For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Enfield303's avatar
Enfield303
Icon for Nimbostratus rankNimbostratus
Dec 31, 2020

Persistence and NAT

Hello, we're using an F5 BIG IP active/passive cluster to loadbalance Always On VPN connections. To avoid asymmetric routing we're using NAT, so the VPN gateway servers will always see the same IP ad...
application delivery
BIG-IP
persistence
Enfield303's avatar
Enfield303
Icon for Nimbostratus rankNimbostratus
Jan 13, 2021

Thanks Amine - yes we do have upstream devices also doing SNAT:

 

client machine on internet

|

|

\|/

Azure cloud loadbalancer (required for cloud F5 loadbalancer failover)

I

|

\I/

Cloud F5 loadbalancer

|

|

\|/

Organisation firewall

I

|

\I/

Internal F5 loadbalancer

|

|

\|/

Backend VPN servers

 

I'm assuming that if I disable source address translation / SNAT on everything above the internal F5 loadbalancers then it should work as you've described?