Routing UDP SIP responses to Via Address

I don't have a particular rule to help with that, but I'm curious what about the SIP::via command isn't working for you?

 

 

Colin

The [SIP::via sent_by] is pulling the correct ip out of the Via, we can log it to syslog and it is ok.

 

The node [SIP::via sent_by] just isn't routing the request back to the ip.

 

If we do a TCP dump on the F5, the response UDP message is not being sent to that ip.

 

 

This may be a testing issue.

 

We are unable to recreate our real issue readily, so to test the iRule we inject a different ip in the Via.

 

Our syslog shows that we are passing this other IP to the node command, but the packet is still routed to the original client_addr.

 

 

Does the F5 disallow changing the ip to one that is not in it's list of "connected" clients?

 

 

 

Thanks

With the node command you should be able to route traffic to whatever IP you want. I'm a little confused as to why the same command would log the correct IP but then direct traffic to the wrong one. That doesn't make much sense to me. Do you have a copy of the iRule in question I could look at?

 

 

Thanks,

 

Colin

What I included previously is the entire thing (minus a log statement).

 

 

when SIP_RESPONSE {

 

log local0. "Sending Response to: [SIP::via sent_by]"

 

node [SIP::via sent_by]

 

}

 

 

We have traffic from IP1 to the F5 VIP (VIP), out to a sip endpoint (SIP).

 

The traffic arrives at (SIP) with a SNAT IP on the F5.

 

We modify our sip response to force a VIA of another test box (IP2) to test the routing of the iRule.

 

The response is sent back to the SNAT IP and our iRule is executed.

 

We see "Sending Response to: (IP2)", but the tcpdump shows the packet is sent to (IP1).

 

 

Thanks

 

My guess is you are running node command on server-side of the connection.

 

in that case, node command may not have any effect.

 

 

can you do something like this

 

 

log local0. "serverside=[serverside]"

 

 

if it log serverside=1, you may read more. otherwise, you may ignore the rest of this post.

 

 

with default udp profile, BIG-IP treats UDP as a connection oriented which means BIG-IP does not make LB decision for returning traffic (which means node command does not have any effect)

 

 

to configure bigip to to perform LB decision for returning traffic. you may need to use immediate timeout in UDP profile

 

- assign immediate timeout udp profile to VIP (be careful, this may affect all traffic)

 

- create VIP2 (which is same as SNAT IP) to intercept returning traffic. apply your iRule to VIP2

 

 

Thanks

 

Nat