For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Angelo_Turetta1's avatar
Angelo_Turetta1
Icon for Nimbostratus rankNimbostratus
Mar 02, 2015

Subnet as Virtual Server destination

I'd like to distribute connections to a virtual server among two adjacent IP addresses.

If I try using

destination 172.18.119.42:80
mask 255.255.255.254

The virtual server doesn't reply neither 172.18.119.42 nor 172.18.119.43. Of course reverting to 

mask 255.255.255.255
will restore service on 172.18.119.42

What am I missing?

Thanks,

Angelo.

application delivery
LTM
management
TMOS

5 Replies

  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Mar 02, 2015
    what BigIP version are you running? Is the VS just not showing any stats when you have it set to use a /31 mask? What kind of VS are you using?
  • Angelo_Turetta1's avatar
    Angelo_Turetta1
    Icon for Nimbostratus rankNimbostratus
    Mar 02, 2015

    Version is 11.5.1HF7

     

    The state is green, and it correctly show 172.18.119.42/31 as destination, but it doesn't reply to TCP SYN

     

    I also added static routing from the router to the floating SELF_IP for those two IPs, just in case it was not answering ARP.

     

    No difference.

     

    • Brad_Parker's avatar
      Brad_Parker
      Icon for Cirrus rankCirrus
      Mar 02, 2015
      Do the IPs show up in your ARP tables? Are you running a virtual or physical BigIP?
    • Angelo_Turetta1's avatar
      Angelo_Turetta1
      Icon for Nimbostratus rankNimbostratus
      Mar 02, 2015
      it's physical. BTW, in the meantime I solved my problem. I learned some things. IPs used as a destination of type 'network' (so, non /32) are not reachable by ARP. You have to use L3 routing to reach your F5. My problem was the docs where I got my cluster's floating IP: it was wrong, so I was essentially routing my virtual server's IPs to a black-hole :-) After a few useful tcpdump(1) sessions, I corrected my static route and everything started working... I also fixed the docs ;-) Thanks anyway for your answers, Angelo.
  • StephanManthey's avatar
    StephanManthey
    Icon for Nacreous rankNacreous
    Mar 03, 2015

    Hi Angelo,

     

    as you already found out, ARP is disabled by default for network virtual address types.

     

    ARP can be enabled in the virtual address settings menue for network addresses as well. Please make sure not to overlap with other locally used IP addresses!

     

    Thanks, Stephan