For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

TechT's avatar
TechT
Icon for Nimbostratus rankNimbostratus
Jan 09, 2017

Proxy arp disable

Hi,

 

I have a Forwarding VIP which is configured for /24 subnet with ARP and ICMP echo enabled, i see all the hosts are reachable from the subnet if the hosts are alive (or) NOT alive. I guess this is something expected behaviour of LTM where the connections are proxying and returning to ping. Could anyone let me know how can i disable the proxy arp for the hosts which are not live in the network. (iRule or inbuilt option is also fine)

 

application delivery
iRules
LTM

3 Replies

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Jan 10, 2017

    Hi Maneesh,

    to transparently forward ICMP-PING packets to the destination IPs, you have to turn off "ICMP Echo" and "ARP" on the 10.X.33.0 Virtual Address object.

    ltm virtual-address 10.X.33.0 {
    address 10.X.33.0
    arp disabled
    icmp-echo disabled
    mask 255.255.255.0
    spanning enabled
    traffic-group traffic-group-1
}

    After the change your F5 should stop to answer ICMP-Pings for IPs that are either not in use nor currently reachable.

    Cheers, Kai