For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

KaiTT's avatar
KaiTT
Icon for Nimbostratus rankNimbostratus
Nov 30, 2022

In nPath configuration, BIG-IP does not send ICMP reply to the L3 switch.

Hi All, 1) The Client sends an ICMP request to the 20.20.20.10 node IP destination. 2) Since the G/W of the Node is self-IP of BIG-IP, ICMP reply is sent to BIG-IP via the L3 switch. 3) BIG-...
announcement
application delivery
cloud
devops
event
security
Mohamed_Ahmed_Kansoh's avatar
Mohamed_Ahmed_Kansoh
Icon for MVP rankMVP
Nov 30, 2022

Hi KaiTT , 

> you should change your configuration little bit , use one of two scenarios :

  1.  Change the default gateway for "20.20.20.1" instead of using Bigip self-ip as a gateway , and configure
    ( SNAT automap or SNAT pool ). 
    by this scenario , ICMP traffic should go through L3 swith without forward it to Big-ip
    All of this with respect to your routes.
  2. Configure a fast layer 4 virtual server on your Big-ip and do not assign tcp profile to it , allow all protocols. 
    After creating it , go to virtual address and configure "echo-reply = disabled " not "always" 
    like below : 

in this scenario , ICMP traffic should go through Bigip to server 20.20.20.10 and return back to F5 big-ip " its gateway" 

> you only need to adjust your traffic flow , I recommend to do the first scenatio , using SNAT is very useful , so try it. 

Regards. 

KaiTT's avatar
KaiTT
Icon for Nimbostratus rankNimbostratus
Dec 01, 2022

Hi  Mohamed,

Thank you for your kind reply.

As I mentioned to Kai, the automap is not available.

I am testing it because I think it can be solved with forwarding VS.

Thanks.