Forum Discussion
yeser
Nimbostratus
Dec 05, 2008it's possible to rewrite mac address?
Hi,
I have this deployment in my customer's network
Internal client sends a request to a server without going through BIG IP (It might be in this way). Default route of this server is BIG IP self ip.
Server response obviously goes through big ip via VS_FORWARDING but BIG IP forward the response to fw with its mac address and the fw detects it like IP SPOOFING. It's possible that BIG IP send the response with client MAC address?
Thanks in advance
29 Replies
- nitass
Employee
but the problem is the server's IP were not reachable. it is not reachable because incoming packet goes from external client, router and then server but return packet would go from the server to bigip and i guess bigip would drop it. not sure if stateless virtual server (handle return traffic) would help. anyway, i think specific virtual server (ip or port) could work. - Spidey_29396
Nimbostratus
Hi NItass,
Thank you for your response. i have the following servers:
202.126.41.X
202.126.45.X
202.126.34.X
Would you mind giving me example of VS to be configured in this case? - Spidey_29396
Nimbostratus
Hi Nitass,
Also, i have read some regarding proxy arp and vlan-group creation.do i need to? - nitass
Employee
can you try something like this?root@ve1110(Active)(/Common)(tmos) list ltm virtual vs_wildcard_forwarding ltm virtual vs_wildcard_forwarding { destination 0.0.0.0:0 ip-forward mask any profiles { my_route_friendly_fastl4 { } } translate-address disabled translate-port disabled vlans-disabled } root@ve1110(Active)(/Common)(tmos) list ltm profile fastl4 my_route_friendly_fastl4 ltm profile fastl4 my_route_friendly_fastl4 { app-service none defaults-from fastL4 loose-close enabled loose-initialization enabled reset-on-timeout disabled }
sol7595: Overview of IP forwarding virtual servers (Emulating stateless IP routing with BIG-IP LTM forwarding virtual servers)
http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html - Spidey_29396
Nimbostratus
Hi Nitass,
Thank you so much. It seemed to be working on our lab. We will schedule this since we need window time to implement this action item.Also, do we really need to disable reset-on-timeout? also, why do we need to enable loose-close and loose-initialization? - nitass
Employee
why do we need to enable loose-close and loose-initialization?bigip maintains connection state. since incoming packet does not pass through bigip but return packet does, without enabling loose initiation bigip would drop return packet.
do we really need to disable reset-on-timeout? i think it might work even enabling reset-on-timeout. anyway, the sol emulates stateless ip routing, so i think it does not want bigip to interfere connection (i.e. by resetting). - Spidey_29396
Nimbostratus
Hi Nitass,
Thank you so much.I'll be posting the result once done.
Thanks!
Ferdz - Spidey_29396
Nimbostratus
Hi Nitass,
The configuration you suggested works on live environment. Thank you so much! - Spidey_29396
Nimbostratus
Hi Nitass,
The configuration you suggested works on live environment. Thank you so much!
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects