For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dmetcalfe_13626's avatar
Dmetcalfe_13626
Icon for Nimbostratus rankNimbostratus
Jul 17, 2014

Inline load balancing

So, I know this question has been asked before but there appears to be no clear answer. I need to preserve the source IP so that our spam server can detect brute force hack attempts on a customer fac...
application delivery
design
LTM
mimlo_61970's avatar
mimlo_61970
Icon for Cumulonimbus rankCumulonimbus
Jul 17, 2014

You need a forwarding virtual server if your backend servers initiate new connections out their default gateway(the F5) The F5 isn't a router, it needs a VS that maps to a pool containing your upstream router to handle the requests.

 

Being these are mail servers and probably deliver mail outside of your network as well as probably grab updates/signatures, I would assume you need this. There are other implementations though where the backend servers only receive traffic through the default gateway, so a forwarding virtual isn't necessary.

 

A real-world example I have is a VPN gateway that only accepts connections, it learns routes to internal networks via other interfaces, gets managed/updated through a management interface, and never needs to initiate a new connection outbound to the internet via its default gateway. No forwarding vs was needed in this implementation.

 

  • Dmetcalfe_13626's avatar
    Dmetcalfe_13626
    Icon for Nimbostratus rankNimbostratus
    Jul 18, 2014
    Thanks for replying. Right now I have a forwarding virtual server that has the gateway as its pool member, but what your saying is that it should be the upstream device thats a pool member instead? That makes sense and that's where I was having a gap, because I couldn't figure out how it would route beyond that without a static route or some other means of getting outside. I am still foggy on how the traffic will work though. Are you saying its ok to have a bunch of VS serving different ports AND a forwarding VS? The traffic will still get load balanced to my backend servers with this config?