Forum Discussion

yeser's avatar
yeser
Icon for Nimbostratus rankNimbostratus
Dec 05, 2008

it's possible to rewrite mac address?

Hi,

 

 

I have this deployment in my customer's network

 

 

Internal client sends a request to a server without going through BIG IP (It might be in this way). Default route of this server is BIG IP self ip.

 

 

Server response obviously goes through big ip via VS_FORWARDING but BIG IP forward the response to fw with its mac address and the fw detects it like IP SPOOFING. It's possible that BIG IP send the response with client MAC address?

 

 

Thanks in advance

29 Replies

  • but the problem is the server's IP were not reachable. it is not reachable because incoming packet goes from external client, router and then server but return packet would go from the server to bigip and i guess bigip would drop it. not sure if stateless virtual server (handle return traffic) would help. anyway, i think specific virtual server (ip or port) could work.
  • Hi NItass,

     

     

    Thank you for your response. i have the following servers:

     

     

    202.126.41.X

     

    202.126.45.X

     

    202.126.34.X

     

     

    Would you mind giving me example of VS to be configured in this case?
  • Hi Nitass,

     

     

    Also, i have read some regarding proxy arp and vlan-group creation.do i need to?
  • can you try something like this?

    root@ve1110(Active)(/Common)(tmos) list ltm virtual vs_wildcard_forwarding
    ltm virtual vs_wildcard_forwarding {
        destination 0.0.0.0:0
        ip-forward
        mask any
        profiles {
            my_route_friendly_fastl4 { }
        }
        translate-address disabled
        translate-port disabled
        vlans-disabled
    }
    root@ve1110(Active)(/Common)(tmos) list ltm profile fastl4 my_route_friendly_fastl4
    ltm profile fastl4 my_route_friendly_fastl4 {
        app-service none
        defaults-from fastL4
        loose-close enabled
        loose-initialization enabled
        reset-on-timeout disabled
    }
    

    sol7595: Overview of IP forwarding virtual servers (Emulating stateless IP routing with BIG-IP LTM forwarding virtual servers)

    http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html
  • Hi Nitass,

     

     

    Thank you so much. It seemed to be working on our lab. We will schedule this since we need window time to implement this action item.Also, do we really need to disable reset-on-timeout? also, why do we need to enable loose-close and loose-initialization?
  • why do we need to enable loose-close and loose-initialization?bigip maintains connection state. since incoming packet does not pass through bigip but return packet does, without enabling loose initiation bigip would drop return packet.

     

     

    do we really need to disable reset-on-timeout? i think it might work even enabling reset-on-timeout. anyway, the sol emulates stateless ip routing, so i think it does not want bigip to interfere connection (i.e. by resetting).
  • Hi Nitass,

     

     

    Thank you so much.I'll be posting the result once done.

     

     

    Thanks!

     

     

    Ferdz
  • Hi Nitass,

     

     

     

    The configuration you suggested works on live environment. Thank you so much!

     

     

  • Hi Nitass,

     

     

     

    The configuration you suggested works on live environment. Thank you so much!