Forum Discussion
meena_60183
Nimbostratus
NimbostratusSelf-IP and VS is not pingable
I used the following link
http://devcentral.f5.com/Forums/tabid/53/aft/20979/afv/topic/Default.aspx
to implement Cisco NAC on our network using BigIP. I changed the drawing to inc...
meena_60183Nimbostratus
NimbostratusI took a tcpdump while pinging the real server IP from the BigIP and here is some of the relevant data
----------------------------------
09:26:07.597576 802.1Q vlan351 P0 10.60.252.4 > 10.60.252.6: icmp: echo request (DF)
09:26:07.597576 802.1Q vlan5 P0 arp who-has 10.60.252.4 tell 10.60.252.6
-------------------------------------
When I do a "ping 10.60.252.6" from BigIP, I am not sure why vlan5 is asking for ARP. The real server itself is a Cisco appliance and the traffic goes to vlan351 (10.60.252.6) on the untrusted side and gets routed through vlan 5 (10.60.99.6) which is on the trusted side.
In this case, BigIP's selfIP(10.60.252.4) is on the same subnet and I do not know why it is trying to send the traffic through the other side. The routing table on the appliance only has a default route and it points to the trusted side which is on vlan 5.
The etherchannel on the Cisco side used to allow only necessary vlans but I made it to allow all vlans now. The trunk config on the BigIP uses LACP in active mode. After I made this change, I could ping the self IP on vlan 6 (10.60.98.4) and the VS (10.60.98.11). The problem migrated to vlan 351 now which is the real server vlan.
Meena
