Forum Discussion
Leslie_South_55
Nimbostratus
NimbostratusIn-Line or One-Arm LTM Placement
OK, so this may be a little "BigIP 101" but I wanted to ask the question anyway. I have been using v9 bigip for about 2 years now, and during the first implementation, we put the LTM smack dab in the...
Hannes_RappNimbostratus
NimbostratusI do not approve ingress SNAT or SNAT pools in any circumstance :p
True L3 IP visibility on a lower level is the cornerstone of smooth troubleshooting. These days, such networks are a minority, but I always advocate for the use of 2 Default Gateways (IP rules) in end-servers, if F5 cannot be the only default gateway.
BigIP with explicit use of SNAT (one-arm/one-VLAN deployment) may work, but there are CAUTIONS:
- Loss of availability to run tcpdump against true client-src-IP in end-servers, and any other device in line after BigIP. This alone, without considering any other facts or variables, makes the deployment unclean/dirty.
- Risk breaching TCP src-port limits on Server-Side. You can have ~64k concurrent server-side connections from your SNAT-IP to a pool member (dest-ip/port-no combo). It makes it far easier to breach those limits if more clients are stacked up on the same src-IP.
- Once the limit above is breached, you are likely to opt for 'SNAT Pools' - this will convert your infrastructure into a clusterfuck.
- Now, as a dedicated administrator of a clusterfuck infrastructure, what kind of evidence can you provide to an external party, to convincingly prove that incident is not linked to a "possible network issue on your side"? What will you say if they ask for a tcpdump against their source IP-address from the end-servers?
JRahm
Admin
AdminI try to be less dogmatic in my advice. As much as we would all love the ideal greenfield deployment, the reality is far from that, so knowing all the options and how to best deal with them is important.