For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Enfield303's avatar
Enfield303
Icon for Nimbostratus rankNimbostratus
Dec 31, 2020

Persistence and NAT

Hello, we're using an F5 BIG IP active/passive cluster to loadbalance Always On VPN connections. To avoid asymmetric routing we're using NAT, so the VPN gateway servers will always see the same IP ad...
application delivery
BIG-IP
persistence
Amine_Kadimi's avatar
Amine_Kadimi
Icon for MVP rankMVP
Jan 07, 2021

SNAT is not the problem here IMHO, as it should not affect the load balancing between backend servers nor the persistence entry. Just check the persistence mask in the source address profile and make sure it is tight enough.

You can also issue the following command to display the current content of the source address persistence table:

tmsh show ltm persistence persist-records all-properties
  • Enfield303's avatar
    Enfield303
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2021

    Hello Amine, thanks once again for getting back to me - I've assumed that it is sending everyone to the same backend server but thats only based on 3 test connections which were all sent to the same server (we have 3 backend servers) - so do you think adding 255.255.255.255 to the mask will result in proper loadbalancing, even though all connections will come from the same IP address?