Forum Discussion
Policy Routing in Multi-Arm Deployment
- Dec 07, 2022
Have a look at this , Auto Last Hop (this is the same as Netscalers MAC-based forwarding (MBF)
https://support.f5.com/csp/article/K13876
Hi mOjO,
using iRules its the only way setting up Policy-Based-Routing (PBR) based on SRC_IP and DST_IP. The [class match] syntax of the iRules outlines in K20510467 is just "one" example how your PBR could be setup. You may also use native [if] expressions or [switch] statement to express your needs.
When designing such a PBR, then elect to most used routing scenario as your "default" and use F5s routing table to establish the routing as usual. The use the iRule to overwrite routing decissions based on your needs.
when CLIENT_ACCEPTED {
if { ( [IP::addr [IP::client_addr] equals "10.0.0.0/8"] )
and ( [IP::addr [IP::local_addr] equals "10.0.0.0/8"] ) } then {
# Let the build-in routing table forward traffic for:
#
# src=10.0.0.0/8 to DST=10.0.0.0/8
} elseif { ( ( [IP::addr [IP::client_addr] equals "172.16.0.0/12"] )
or ( [IP::addr [IP::client_addr] equals "192.168.0.0/24"] ) )
and ( ( [IP::addr [IP::local_addr] equals "172.16.0.0/12"] )
or ( [IP::addr [IP::local_addr] equals "192.168.0.0/24"] ) ) } then {
# Let the build-in routing table forward traffic for:
#
# src=172.16.0.0/12 or src=192.168.0.0/24 to DST=172.16.0.0/12 or DST=192.168.0.0/24
} elseif { ( [IP::addr [IP::client_addr] equals "10.0.0.0/8"] )
and ( [IP::addr [IP::local_addr] equals "20.20.20.0/24"] ) } then {
# Overwrite next hop to GW=10.10.10.1 for:
#
# src=10.0.0.0/8 to DST=20.20.20.0/24
nexthop 10.10.10.1
} elseif { [IP::addr [IP::client_addr] equals "10.0.0.0/8"] } then {
# Overwrite next hop to GW=10.10.20.1 for:
#
# src=10.0.0.0/8 to DST=REMAINING DESTINATIONS
nexthop 10.10.20.1
} else {
# let the build-in routing table handle remaining traffic...
}
}
Cheers, Kai
Sorry missed the part that only RETURN traffic from your VS should follow the ingress path. So yeah... AUTO Last-Hop (enabled by default) doing already the trick.
Cheers, Kai
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com