Forum Discussion
NimbostratusRouted VS SNAT Deployment
Typically, we always use SNAT in our environment. I have a scenario now where I need to retain source IPs from clients thus disabling SNAT.
Here is what I have configured thus far:
1) Created a new VS with a type of "Forwarding IP," a destination network of 0.0.0.0, and a mask of 0.0.0.0. The VS is bound to all ports. It also has a fastL4 profile assigned to it, and is bound to all VLANs and all protocols.
2) Defined a default route on the BIG-IP to a gateway that can reach all of our internal applicable networks.
3) Configured the server's default gateway as the floating self-IP on the corresponding VLAN.
From the server, I can reach all external networks. However, I can not access the server FROM a remote network. I can however ping it, but all TCP connections fail (SSH, etc).
What configuration am I missing here? My goal is to be able to access the server (which has the LTM defined as it's gateway) from any network via it's assigned IP address and not a VS.
Is this possible?
Thanks for any help!
18 Replies
Josh_41258This brings me to another question..
Would it be easier/best practices to carve out a new /24 for example, and directly connect it to the BIG-IP instead of attempting to use networks that are not directly connected? Essentially, make the BIG-IP the "router" for this dedicated network. Then, create one static route on our cores (which the BIG-IPs are connected to) for this new directly connected network?
Josh
- JRahm
Admin
if you need the source IP to actually be the IP (instead of passed in a header) then the BIG-IP needs to be inline for all routing or you need to use npath routing.
nitass_89166Noctilucent
15:59:51.130145 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568921727 ecr 0,nop,wscale 7], length 0 15:59:52.129598 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568922727 ecr 0,nop,wscale 7], length 0i think the 2nd packet may be the one from bigip to server. if i am correct, the problem could be routing on server. in tcpdump, you may include "-e" to show mac address.
- JRahma full second to pass through the BIG-IP? Looks like a second SYN attempt to me.
- nitass_89166good point. thanks!
- nitass
Employee
15:59:51.130145 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568921727 ecr 0,nop,wscale 7], length 0 15:59:52.129598 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568922727 ecr 0,nop,wscale 7], length 0i think the 2nd packet may be the one from bigip to server. if i am correct, the problem could be routing on server. in tcpdump, you may include "-e" to show mac address.
