How to handle servers that do not need to be load balanced?

Hi GM,

 

 

Can he do this even though the non-load balanced servers are on the same segment as the load balanced servers all behind the BIG-IP 3600?

 

 

Sure. If the destination host's default gateway isn't LTM, you'd want to use SNAT to ensure responses from the host come back through LTM.

 

 

You can use a virtual server without load balancing. Here's a SOL with more detail:

 

 

SOL7229 - Methods of gaining administrative access to nodes through the BIG-IP system

 

https://support.f5.com/kb/en-us/solutions/public/7000/200/sol7229.html

 

 

Is there any technical reason that he should create two segments, one behind the F5 load balancing device for load balanced servers and another segment not behind the F5 load balancing device for non-load balanced servers?

 

 

As stated above, you don't have to have two separate VLANs on LTM. But it can be advantageous from a security and access control perspective to have all access to the servers done through virtual servers on LTM.

 

 

Aaron

For my hosts I usually put them all into DMZ's by platform (Separate VLAN's for Windows/Linux/Unix) and some organisations like to segregate Prod/Non-Prod... Also I tend to segregate by level of auth. e.g. Public/Open servers. Servers that require Auth. It does mean a larger than normal number of DMZ's, but you can craft firewall rules by VLAN quite fictively that way (e.g. Windows servers need certain access back inwards where they require access to AD etc... Not that I advise using internal AD from the DMZ, but some organisations require it).

 

 

To access non load-balanced services, use a network VS.

 

 

For extra security I also like to have separate external and internal VLAN's on the BigIP (Where you have separate firewalls separating the DMZ from the external nets and DMZ from internal nets. That way you can also ensure VS's are limited where required (e.g. network VS's can be active only on the VLAN connecting to the internal networks for example). You can also configure your network VS's to that access from DMZ to DMZ needs to pass via the firewalls rather than being directly routed across the LTM...

 

 

H

 

 

H