Forum Discussion

Dave_Mulligan_1's avatar
Dave_Mulligan_1
Icon for Nimbostratus rankNimbostratus
Feb 01, 2014

Sideband connection coming from 127.1.1.3: virtual server can't reply. How to fix?

Hi all,

I have an iRule configured on a virtual server that is attempting to make a sideband connection to another virtual server. The target virtual server also has an iRule, and everything works just fine when I target that virtual server directly. However, when I try to use the virtual server from within the iRule, the connection times out. Here is the relevant section of iRule code:

 

set sidebandRequest "GET /service?$payload HTTP/1.1\r\n\r\n"
set sidebandServer [connect -protocol TCP -timeout 100 -idle 5 -status connect_status $static::SBVirtualServer]
send -status send_status -timeout 300 $sidebandServer $sidebandRequest
set sidebandResponse [recv -status recv_status -timeout 1000 $sidebandServer]

 

When I look at the packet capture for the sideband connection attempt, I see this:

so I think that the root of my problem might be that 127.1.1.3 source address: it seems clear that the server at 192.168.0.111 won't be able to send any responses back to there. I had an idea that I might want to configure address translation on the source virtual server, so I tried that. I used both the "automap" setting, and the "SNAT Pool" setting, with a pool I created using the LTM's address on that 192.168.0.x network. No joy with either approach.

Am I in the right general area? How should I fix this?

Thanks

Dave

  • In the Sideband connect command you can set the IP and port to source the connection from. This will allow you to pick a IP address the VIP can respond to.

     

    connect [-protocol TCP|UDP] [-myport ] [-tos ] [-status ] [-idle ] [-timeout ] 
    -myaddr and -myport can be used for sourcing the connection from a specific source address and/or port. If specifying a source IP address, it must be one which TMM answers ARP for (ideally a self IP address)
    

     

     

  • Richard__Harlan's avatar
    Richard__Harlan
    Historic F5 Account

    In the Sideband connect command you can set the IP and port to source the connection from. This will allow you to pick a IP address the VIP can respond to.

     

    connect [-protocol TCP|UDP] [-myport ] [-tos ] [-status ] [-idle ] [-timeout ] 
    -myaddr and -myport can be used for sourcing the connection from a specific source address and/or port. If specifying a source IP address, it must be one which TMM answers ARP for (ideally a self IP address)
    

     

     

    • Dave_Mulligan_1's avatar
      Dave_Mulligan_1
      Icon for Nimbostratus rankNimbostratus
      Thank you! Looks like a doc bug there - there's no [-myaddr] in the initial description of the connect command