Forum Discussion

gmac263_33890's avatar
gmac263_33890
Icon for Nimbostratus rankNimbostratus
Apr 12, 2012

How to handle servers that do not need to be load balanced?

I have a customer that would like to use F5 BIG-IP 3600 load balancing device between the an Internet route-able segment and a server segment. He has some servers that he wants to load balance and he has other servers that he wants to be able to access directly from the internet without load balancing them. Can he do this even though the non-load balanced servers are on the same segment as the load balanced servers all behind the BIG-IP 3600? Is there any technical reason that he should create two segments, one behind the F5 load balancing device for load balanced servers and another segment not behind the F5 load balancing device for non-load balanced servers?

 

 

Thanks

 

 

 

GM

 

config
design
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Apr 12, 2012
    Hi GM,

     

     

    Can he do this even though the non-load balanced servers are on the same segment as the load balanced servers all behind the BIG-IP 3600?

     

     

    Sure. If the destination host's default gateway isn't LTM, you'd want to use SNAT to ensure responses from the host come back through LTM.

     

     

    You can use a virtual server without load balancing. Here's a SOL with more detail:

     

     

    SOL7229 - Methods of gaining administrative access to nodes through the BIG-IP system

     

    https://support.f5.com/kb/en-us/solutions/public/7000/200/sol7229.html

     

     

    Is there any technical reason that he should create two segments, one behind the F5 load balancing device for load balanced servers and another segment not behind the F5 load balancing device for non-load balanced servers?

     

     

    As stated above, you don't have to have two separate VLANs on LTM. But it can be advantageous from a security and access control perspective to have all access to the servers done through virtual servers on LTM.

     

     

    Aaron
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Apr 12, 2012
    For my hosts I usually put them all into DMZ's by platform (Separate VLAN's for Windows/Linux/Unix) and some organisations like to segregate Prod/Non-Prod... Also I tend to segregate by level of auth. e.g. Public/Open servers. Servers that require Auth. It does mean a larger than normal number of DMZ's, but you can craft firewall rules by VLAN quite fictively that way (e.g. Windows servers need certain access back inwards where they require access to AD etc... Not that I advise using internal AD from the DMZ, but some organisations require it).

     

     

    To access non load-balanced services, use a network VS.

     

     

    For extra security I also like to have separate external and internal VLAN's on the BigIP (Where you have separate firewalls separating the DMZ from the external nets and DMZ from internal nets. That way you can also ensure VS's are limited where required (e.g. network VS's can be active only on the VLAN connecting to the internal networks for example). You can also configure your network VS's to that access from DMZ to DMZ needs to pass via the firewalls rather than being directly routed across the LTM...

     

     

    H

     

     

    H