OCSP with Route Domains

Ok, I have now the whole picture. The "forwarding" VS, which is Standard-type VS in our setup needs to have an IP-address out from a directly connected VLAN. Before I used a dummy 192er address, that's why I never saw traffic or required a dedicated route for this IP. We used a VIP-address from our heartbeat VLAN, as there were still some free IPs available. But you can also create a complete new dummy VLAN with at least one self-IP in it. In both cases this VLAN needs to be part of the Common partition/route domain. Additionally you need to set the "Parent Name" of the route domain where you need the OCSP feature to "0". This allows your non-Common route domain to check the routing table of the Common route domain, which includes the "forwarding" VS as a directly connected VLAN. So no additional static route is required and even "Strict Isolation" can be left enabled.

On top of that I combined this solution with the proxy emulating iRule, because the LB in our setup is not allowed to communicate towards the Internet. This works also like a charm.

Ciao Stefan :)