Forum Discussion
How to allow F5 to do basic routing and allow out of order syn-acks
Hi,
I am pretty new to F5 Load balancers so this might be a very simple question.
I have below setup:
Client --- > LB (VIP) ---> Servers.
- I am not SNATing so the LB retains source IP when sending traffic to the servers.
- But, to ensure that return traffic traverses via LB, I have added a static route on my servers (just for my client IP) to go via LB's interface self IP (IP in the subnet of my nodes/servers).
When I access VIP with this setting, I am not able to load the page completely - which I believe might be something in our application.
But, even if I access the node directly (with static route on servers), LB seems to drop the return traffic. I see SYN-ACKs being RST. (It does not see the SYNs because it probably follows different path).
I have Forwarding IP Virtual server (With FastL4) allowing on all VLANs for any source and any destination.
I am running 15.1.0 version.
Verified that F5 can ping client IP and back-end nodes.. so it knows how to reach back the client.
Any ideas why F5 would block out of order SYN-ACKs? Is there any other obvious configuration that I missed?
Create a new fastL4 profile based on the default called fastl4_loose and select loose init and loose close. Disable reset on timeout. Apply it to your virtual server
5 Replies
- PeteWhite
Employee
Create a new fastL4 profile based on the default called fastl4_loose and select loose init and loose close. Disable reset on timeout. Apply it to your virtual server
- Charles_Lamb
Nimbostratus
You might also need an outbound SNAT configured to SNAT the traffic back to the VIP.
- Sayali
Altocumulus
Yeah.. unfortunately we have a requirement to not use SNATs and retains the source IPs. But, thanks for your help.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
