Forum Discussion

mreco_159588's avatar
mreco_159588
Icon for Cirrus rankCirrus
Jun 08, 2017

No response after added virtual server IP address as floating self-IP address

Hi,   I have an F5 HA pair that serves several virtual servers.   VS1: ip1   VS2: ip2   Now, the IP address of VS1 (ip1) was already defined as a floating self-IP, but I found out that th...
application delivery
BIG-IP
LTM
self ip
virtual server
  • mreco_159588's avatar
    mreco_159588
    Jun 14, 2017

    It was driving me nuts, since I just want to understand what's going.

     

    After reading this post: https://devcentral.f5.com/questions/self-ip-address-selection-with-multiple-to-choose-from, I checked the firewall logs again. And now the pieces fit.

     

    On the Virtual Servers I have SNAT Automap enabled. When I only have one floating self IP, that floating self IP is used to initiate traffic to backend servers. When I add more floating self IPs, it will use any of those floating self IPs to initiate traffic towards the backend servers.

     

    The firewall between the F5 and the backend servers does not accept this traffic, meaning not actually the VS stopped responding after I added the VS IP address as a floating self IP, but the firewall blocked traffic towards the backend servers.

     

    So, conclusion (just to summarize):

     

    • only one floating self IP is needed for SNAT communication towards the backend servers (if the amount of connections is less than 65000, otherwise more are needed and I must define a SNAT pool or allow the other floating IP addresses to communicate to the backend servers)
    • I will remove the unneeded floating self IP, since they're not needed for a VS to function as a listener IP

    Thanks all for your help!

     

marin_266716's avatar
marin_266716
Icon for Nimbostratus rankNimbostratus

Im confused, you said floating IP but you also said VS, are you adding a floating IP and thinking it will be the VIP for a pool?

 

VS1 = VIP1 (Application 1) VS2 = VIP2 (Application 2)

 

Self IP = IP in segment used to to reach into segments for monitoring or other purposes.

 

A Self IP is just that, in an HA cluster you could have 2-3 IP's per VLAN. 2x would be 1 Self IP (Non-Floating) per device in your HA group. The 3rd IP would be the floating IP added to the Active node and synced across to the standby. Floating IP's sync, self IP's do not. The Floating IP can be used as a default gateway for instance since it will always follow the active member.

 

What are you trying to accomplish with said "Self/Floating IP"

 

marin_266716's avatar
marin_266716
Icon for Nimbostratus rankNimbostratus
Jun 14, 2017

Let me read this and digest what your real setup is based upon your examples.

 

Example:

 

VLAN 10 = External (204.12.15.0/24)

 

VLAN 20 = Internal (10.0.0.0/24)

 

 

To keep you moving on last bullet in your answers. This needs to be looked at on the switch side. For example, if you have 2x 1G interfaces (1.1/1.2) on the Big-IP going in a Port Channel on the switch (2G aggregate) and say VLAN 10 is the only VLAN trunked in the Port Channel. Then on the F5 I would create a "Virtuals" trunk and add interface members 1.1 and 1.2. On the other side I would use 1.3/1.4 as my "Virtuals" and trunk VLAN 20 on the switch on that side. From there you can then create your VLAN's on F5 and create say vlan_10 with tagged 10 traffic and the same for vlan_20 tagged for vlan 20.

 

My point in the last bullet is, you need to verify on the switch, what VLAN is going into which "trunk" on both the switch and F5 side.

 

Again let me kind of whiteboard what you put for the VS examples above and I will respond.