Nimbostratus
MVPIn that case internal F5 will see all the traffic as coming from the same IP so you won't be able to persist based on source IP. One alternative is to inject X-Forwarded-For header from the upstream device and retrieve it in the LB and persist based on it using an irule. You can find an example here: https://devcentral.f5.com/s/question/0D51T00006i7grt/enable-source-ip-persistence-based-on-x-forwarded-ip-info
NimbostratusThanks again Amine; does that work even when my traffic is not HTTP (its port 4500 & 500 UDP VPN traffic)
MVPSorry, I didn't notice that this is for vpn traffic. In this case xff header is not applicable as it only works with http(s) traffic
NimbostratusIf we disabled SNAT on all the devices above the internal F5s, do you hink that would work?
MVPYes it should. And if you have two VS one for 500 and a second for 4500 you'll likely need to share persistence between them using the Match Across Services of the persistence profile.