For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Raj_Siva_327012's avatar
Raj_Siva_327012
Icon for Nimbostratus rankNimbostratus
Jul 12, 2017

SNAT - same VLAN ?

Do we need SNATs if the server is in the same VLAN as the self / floating IPs ? the default gateway of the server is not the F5 in this case...   for ex   external VIP - 172.18.2.153   pool ...
application delivery
LTM
security
Munney_64889's avatar
Munney_64889
Icon for Nimbostratus rankNimbostratus
Jul 12, 2017

If you don't SNAT, the source address of the requesting client will get passed straight on through to the server. And then the server will see the client as a non-local IP address and use it's default gateway to respond to, bypassing the load balancer.

 

Asynchronous route. Game over.

 

ricky_paulus_gi's avatar
ricky_paulus_gi
Icon for Nimbostratus rankNimbostratus
Jul 13, 2017

Source address translation must be used in this configuration to ensure that server response traffic returns to the client via F5. If not, it will cause asymmetric routing of server traffic.