Forum Discussion

amiranti1982_54's avatar
Icon for Nimbostratus rankNimbostratus
Dec 06, 2011

I have a F5-LTM sandwiched between ASAs and a CheckPoint firewall... Need route help!

I am trying to set up a complicated system of firewalls stacked on one another inside of a DMZ.



I have configured a CheckPoint as my outside (outside to the DMZ) firewall facing the public. The inside interface is plugged directly into one of the Ethernet ports on the F5. Also on the F5, I have another interface (on the same VLAN as the CheckPoint) plugged into a Cisco switch.



From there I have two ASA 5520 devices plugged into the same switch and configured with DMZ VLAN IP addresses as their outside interface address. Their inside IP addresses are RFC 1918 and connect to a core 7606 router.



My main question is, how do I route the F5 to talk to the ASAs, which I would like to load balance behind the F5?



The CheckPoint communicates back and forth with the F5 and the Cisco Switch. The CheckPoint also communicates back and forth with the F5. The ASAs can both communicate with the Cisco switch, BUT the ASAs (both configured on the same VLAN) are unable to communicate with the F5. I have set the ASA device's gateway as the CheckPoint IP address as well as the F5 IP (separately) with no luck. I need routes back to the ASAs, but I am unclear on how to do that. There are a lot of options in creating routes.



I have tried to keep this as simple as possible, however. I am running into complications. The F5 has been set up with a VLAN 115, self IP and two untagged physical interfaces, virtual server for the VIP of the ASAs, a pool for both ASA devices for load balancing, and no definite routes for connectivity.



I have created a drawing of the network layout, but it will not upload to this page. I can send it to anyone that feels it would be helpful in assisting me.


12 Replies