Forum Discussion
Scott_C_16492
Feb 15, 2011Nimbostratus
Network Virtual Servers
Hi I'm trying to create a single virtual for a range of IPs pointing to the same pool.
All added ok via the gui, here's the config looks like:
virtual address 94.136.40.224 {
mask 255.255.255.248
}
virtual wildcard-test.vs {
pool http.linweb.pool
destination 94.136.40.224:http
mask 255.255.255.248
ip protocol tcp
profiles
http
tcp
}
So I'm expecting everything in 94.136.40.224/29 to listen to port 80 and forward traffic through to the pool http.linweb.pool
This doesn't work as expected though.
Doing a tcpdump on the LTM, I see my router arp'ing for the IP, but the LTM doesn't respond:
[me@biggerip01:Active] ~ tcpdump -i vlan704 net 94.136.40.224/29
tcpdump: listening on vlan704
14:39:02.406927 arp who-has 94.136.40.224 tell 94.136.40.254
14:39:05.411933 arp who-has 94.136.40.224 tell 94.136.40.254
Running a pair of 6400s with 9.4.8 HF4
Any ideas what I'm doing wrong, or is this not how the network VIPs work?
Scott
- Chris_MillerAltostratusWith this setup, you're essentially saying anything destined for 94.136.40.224/29 over HTTP should be sent to pool http.linweb.pool with address translation disabled. So, you haven't necessarily created an instance at 94.136.40.224/29. You've created a specific method by which to access that network via pool http.linweb.pool.
- HamishCirrocumulusThink of a network virtual server as a router. Anything destined for the IP range specified by the VS address and Mask will be routed to the destination 9Pool in your case).
- hc_andy_35682NimbostratusWhat Hamish says is exactly right on...
- STTR_85331NimbostratusHi folks,
- johnsEmployeeSimon, if you have the network only exists on the LTM, I am not sure you will need the network VS. Network VS is meant to allow traffic to transit through LTM when host on one side/VLAN of the LTM wants to get to the other side/VLAN. Something like, your server side is 1.1.1/24 and your firewall side is 2.2.2/24, then for firewall to get to the server side, you will need to configure 1.1.1.0 network VS and enable it on all vlans, or at least on the firewall side.
- STTR_85331NimbostratusThanks for the response. The reason for the network virtual is that I'm using it with an irule and data group to pass through traffic to a set of servers without any load balancing. Don't ask why this traffic needs to go through the LTM in the first place - let's just call it for "historical reasons"!
- HamishCirrocumulusHmm..
- STTR_85331NimbostratusSure - I've attached a simplified version of my lab setup. I agree that the firewall shouldn't be expecting an ARP response for the network VS - it should be using it's static route to send traffic for the network VS to the LTM's external IP.
- STTR_85331NimbostratusTrying again for an attachment upload...
- HamishCirrocumulusAre you SNAT'ing the traffic through the network VS destined for the two servers? It doesn't say you are, but you'd have to if they're not in the 10.10.60.0/24 subnet (And the diagram has them as 10.10.10.11 and 10.10.20.12).
Recent Discussions
Related Content
Â
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects