rankNimbostratus
    Dec 15, 2010
    Hi Aron,

     

     

    Thanks for the reply.

     

     

    I modified my lab, now I have separate VLANs for internal, external and management, now my lab is broken if I access the virtual IP from another subnet other than the external VLAN.

     

     

    I configured the default route, and now the routing table look like this:

     

     

    [root@test-f5:Active] config bigpipe route show

     

    ROUTE default inet

     

    | VLAN External static

     

    ROUTE 10.0.0.0/24

     

    | VLAN External connected

     

    ROUTE 127.1.1.0/24

     

    | VLAN tmm0 connected

     

    ROUTE 192.168.1.0/24

     

    | VLAN Internal connected

     

    ROUTE fe80::/64

     

    | VLAN tmm0 connected

     

    ROUTE fe80::%vlan4093/64

     

    | VLAN External connected

     

    ROUTE fe80::%vlan4094/64

     

    | VLAN Internal connected

     

    ROUTE ff02::/64

     

    | VLAN tmm0 auto

     

    ROUTE ff02::%vlan4093/64

     

    | VLAN External auto

     

    ROUTE ff02::%vlan4094/64

     

    | VLAN Internal auto

     

     

     

    if it is a Cisco router, I expect the default route should have a next-hop IP, so when it forwards the traffic, it knows where to forward to, in F5 routing table, it looks there is no next hop, only the VLAN, how can the F5 box knows the mac-address to encap the packet ?

     

     

    Sorry if this question is too obvious, I am digging F5 from scratch, and have no background what so ever : -0

     

     

    Harry.
  • superblue1999_8's avatar
    superblue1999_8
    Icon for Nimbostratus rankNimbostratus
    Dec 15, 2010
    hmm, it looks it can work without any routing configured, I removed all the routing and only leave with connected interface, and I can still access the VIP from outside.

     

     

    is this some kind of F5 magic ?

     

     

    [root@test-f5:Active] config bigpipe route show

     

    ROUTE 10.0.0.0/24

     

    | VLAN External connected

     

    ROUTE 127.1.1.0/24

     

    | VLAN tmm0 connected

     

    ROUTE 192.168.1.0/24

     

    | VLAN Internal connected

     

    ROUTE fe80::/64

     

    | VLAN tmm0 connected

     

    ROUTE fe80::%vlan4093/64

     

    | VLAN External connected

     

    ROUTE fe80::%vlan4094/64

     

    | VLAN Internal connected

     

    ROUTE ff02::/64

     

    | VLAN tmm0 auto

     

    ROUTE ff02::%vlan4093/64

     

    | VLAN External auto

     

    ROUTE ff02::%vlan4094/64

     

    | VLAN Internal auto

     

     

    there is no management route configured, but it seems still work.
  • viks_96432's avatar
    viks_96432
    Icon for Nimbostratus rankNimbostratus
    Sep 23, 2012
    Did you manage to crack this ? I am also in a similar fix. I can't understand how F5 is routing requests for subnets that it's not aware of :(