For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Zdenda's avatar
Zdenda
Icon for Cirrus rankCirrus
May 17, 2014

MAC masquerading in v11.

Hi, I checked articles here nad here. And do I understand correctly that in v11 there is used only one floating MAC address for ALL vlans configured on F5? We use only one traffic group so it seems to be the case. In version 10.2.4 we have floating MAC specified for each vlan separately.

 

Thanks, Zdenek

 

design

4 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 17, 2014

    tm.macmasqaddr_per_vlan is introduced in 11.2.0.

    ID378464 - Need a way to associate mac masquerade address with vlan index (db variable)

    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list sys db tm.macmasqaddr_per_vlan
sys db tm.macmasqaddr_per_vlan {
    value "false"
}
  • Zdenda's avatar
    Zdenda
    Icon for Cirrus rankCirrus
    May 17, 2014

    Thank you Nitass, I do not insist to have own floating MAC for each vlan. My question was more if it can be problem to use one floating MAC for all vlan interfaces on LB. Do you think it is safe? Or did somebody else have some problem with this feature in version 11.x?

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 17, 2014

    My question was more if it can be problem to use one floating MAC for all vlan interfaces on LB. Do you think it is safe? Or did somebody else have some problem with this feature in version 11.x?

     

    i understand as long as switch uses fdb (forwarding database) table per vlan, it should work just fine.

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    May 19, 2014

    Just to add to clarify this for others, it's a single MAC address for all self IP addresses in a single Traffic Group. If it was for all VLANs and you had multiple Traffic Groups split across two or more devices you'd have some real problems with the same MAC appearing on multiple switch ports.