For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

StarFlock's avatar
StarFlock
Icon for Nimbostratus rankNimbostratus
Oct 06, 2015

UDP Virtual Server, return traffic don't get translated on the way out

Hi!

 

I have a problem with return traffic not getting translated back to VS address on the way out. The setup is a standard VS with a host address, protocol is UDP on a specific port. SNAT is set to none. Normally this works like a charm with TCP but for some reason it doesn't with UDP. Remaining settings are left to default values (address and port translation are set to enable etc)

 

VS 1.1.1.1:5000

 

The pool members are placed behind the F5 on an isolated VLAN with default gateway set to the F5's internal floating address. So there are no traffic shortcuts.

 

Pool Members 2.2.2.2:5000 2.2.2.3:5000

 

Problem is that the return traffic from the pool members don't get translated. If a run a tcpdump on the external vlan I see the pool member address as source and not the VS address.

 

Traffic flow looks like this: Client address: 5.5.5.5

 

5.5.5.5:400 -> 1.1.1.1:5000 (external if) 5.5.5.5:400 -> 2.2.2.2:5000 (internal if)

 

2.2.2.2:5000 -> 5.5.5.5:400 (internal if) 2.2.2.2:5000 -> 5.5.5.5:400 (external if)

 

It seems like the F5 don't see the return traffic as part of the VS session.

 

And to get it a little more complex, I need to preserve both the destination and source port all the way. So I did try create a forwarding VS on the internal if like this:

 

proto: udp dest: 0.0.0.0 src: 0.0.0.0 source port: preserve strict

 

But this VS does not get any hits.

 

Please help me out :)

 

3 Replies