Hi, I have configuration: NET => FW => F5 => SRV I have VS1 which forwards traffic to SRV (no SNAT used, not possible to do XFF so source address of client is seen). F5 is def gw for SRV. On F5 there is also forwarding IP VS 0/0 and def route to FW. FW also have static route for SRV subnet poiting to F5. Questions: 1. Client from net goes to VS1 (SNAT off) is redirected to SRV (source address is seen, destination nat is in place to pass traffic to SRV). I assume that return traffic from SRV is hitting VS 0/0 (am I right?) VS 0/0 have snat off. And I also assume that source address of SRV is changed to VS1 IP (am I also right?). If not, should I do some SNAT on VS 0/0? Second example. When server is originating connection to NET it hits VS 0/0, is that right? No SNAT is configured so source address of server is seen outside? The route on FW pass traffic back to SRV via F5. If point 1 is true (so when return traffic is automatically SNATed back to VS1 IP) what determines that traffic is SNATed or not? Is it previously created session/entry for DNAT when traffic originating from Net hits VS1?

There is mistake in question numbers. I do not know why I cannot edit it. Before "Second example" should be "2" and of course instead of 2 should be 3

Please paste full configuration of your 0.0.0.0/0 VS. There are many ways the routing can be done.

ltm virtual forward-all { destination 0.0.0.0%8:any ip-forward mask any profiles { fastL4-test { } } source 0.0.0.0%8/0 translate-address disabled translate-port disabled vlans { server-vlan } vlans-enabled vs-index 307 } ltm profile fastl4 fastL4-test { app-service none defaults-from fastL4 loose-close enabled loose-initialization enabled reset-on-timeout disabled }

inline configuration

26 Replies

Hannes_Rapp_162
Nacreous
Oct 31, 2014
"... Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1"

SIP is 192.168.1.1

"(https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic."

Response packets are already routed back as per connections table records, not as per virtual server configurations. You certainly don't have to configure 1.1.1.1 VS to ensure response packets are routed back.
- thomass87_91937
  Nimbostratus
  Nov 02, 2014
  Hannes, now it is clear for me. Thank you for explanation. I have also question regarding my VS 0/0 configuration. I asked it under VS 0/0 configuration above.
Hannes_Rapp
Nimbostratus
Oct 31, 2014
"... Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1"

SIP is 192.168.1.1

"(https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic."

Response packets are already routed back as per connections table records, not as per virtual server configurations. You certainly don't have to configure 1.1.1.1 VS to ensure response packets are routed back.
nitass_89166
Noctilucent
Nov 03, 2014
Second example. When server is originating connection to NET it hits VS 0/0, is that right? No SNAT is configured so source address of server is seen outside? The route on FW pass traffic back to SRV via F5.

yes unless you also have snat list configuration.

It is enabled only on server-vlan. If I understand correctly when the server itself is originating connection outside it will hit VS 0/0. How does this configuration applies when connection is originating from another subnet (for example behind FW) to server IP address (not VS1). Connection will be dropped/rejected? Should VS 0/0 listen on all vlans to allow such connections?

yes connection will be rejected. bigip is default deny device. to allow traffic, object listener (i.e. virtual server, snat, nat) is required.

sol9038: The order of precedence for local traffic object listeners

https://support.f5.com/kb/en-us/solutions/public/9000/000/sol9038.html
- thomass87_91937
  Nimbostratus
  Nov 03, 2014
  OK, it is clear now. Thanks.
nitass
Employee
Nov 03, 2014
Second example. When server is originating connection to NET it hits VS 0/0, is that right? No SNAT is configured so source address of server is seen outside? The route on FW pass traffic back to SRV via F5.

yes unless you also have snat list configuration.

It is enabled only on server-vlan. If I understand correctly when the server itself is originating connection outside it will hit VS 0/0. How does this configuration applies when connection is originating from another subnet (for example behind FW) to server IP address (not VS1). Connection will be dropped/rejected? Should VS 0/0 listen on all vlans to allow such connections?

yes connection will be rejected. bigip is default deny device. to allow traffic, object listener (i.e. virtual server, snat, nat) is required.

sol9038: The order of precedence for local traffic object listeners

https://support.f5.com/kb/en-us/solutions/public/9000/000/sol9038.html
- thomass87_91937
  Nimbostratus
  Nov 03, 2014
  OK, it is clear now. Thanks.
thomass87_91937
Nimbostratus
Nov 20, 2014
Hi,

I have also another question: Do I really need: loose-close enabled loose-initialization enabled configuration? Or in inline configuration when the all traffic is passing thru F5 I do not need this settings? (I think they should be enabled in nPath architecture). Please correct me if I am wrong.
- nitass
  Employee
  Nov 23, 2014
  yes, npath is one example. another example is when you do not want to keep track of connection. sol7595: Overview of IP forwarding virtual servers (Emulating stateless IP routing with BIG-IP LTM forwarding virtual servers) https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html