For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chuck_Brantley_'s avatar
Chuck_Brantley_
Icon for Nimbostratus rankNimbostratus
Apr 17, 2014

Inline F5 not working

Scenario:

 

Two real servers behind the F5. Real server have the F5 private interface as their DG. VIP is setup for the pool with the two real servers. Forwarding VIP is setup for inbound and outbound traffic to the real server ip address.

 

Issue:

 

Client can reach the server pointing to the real server ip address, but not the virtual ip address. If SNAT is turned on, the VIP will work.

 

Any and all ideas are welcome. This is a test environment so changes can be made.

 

16 Replies

  • What appears to be happening is that the VIP is being advertised by the standby box. I have confirmed this by looking at the tables. The route to the real server, however, goes through the primary f5. That must be why turning SNAT on fixes the issue. How do I get the VIP to advertise out of the primary box and not the standby>

     

  • How do I get the VIP to advertise out of the primary box and not the standby

    can you check if virtual address is associated to correct traffic group?

    e.g.

    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual-address 172.28.24.10
    ltm virtual-address 172.28.24.10 {
        address 172.28.24.10
        mask 255.255.255.255
        traffic-group traffic-group-1
    }
    
  • admin@(SJ505DCF51)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual-address 10.200.40.100
    ltm virtual-address 10.200.40.100 {
        address 10.200.40.100
        floating disabled
        mask 255.255.255.255
        traffic-group none
        unit 0
    }
    

    I show none, how do I assign the VIP to the default traffic class? Specifically in the GUI?

    EDIT: I just found it. Is this something I will need to do for each VIP, or can I make each VIP I create default with this?

  • I show none, how do I assign the VIP to the default traffic class? Specifically in the GUI?

    this is for tmsh.

    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) modify ltm virtual-address 172.28.24.10 traffic-group ?
    Specifies the traffic group for the virtual address. The default traffic group is inherited from the containing folder.
    

    for gui, it is at local traffic > virtual servers > virtual address list.

  • This appears to have resolved my issue. I will be upgraded to 11.4.1 HF3 next week to address this bug. Thanks for your help.