For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wintrode_61162's avatar
Wintrode_61162
Icon for Nimbostratus rankNimbostratus
Aug 09, 2012

IPv6 Routing Loop?

Basic setup is dual stack with completely unrelated v4/v6 addresses. One v4 self IP and one v6 self IP per VLAN along with one floater address for v4 and one v6 using vmac (HA pair).

 

We are doing per VLAN gateway with two fastL4 forwarders configured per VLAN (one v4 0.0.0.0:* and one v6 0:0:0:0:0:0:0:0.*).

 

Question is are there any settings I need to be on the lookout for that would prevent this looping? Or has anyone else seen this behavior?

 

 

 

 

 

 

When tracing externally, I see the trace bouncing between my upstream router interface and the VIP until it hits 30 hops.

 

 

 

Update - ICMP traceroutes seem to work fine, issue is with UDP traceroutes. Is there some oddity with how F5 handles UDP traceroutes to a vip?

 

config
design

2 Replies

  • Wintrode_61162's avatar
    Wintrode_61162
    Icon for Nimbostratus rankNimbostratus
    Aug 09, 2012
    Update2 - OK, so thinking about it now, the default behavior for a UDP traceroute to an IPv4 VIP is that it times out (by design) since the VIP in this case is TCP only, so it drops the UDP packets...why does it not drop the UDP traceroute to the IPv6 VIP?
  • Jessed12345's avatar
    Jessed12345
    Icon for Employee rankEmployee
    Aug 26, 2012

    Wintrode,

     

     

    I may be necro'ing this thread, but I ran into a sorta-similar behavior on v11.1-hf2, and would recommend that you open a support case. What I encountered is not exactly identical to what you observed, however I was seeing every UDP packet being handled by a forwarding vip being duplicated. and since my config used two forwarders (to and from a router playing the part of "proxy" server), each incoming UDP packet received on my client side resulted in four packets being sent through LTM (three duplicates). I know it's not what you are seeing exactly, but between your report and what I've been seeing over the last couple days, you may want to find out if support has any more information.

     

     

    EDIT: corrected the version.