For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

StephanManthey's avatar
StephanManthey
Icon for Nacreous rankNacreous
Feb 11, 2015

Hi Ed,

 

AutoLastHop saves the ingress VLAN and peer MAC address in the connection table.

 

This way responses will be returned to the client exactly the same path the request came in.

 

It saves routing table lookup and prevents asymmetric traffic flow.

 

AutoLastHop will cause issues, if the next hop MAC address becomes unavailable.

 

As far as I understand, a router is not using the virtual MAC address to forward a packet but puts in it´s own MAC address as source. If the router becomes unavailable the virtual server still tries to forward response packets to the disappeared MAC address and the connection will time out.

 

From my perspective this issue affects primarily long lasting connections.

 

Turning off AutoLastHop requires to lookup the BIG-IP´s routing table to forward responses and has probably a performance impact.

 

As the stored MAC address belongs to the router it should not matter, if there are additional layer 2 components between the BIG-IP and your router/firewall gear.

 

Thanks, Stephan