For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

DV_25303's avatar
DV_25303
Icon for Nimbostratus rankNimbostratus
Nov 16, 2009

TWO ISA 2006 + NLB having problem to access BIG-IP LTM and Virtual Server

Hi there,

 

 

I'm having a problem with a structure of TWO ISA Servers 2006 + NLB and BIG-IP LTM.

 

 

My structure is like this:

 

 

Two Isa Server 2006 in NLB mode

 

Two BIG-IP LTM

 

 

All them are in the same subnet, like: 10.1.0.0/16

 

 

The problem happen when some machine behind of ISA Server (using ISA Server as default proxy) try to access the big-ip or try to access some virtual server behind BIG-IP. All attempt are unsuccessful.

 

 

Inner the BIG-IP, when I do a ping, the response is:

 

 

ltm02:Active] ~ ping 10.1.1.25

 

PING 10.1.1.25 (10.1.1.25) 56(84) bytes of data.

 

64 bytes from 10.1.1.25: icmp_seq=0 ttl=128 time=1.46 ms

 

64 bytes from 10.1.1.25: icmp_seq=0 ttl=128 time=1.47 ms (DUP!)

 

64 bytes from 10.1.1.25: icmp_seq=1 ttl=128 time=0.573 ms

 

64 bytes from 10.1.1.25: icmp_seq=1 ttl=128 time=0.574 ms (DUP!)

 

 

Does anyone know what could be happening?

 

I just posted the same issue in MS forums and all guys doesn't know what is happening.

 

 

Thanks in advance.

 

 

David
microsoft
partner

2 Replies

  • kampa_106861's avatar
    kampa_106861
    Icon for Nimbostratus rankNimbostratus
    Dec 09, 2011
    Hi,

     

    The ping DUP (duplicate) is the NLB cluster configurated in unicast mode.

     

    So, the two server NLB have the same mac address (like 02-BF-...) and generate the brodcast traffic.

     

     

    The problem, with the access to the virtual server from NLB proxy, is probably the conf of BIG-IP with auto_lasthop.

     

     

    I have never tried these solutions, but there are these articles about this situation :

     

     

    http://support.f5.com/kb/en-us/solutions/public/1000/500/sol1564.html

     

    http://support.microsoft.com/kb/317239/en-us

     

     

    In my NLB configuration, there were two ethernet cards, and i have configurated the second card with a new IP in the same subnet/class,

     

    and I have added a static route to the IP of virtual server from this second card with no NLB flag.