Forum Discussion

syavash's avatar
syavash
Icon for Nimbostratus rankNimbostratus
Jul 22, 2019

Layer 2 nodes migration to Layer 3

Hello,

i have 2400 nodes, over 1200 VLANs. my F5s (cluster of two 7050) has direct leg in the VLANs. i need to move this communication to a L3 path.

i already have the path and routes ready. now here are my questions:

  1. will i experience a hiccup?
  2. how do i avoid saturation of port+IP for the backend traffic?

i have some dev envs that i can test the solution first.

please help

application delivery
LTM
node
TMSH
  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Jul 23, 2019

    You can set up SNAT pools if "SNAT automap" does not provide enough capacity.

     

    [Edit: removed "For inline services...."]

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Aug 02, 2019

    Please also see "K7336: The SNAT Automap and self IP address selection".

     

    Normally one sets up two addresses for each VLAN on a BIG-IP device, one local and one floating. If there is a very large number of clients, there could be a situation of port collision occurring. A SNAT pool of multiple addresses for each VLAN would then help.

     

    Are you planning to have your app server use F5 as the gateway?

  • syavash's avatar
    syavash
    Icon for Nimbostratus rankNimbostratus
    Aug 05, 2019

    thanks for your response. no, there is a (or more) transitive VLAN between the F5 and our firewall. then nodes talk to F5 through the firewall.

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Aug 06, 2019

    It could be really hard to trouble-shoot in the new architecture, difficult for the operation. F5 itself is a certified security device, and can provide the functionality of a firewall.