For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

syavash's avatar
syavash
Icon for Nimbostratus rankNimbostratus
Jul 22, 2019

Layer 2 nodes migration to Layer 3

Hello,

i have 2400 nodes, over 1200 VLANs. my F5s (cluster of two 7050) has direct leg in the VLANs. i need to move this communication to a L3 path.

i already have the path and routes ready. now here are my questions:

  1. will i experience a hiccup?
  2. how do i avoid saturation of port+IP for the backend traffic?

i have some dev envs that i can test the solution first.

please help

application delivery
LTM
node
TMSH

6 Replies

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Jul 23, 2019

    You can set up SNAT pools if "SNAT automap" does not provide enough capacity.

     

    [Edit: removed "For inline services...."]

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Aug 02, 2019

    Please also see "K7336: The SNAT Automap and self IP address selection".

     

    Normally one sets up two addresses for each VLAN on a BIG-IP device, one local and one floating. If there is a very large number of clients, there could be a situation of port collision occurring. A SNAT pool of multiple addresses for each VLAN would then help.

     

    Are you planning to have your app server use F5 as the gateway?

  • syavash's avatar
    syavash
    Icon for Nimbostratus rankNimbostratus
    Aug 05, 2019

    thanks for your response. no, there is a (or more) transitive VLAN between the F5 and our firewall. then nodes talk to F5 through the firewall.

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Aug 06, 2019

    It could be really hard to trouble-shoot in the new architecture, difficult for the operation. F5 itself is a certified security device, and can provide the functionality of a firewall.