For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

refra_151287's avatar
refra_151287
Icon for Cirrus rankCirrus
Jul 13, 2015

Urgent: L2 deployment

Hello, Im trying to deploy standard load balancing, but all network component in the same subnet clients,and servers, The issue that the traffic is passing through the f5 but not hitting any VS, also...
application delivery
deployment
LTM
Vernon_97235's avatar
Vernon_97235
Historic F5 Account
Jul 13, 2015

If the Virtual Server is on one Route Domain, and the pool members are on another, then you must disable "strict-isolation" for the VS RD in order for traffic to traverse between the Route Domains. If the VS and pool members are on the same Route Domain, then nothing special needs to be done in that regard.

The BIG-IP will forward to a pool member if and only if the pool members are in a netblock that also contains a BIG-IP self-IP (in the same Route Domain) or if the BIG-IP has a route to the pool members (also in the same Route Domain). Moreover, the BIG-IP will not send traffic if ARP fails for the next hop (i.e., the pool member if the member is directly connected, or the next hop gateway if a route is followed).

Do you have monitors associated with the pool members? If so, are they working (returning an "up" status)? Are the VS and pool members in the same Route Domain? If not, have you disabled strict-isolation?

Have you verified that ARP is returning successfully for the next hop (using 

tmsh show net arp
and 
tcpdump -nni 0.0 arp
)?

refra_151287's avatar
refra_151287
Icon for Cirrus rankCirrus
Jul 13, 2015
I've monitors (icmp) and it working fine. actually i don't think it's related to the Route Domains, i want give you brief about our setup: |---------Proxy _servers Clients ------SW-----1.1-F5-1.2----SW--------------------------------FW(GW) All these components [one self IP, VS 0.0.0.0%95, pool members(proxy servers)] in the same subnet (and of course in the same RD 95) 192.168.1.0%95/2. the issue I guess the we have two interfaces in wireless VLAN {1.1(connected to clients side), and 1.2(connected to proxy servers side)}, so the traffic goes from the client side through 1.1, and went go out through 1.2 without even path through the VS, so the loadbalance never happens and instead the traffic goes through the FW. Here we see the F5 as a L2 SW, it didn't intercept the traffic, so if you want go to "google.com" the traffic will go to the GW through the F5 instead pass through the proxies.