Pool members on same subnet as VIP

Hi Luca,

The only issue I see is if the clients are on the same subnet as the pool members. In that case, to ensure symmetric routing, you need to use source address translation (SNAT) so the server will reply back to the client via LTM.

I assume the connection flow would be something like this:

   client 
      |
-----------------------
  |           |
 LTM       ISA
              |
-----------------------
           |
          servers

If so, you shouldn't need to do anything special for the LTM virtual server config. If the ISA server's default gateway isn't the LTM self IP, you'd need to enable SNAT on the virtual server.

Aaron

The clients will be on an internal network. The ISA servers will be in our DMZ - so the servers and clients will be on different subnets.

i agree with Aaron. enabling snat on virtual server could be enough.

If the clients are on a different subnet, just ensure that the return path from server to client is via the same F5 interface as the one that forwards the traffic TO the server (Poolmember).

 

 

No SNAT required.

 

 

H