Forum Discussion
Ctan
Nimbostratus
NimbostratusReplying to NTP requests from a Virtual Server IP
Hi, I am trying to configure the F5 to function as a NTP server, but through a virtual server instead of a self IP. The KB only has information about setting it up on a self IP. Is this possible? ...
Kin
Employee
EmployeeBig-IP as NTP server - DevCentral (f5.com)
may be useful... In the above use case, it's a Performance (layer 4), UDP virtual server with Pool created consisting of NTP servers. If things don't work, try toggling "Port translation", SNAT= Automap, and take tcpdumps at the BIG-IP and NTP servers to verify requests are reaching. Hope it works out.
- Ctan
Good stuff.. but unfortunately not quite the use case I'm looking for.
Due to the security requirements of our environment the NTP servers are unreachable from the data plane of the F5. So the goal was to hopefully have the F5 sync up to our stratum1 servers via the management interface, then service requests from clients via a VS.
Is there a way to have the F5 process NTP requests from a VS or to redirect requests from into the VS into a self IP?
- Kin
I may not have connected the dots fully on the security requirements, but to the last qn: The system does not allow us to create a self IP and add it as a pool member. So one way to direct requests from a VS to a self IP is through a Forwarding virtual server with the same IP address as the SelfIP. The forwarding VS can have the configuration described in the UDP VS in Overview of IP forwarding virtual servers (f5.com)
- Ctan
I'll describe the actual scenario so it makes more sense: We currently have an old cisco router providing NTP services for our client network running over 900 terminals. The router is unfortunately on its last legs due to age and needs to be taken out of the network.
The plan is to configure the router's IP address as a VS on the F5 and have it do NTP without having to reconfigure the terminals individually.
The security contraint i mentioned is that the primary NTP servers behind the F5 are only reachable via tha management interfaces and are on a completely separate network, so i can't use it as a pool as it won't be reachable.
Was hoping there was a way to do a combination of NAT or rerouting that can be done on just the F5 so that I avoid having to stick NAT somewhere upstream.