For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cdougall_14195's avatar
cdougall_14195
Icon for Cirrus rankCirrus
Jan 08, 2015

So, what's happening is this.

 

server B calls VIP a - src : 192.168.103.211 dst : 192.168.100.141

 

VIP a sends to server a - src : 192.168.103.211 dst : 192.168.103.125

 

server A responds to request - src : 192.168.103.125 dst : 192.168.103.211

 

  • That's a problem since server b is not expecting to be talking to that address, and has no session to associate the connection with.

Usually you don't need to worry about SNAT when the servers default gateway is the F5. However, you've just hit on one of the situations that does require some grooming. Do be careful if you do decide to put SNAT on the VIP as it will change the way all of the traffic appears on the back end server.