Forum Discussion
LJB_107563
Nimbostratus
NimbostratusICMP from the server pool
I have what is probably a really basic question, but I cannot find an answer in any of the ASM docs.
I have a pair of ASM 4100's that I have just started to configure. These are setup as inline active passive.
Behind them, I have two web servers in different pools with separate VIP's.
I have SNAT's setup so that the server owners can access those servers for maintenance.
From the actual server on the backside (pool) they cannot ping anything beyond the F5's. Do I need to create another SNAT for the reverse? The customers are freaked out that they cannot ping out from the servers, even though they really don't need too.
Thanks,
Len
hoolioCirrostratus
Hi Len,
SOL7366 (Click here) details the steps required to allow ICMP through a SNAT:
A SNAT passes ICMP traffic when SNAT Packet Forwarding is set to All Traffic. The All Traffic setting specifies that the BIG-IP system forwards any IP packets originating from a SNAT member for all traffic types.
To configure a SNAT to forward all traffic, perform the following procedure:
1. Log in to the Configuration utility.
2. Click System, then click General Properties.
3. From the Local Traffic menu, select General.
4. Change the SNAT Packet Forwarding setting to All Traffic.
5. Click Update.
What type of SNAT(s) have you defined?
Aaron
LJB_107563I have two VIP-Pool mappings. One for the http/s service and the other for any port/protocol. I built the SNAT and everything is working perfectly, I just cant ping from the server to the public side.- hoolioAre you able to make a TCP based request from the hosts to the destination they want to be able to ping through the SNAT? If so, you should just need to set the global option for SNAT packet forwarding to 'All Traffic'.
If you try that, are you able to ping from the pool members to the destination(s)?
Aaron - LJB_107563Yes, they can access any service (backup, ftp, etc) to any server, but to those same servers, no icmp...
>global option for SNAT packet forwarding to 'All Traffic'.
I am lost as to where you set global options for the SNAT. I have them set to all VLANS, but I dont see all traffic unless you aare talking about the vip or the pool settings. - LJB_107563DOH!
Thanks a million... I just went through and figured it out. I was thinking pool/vip, you were talking SNAT only. That worked, thanks.