For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jeffgriesel_245's avatar
jeffgriesel_245
Icon for Nimbostratus rankNimbostratus
May 13, 2016

SNAT Virtual Server is sending ICMP Destination Unreachable to Source Server

I have several servers sitting behind a F5 LTM running 11.6 HF6 that when sending a UDP packet that is defined in the Virtual Server to be SNATed are instead getting an ICMP Message sent to them of D...
application delivery
LTM
neptune_121018's avatar
neptune_121018
Icon for Nimbostratus rankNimbostratus
May 13, 2016

Does the outbound VS for the UDP 1700 port have a VLAN Specified? Can you shouw us the configuration for that VS?

 

  • jeffgriesel_245's avatar
    jeffgriesel_245
    Icon for Nimbostratus rankNimbostratus
    May 14, 2016
    Here are the configs on the VS ltm virtual /Common/ISE_radius_coa_snat { description "VIP for ISE return COA traffic" destination /Common/0.0.0.0:1700 ip-protocol udp mask any profiles { /Common/udp { } } source 199.6.162.10/32 source-address-translation { pool /Common/ISE_radius_coa_snatpool type snat } translate-address enabled translate-port enabled vlans { /Common/ISE_VLAN15 } vlans-enabled } ltm snat-translation /Common/199.6.162.9 { address 199.6.162.9 inherited-traffic-group true traffic-group /Common/traffic-group-1 } ltm snatpool /Common/ISE_radius_coa_snatpool { members { /Common/199.6.162.9 } }