one arm setup and two vlans

tolinrome,

Your setup sounds very typical and is what is called the default setup. You have two vlans, an external, and internal. Your Vips are on the external (ingress), and usually Pool members on the internal (egress). The only caveat to your design is that both vlans are running over the same physical interface. The most common deployment would have the two vlans on thier own physical interface: example: interface 1.1 = vlan-external , interface 1.2 - vlan-internal Your design should work, BUT, I would recommend breaking those vlans to separate interfaces AND possibly setup LACP for redundancy in case a physical port dies. This would eliminate a single point of failure.

From my perspective dual arm setup is more of standard deployment and makes understanding the traffic flow much easier. Whether you use the LTM as a forward or backward proxy is up to you. I have used a one arm design when migrated from another vendor onto the F5 to keep the initial migration simple.

If you need an IDS or a sniffer with a dual arm you need additional taps and or span monitor setups.

Thanks for your response. Can you confirm what I wrote in the first paragraph of my understanding of how I have it currently setup as a one arm?

If you want use one arm scenario, you don't need 2 vlans. Besides, if you use 1 fisical interface that may doesn't mean one arme deployment, because of using vlans on it. I think using one arm depends where you virtual servers will be presented and nodes will be located.

Robin, thanks that was a clear response. So is my setup that I explained typical? I understand what you wrote but I have it where the F5 is not the default gateway for the application servers, all the vips are on a different subnet than the application servers, am I am using autopmap. So its a little different than how you explained it. I don't know if its then considered a one arm or not.

I don't know if I would get too hung up on trying define your configuration as "one-armed" or "two-armed", as much as I would look at your ingress and egress path. Also this definition of one-armed versus routed, or two-armed is not a global setting. You have the ability to have configurations where the egress path for some application servers happens to be on the same ingress path, and other configurations on the same device that follow a different data flow. The biggest differentiator in your topology is going to be wether or not you need to apply SNAT(automap or a snat-pool) to a virtual server.

I thought automap was snat?

automap is snat with the (floating) selfIP used as source address. snat can also be used with a snat pool where you determine yourself which IP is used a source.