For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Peter_Z's avatar
Peter_Z
Icon for Cirrus rankCirrus
Apr 12, 2011

Internal server to VIP from other than Internal subnet

Hello,

 

 

I'm curious, if it is possible to have servers behind the internal BIG-IP vlan to access the VS (VIP) that is either from the External BIG-IP subnet (same as the external vlan self-IP) or other subnet that exists on the BIG-IP (other than external or internal subnet).

 

 

 

For example:

 

 

server is on the internal subnet 10.10.10.0/24 (big-ip self-ip 10.10.10.51)

 

VS1 in on the external big-ip subnet 192.168.1.80 (big-ip self-ip 192.168.1.51)

 

VS2 is from the subnet other than the above (for example: 172.16.16.80)

 

 

 

I was testing (open a webpage) such a configuration in LTM-VE, but i was not able to access the VIP successfully unless I have defined a STATIC nat for the server. I was getting RST packets from the BIG-IP, however the ping to both VIPs was successfull.

 

 

 

Is the behavior different if the server (working as a client) is not directly from internal big-ip subnet but other subnet reachable via the Internal big-ip vlan ?

 

 

 

Thanks

 

config
design

3 Replies

  • Minn_62043's avatar
    Minn_62043
    Icon for Cirrostratus rankCirrostratus
    Apr 12, 2011
    You can add a forwarding ip virtual server on BIG-IP. As long as the servers on internal vlan knows how to route the traffic to BIG-IP, it should be able to access the servers elsewhere.
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Apr 13, 2011
    If listener object e.g. virtual server, snat, nat is enabled on that vlan i.e. internal vlan, server should be able to access it.
  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Apr 13, 2011
    I agree with nitass.

    If you do not want to configure SNAT Automap full time then you can use an iRule to engage SNAT when it is talking to another device on a different subnet of the same device.

    Create a Data Group (mynetwork in this example) and add the subnets for the BigIP into it. This example is for v10.x.x. 

    
when CLIENT_ACCEPTED {
if { [class match [IP::client_addr] equals mynetwork] } {
snat automap
}
}