Forum Discussion

Enfield303's avatar
Enfield303
Icon for Nimbostratus rankNimbostratus
Dec 31, 2020

Persistence and NAT

Hello, we're using an F5 BIG IP active/passive cluster to loadbalance Always On VPN connections. To avoid asymmetric routing we're using NAT, so the VPN gateway servers will always see the same IP ad...
application delivery
BIG-IP
persistence
Amine_Kadimi's avatar
Amine_Kadimi
Icon for MVP rankMVP
Jan 02, 2021

Hi,

 

Source address persistence should not result in one member receiving all traffic unless there is an upstream device that does source address translation and masks the actual client IP or -most likely- you are using a wide mask (0.0.0.0) in the source address persistence profile, which is the default if you choose none for the mask field. You may need to narrow this mask to something like 255.255.255.255 to have a unique persistence entry for each /32 address.

 

Also check this: https://cdn.f5.com/product/bugtracker/ID752933.html

  • Enfield303's avatar
    Enfield303
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2021

    Hello Amine, yes we're doing source address translation so therefore the backend servers do not see the client IP address, they just see the address of the physical interface on the F5 - this means that due to the persistence profile, it keeps sending all clients to the same backend server - so I was wondering what my other persistence options are to avoid that and have proper loadbalancing accross all backend servers