iRule to mimic Cisco ACL for Forwarding VIP

Hi Andy,

 

 

Thanks for clarifying; you were on the right track. LTM is stateful in that it tracks the ICMP request in its connection table and allows the response back to the client that originated the request. This is the same behavior for TCP and UDP. The google host wouldn't be able to originate requests through the LTM VIP as it's not in the trusted address datagroup.

 

 

You could (and should) only enable the forwarding virtual server on the internal VLAN that the hosts you want to allow are on. This adds another layer of protection against accidental routing of unwanted traffic through LTM.

 

 

Aaron