Forum Discussion
Two Arm Deployment mode using PBR
i am planning to deploy an BIG-IP VE on two-arm deployment on NDFC fabric using PBR. Could you share your insights and thoughts on it.. or relevant source information i can go through if it address some queries or my assumptions in mind
5 Replies
WCCP could be nice in this case WCCP
- anish6190
Nimbostratus
Do you think we use the same methodology in two-arm deployment, is there any relevant docs which i can refer on this. If you share it would great
I now saw your picture as I did not see that you attached one. For the VIP as it is on interface 1 with ip address 192.168.10.x , so PBR or SNAT should be only for the return traffic.
Using SNAT to change the traffic to be sourced from 192.168.11.x will be easier but maybe you want the servers to see the original client ip address and this is why you look at PBR. Keep in mind that F5 can add XFF header for HTTP/HTTPS traffic or use option TCP 28 or proxy protocol for tcp traffic but then you need to sync with the server team if they are ok with this.
Inserting X-Forwarded-Host HTTP header
Original IP address sent to backend servers for non HTTP traffic when SNAT configured
For PBR to be used for the return traffic if SNAT is not enabled then with PBR you can configure the router to send the traffic to the F5 192.168.11.1 or just modify routing on the router with a static route maybe. What I see as issue is the server intiated traffic (server upgrade or app upgrade, ntp etc.) that is not reply of a client traffic may be redirected to F5 . You can have F5 Layer 3 forwarding VIP to capture that traffic and send it to the router if you can't exclude it from being send to the F5 device. If you know the client source ip addresses (if only internal clients use the servers) as if it not the entire internet then it will be easier as PBR or static route can send the server traffic that is just the client subnet to the F5 device. You can use WCCP as a replacement of PBR but it depends on your topology. Try SNAT if the server team agrees and then PBR and if you need more control WCCP.
- anish_6190
Nimbostratus
Thanks for the broader view and perspective on this
the overhead of snat in f5 is negligible.
as reverse proxy, things will be much easier if you install f5 in one arm mode
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com