For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brerr's avatar
Brerr
Icon for Nimbostratus rankNimbostratus
Apr 14, 2020

Newbie LTM lab setup question

I'm setting up a lab to do v simple LTM Load balancing, I have a small/medium knowledge of f5 and have got quite a way in but am struggling at what I think is the final hurdle I have 2 VMS (192.168....
application delivery
BIG-IP
LTM
Mayur_Sutare's avatar
Mayur_Sutare
Icon for MVP rankMVP
Apr 14, 2020

What is default gateway configured on DNS servers??

If it is not F5 Ip then in your case, it will cause Assymetric routing issues. This is because DNS servers response will not go through F5 and session will be incomplete. So to avoid this situation, SNAT is the option that you are talking about. By keeping SNAT settings to automap, you can overcome Assymetric routing​ issues and response from DNS will go via F5.

​

Please enable SNAT and then check traffic.

​

Mayur​

  • Brerr's avatar
    Brerr
    Icon for Nimbostratus rankNimbostratus
    Apr 14, 2020

    Thanks for the reply really appreciated, that has helped my understanding a little but not solved my problem. The DNS servers as you guessed do not have a default gateway pointing at the f5s.

    The virtual server is 10.0.0.10

    The selfip is 10.0.0.100

    The VM (linux1) is 192.168.33.20

    I'm sending the dns query to 10.0.0.10 and can see it appearing on the vm as follows

    Without SNAT

    19:01:09.559313 IP 10.0.0.1.64843 > linux1.domain: 10311+ [1au] A? www.pwei.org.uk. (44)

    With SNAT automap

    19:03:07.364072 IP 10.0.0.101.50310 > linux1.domain: 47897+ [1au] A? www.pwei.org.uk. (44)

     

    As you can see both of these are from 10.x which will not work as the VM will answer this down it's default gateway (Which is on a different interface on the VM)

     

    I think the DNS query would have to come from the 192.168.33.0/24 network for this to work.

     

    Thoughts?

     

    Thanks

     

    Brett