Forum Discussion

solmon_191529's avatar
solmon_191529
Icon for Nimbostratus rankNimbostratus
Mar 10, 2015

Real Ip address for non http servers

Hi Team

 

I have a situation which i am try to solve , basically i have non-http service hosted behind my load balancers here. currently the servers are not in a vlan attached to f5 , so using SNAT to make it work. and currently the VIP is a Performace L4 VIP with SNAT enabled.

 

and now the application team needs the Real IP address of their clients and as its not http i am unable to change the VIP type to standard and apply a http profile with "x-forwarded for" enabled.

 

and the application team does not want to move their server vlan to vlan behind the load balancer.

 

any possibility with irules , if yes please help me .

 

many thanks in advance

 

S

 

application delivery
deployment
devops
iRules
LTM
TMSH

4 Replies

  • mhite_60883's avatar
    mhite_60883
    Icon for Cirrocumulus rankCirrocumulus
    Mar 10, 2015

    Sounds like you'll have to look at DSR (direct server return) or VXLAN.

     

    DSR over a routed network:

     

    https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-1-0/6.html

     

    VXLAN:

     

    https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-implementations-11-4-0/10.html

     

    It's also possible to implement "proxy-protocol" using an iRule (I have done it in the past). Your application developers would need to accomodate this on the server side. See:

     

    https://aws.amazon.com/blogs/aws/elastic-load-balancing-adds-support-for-proxy-protocol/

     

    https://devcentral.f5.com/questions/proxy-protocol-irule-implementation

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Apr 30, 2015

    You do also have these options;

     

    1) Adjust your routing so that the return traffic passes through the F5s (possibly in combination with a VRF)

     

    2) Use Policy Based Routing (PBR)

     

    3) Connect your F5 directly to the VLAN in question (assuming that is physically and logically possible) and use static routes on the servers to ensure return traffic goes through it

     

    Either way, its seems like a huge amount of work and added complexity to accommodate your server team. Rather than looking for a technical solution, I'd say it would be worth talking to them again and explaining your challenge and the downsides of all these solutions.

     

  • solmon's avatar
    solmon
    Icon for Nimbostratus rankNimbostratus
    Apr 30, 2015

    indeed it is a complex situation , due to their current vlan which is multicast capable they are unwilling to move to an inline f5 vlan , have asked them to get additional NIC so that they can have MC and LB capabilites both.

     

    thank you for you for the kind responses.

     

    much appreciated.

     

Related Content