Source routing

Hi Denny (or whomever else can answer),

 

 

I have what looks like a simpler setup than what you've shown in your nice ASCII image. The VLANs X and Y would stay, but behind the F5s I just have a single VLAN, A. Basically imagine VLAN Y is our old firewall/DMZ gear and VLAN X is the new, improved gear we're trying to migrate towards (along with new IP addresses).

 

 

So, on VLAN Y (old) I'll have virtual servers that access the pools on VLAN A. Now I need to create a new virtual server on VLAN X (new gear) and have it provide access to the same pool on VLAN A, but ensure that connections that come in from X go back out X, and connections that come in on Y go back out Y. Is this simply a matter of just having self-IPs on each of the external VLANS, and the F5 will default to sending connections back out the gateway a connection came in on? Currently the F5 only has a single default route, which points towards to old gear we're trying to get off of (VLAN Y). My concern is that when a connection comes in via VLAN X, the F5 will look at its routing table and want to send replies out via VLAN Y instead of VLAN X. Since I don't have VLANs A and B on the back side, I can't create two separate wildcard forwarding servers and associate them with different internal VLANs.

 

 

If you're with me this far there's one additional consideration. There are stand-alone servers on VLAN Y necessary to the sites' functioning that will eventually migrate as well. For now, they'll remain on VLAN Y. If I bring a virtual server up on VLAN X, and the hosts in a pool get new SNATs on X to replace their old VLAN Y SNATs, the F5 won't do something goofy with routing and say, "Well, this host with SNAT 10.10.10.5 wants to talk to 192.168.2.200... I have a self-IP on the 192.168.2.0 network, so I'll just route internally and send the packet out that interface rather than using the default gateway for the 10.10.10.0 network", will it? (resulting in a SYN packet with a 10.10.10.5 source IP getting dumped directly onto VLAN Y, and the resulting SYN/ACK from the server gets to VLAN Y's firewall but doesn't match a state, because there was never a SYN from 10.10.10.5 seen at the firewall).