For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

David_Dalgaard_'s avatar
David_Dalgaard_
Icon for Nimbostratus rankNimbostratus
Feb 26, 2014

Tunnel default gateway in APM

Hi guys   I am wondering if there is any way to define a tunnel default gateway (like with Cisco ASA)? I like to force all VPN traffic from the F5 down to a firewall on the same subnet as the VPN ...
BIG-IP Access Policy Manager (APM)
security
Fred_Wittenberg's avatar
Fred_Wittenberg
Historic F5 Account
Dec 07, 2017

Another option is to configure a layer 4 virtual with a pool as the gateway next hop (example below):

 

ltm virtual v4_nexthop { destination 0.0.0.0:any mask any pool 192.168.0.1 profiles { fastL4 { } } source 192.168.0.128/28 translate-address disabled translate-port disabled vs-index 7 }

 

ltm pool 192.168.0.1 { members { 192.168.0.1:telnet { address 192.168.0.1 session monitor-enabled state up } } monitor gateway_icmp }

 

Alternatively, you can use just a layer 3 forwarding VIP and add the following iRule:

 

ltm rule v4_next_hop { when CLIENT_ACCEPTED { nexthop internal 192.168.0.1 log local0. "[IP::remote_addr]:[TCP::remote_port] > [IP::local_addr]:[TCP::local_port]" } }

 

Either works fine for sending traffic to a gateway other than what is configured in the TMOS routing table.