Forum Discussion
Persistence and loadbalancing
How is using SNAT on the outside F5 going to give you any sort of reasonable persistence on the inside F5 if all requests are coming from the same IP address?
You should always use SNAT when oneconnect is enabled, as oneconnect can hide true source IP, and using a SNAT is a way of explicitly indicating that the source IP you are seeing is not 'real' (otherwise people who are trying to troubleshoot who don't know about oneconnect may think they are seeing the actual client source IP). The point I was trying to make above was that using SNAT or not makes no difference in this situation as...
Without SNAT, the client's true source should be available to the inside F5 for real persistence, arguably not perfect though.
The source IP seen by the inside 'app' tier will be the source IP of the 'web' tier, not the actual client IP. It's irrelevant whether SNAT is used on the web tier VIP or not.
Using source IP persistence on the inside tier (which will use the web tier IP) is not going to get a smooth load distribution, however it's about as good as you are going to get unless the web tier acts as a proxy and passes L7 information like cookies, from the client request, down to the request made to the inside tier, and passes cookies from the app tier back to the client.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com