Persistence and loadbalancing

Then, if you need persistence to the app tier, source IP persistence (doesn't matter whether SNAT enabled or not) on the inside VIP will also work (but is not going to necessarily give you even load across the app tier).

 

How is using SNAT on the outside F5 going to give you any sort of reasonable persistence on the inside F5 if all requests are coming from the same IP address? Without SNAT, the client's true source should be available to the inside F5 for real persistence, arguably not perfect though.

 

If source address is not a stable value, and you can't do something like universal persistence (something in the payload), then really the only viable approach is cookies. You must not, however, use the default BIGipServer cookie on the internal F5 as that contains the encoded value of selected pool and node on one F5, and would not necessarily work for the other. Create a cookie persistence profile on the internal F5 that does not use the default BIGipServer name. Use regular (default) cookie persistence on the external F5. You should see both cookies at the client after the first response, and you should see the internal cookie reach the internal F5 and persist accordingly.

 

How is using SNAT on the outside F5 going to give you any sort of reasonable persistence on the inside F5 if all requests are coming from the same IP address? 

You should always use SNAT when oneconnect is enabled, as oneconnect can hide true source IP, and using a SNAT is a way of explicitly indicating that the source IP you are seeing is not 'real' (otherwise people who are trying to troubleshoot who don't know about oneconnect may think they are seeing the actual client source IP). The point I was trying to make above was that using SNAT or not makes no difference in this situation as...

Without SNAT, the client's true source should be available to the inside F5 for real persistence, arguably not perfect though.

The source IP seen by the inside 'app' tier will be the source IP of the 'web' tier, not the actual client IP. It's irrelevant whether SNAT is used on the web tier VIP or not.

Using source IP persistence on the inside tier (which will use the web tier IP) is not going to get a smooth load distribution, however it's about as good as you are going to get unless the web tier acts as a proxy and passes L7 information like cookies, from the client request, down to the request made to the inside tier, and passes cookies from the app tier back to the client.