But the point is that Ii don't want the F5 to change anything in the packet including the MAC address...
Imagine the F5 connected via a 4 interfaces trunked together to a another router which will be the next hop.
on each of those 4 cables there is a "tapper" that just looks at the packets (it doesn't bridge or route them, just observes them).
Sound like using a trunk with a desired 'Frame Distribution Hash' can actually be the solution. However in case one of those 4 cables fails I don't want the entire remaining 3 cables to rehash, just the failed server.
For example:
I have 4 bump-in-the-wire servers on each of the 4 cables in the trunk.
user with IP 1.1.1.1 under normal circumstances goes via cable 1 and user with IP 2.2.2.2 under normal circumstances goes via cable 2.
Now server on cable 1 fails, I want that 1.1.1.1 will be moved to one of the other 3 cables but I don't want 2.2.2.2 to move from cable 2 to any other cable (as cable 2 didn't fail)
Normal trunk can't achieve that...
I need something like the CARP algorithm just that the group members will be physical interfaces rather than IP entities.
Hope it's clear....
Yaniv