Forum Discussion
UDP Virtual Server, return traffic don't get translated on the way out
Hi!
I have a problem with return traffic not getting translated back to VS address on the way out. The setup is a standard VS with a host address, protocol is UDP on a specific port. SNAT is set to none. Normally this works like a charm with TCP but for some reason it doesn't with UDP. Remaining settings are left to default values (address and port translation are set to enable etc)
VS 1.1.1.1:5000
The pool members are placed behind the F5 on an isolated VLAN with default gateway set to the F5's internal floating address. So there are no traffic shortcuts.
Pool Members 2.2.2.2:5000 2.2.2.3:5000
Problem is that the return traffic from the pool members don't get translated. If a run a tcpdump on the external vlan I see the pool member address as source and not the VS address.
Traffic flow looks like this: Client address: 5.5.5.5
5.5.5.5:400 -> 1.1.1.1:5000 (external if) 5.5.5.5:400 -> 2.2.2.2:5000 (internal if)
2.2.2.2:5000 -> 5.5.5.5:400 (internal if) 2.2.2.2:5000 -> 5.5.5.5:400 (external if)
It seems like the F5 don't see the return traffic as part of the VS session.
And to get it a little more complex, I need to preserve both the destination and source port all the way. So I did try create a forwarding VS on the internal if like this:
proto: udp dest: 0.0.0.0 src: 0.0.0.0 source port: preserve strict
But this VS does not get any hits.
Please help me out :)
3 Replies
- IheartF5_45022
Nacreous
Hmm...pretty sure that forwarding vs could be causing your problem..why don't you remove the forwarding vs on internal and enable 'source-port preserve-strict' on your VS 1.1.1.1:5000?
- StarFlock
Nimbostratus
If I do that, the return traffic wont get translated back to VS address on the way out. That is the main problem of this.
- IheartF5_45022
Nacreous
OK - found your problem I think - you do need a second vs - look up the 'Load balancing bidirectional stateless UDP traffic' section here https://support.f5.com/kb/en-us/solutions/public/13000/600/sol13675.html.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
