For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dayesh_381792's avatar
Dayesh_381792
Icon for Nimbostratus rankNimbostratus
Feb 06, 2019

One connect profile query.

Hello All,   Just for a better understanding of Oneconnect profile function, from the KB5911 I learned following line :   " OneConnect applies a mask (much like applying an independent subnet m...
application delivery
LTM
wlopez's avatar
wlopez
Icon for Cirrocumulus rankCirrocumulus
Feb 06, 2019

As far as the oneconnect profile goes:

 

A mask of 0 (default value) causes the system to share reused connections across all source addresses.

 

A host mask of /32 (that is, all 1 values in binary) causes the system to share only those reused connections originating from the same source address.

 

You also need to take into account that persistence profiles and SNATs can affect if connections will be reused. When you are using a SNAT or SNAT pool, the server-side source address is translated first and then the OneConnect mask is applied to the translated address.

 

wlopez's avatar
wlopez
Icon for Cirrocumulus rankCirrocumulus
Feb 06, 2019

If you have the both SNAT Automap or SNAT pool on the virtual server, and a oneconnect profile active on the virtual server, the egressing SNAT address on the server side will be the one that the BigIP will apply the oneconnect mask to.

 

Haven't done any captures of that configuration to validate this.

 

But that's what I would expect to happen.