Forum Discussion
CirrostratusUsing LTM for network forwarding
Our data center architecture has a pretty standard model, with an "internal" network and a "DMZ". Our internal network does not have a direct route to the Internet. However, I have LTMs in our DMZ that can access the Internet directly. We have a server in our internal network running Microsoft Office 365 "Hybrid services" that needs to access a number of Microsoft Office 365 public networks, and I am being asked to facilitate this connectivity with our LTM. But given my lack of networking knowledge, I don't quite understand how I might configure the LTM to do this. I get a bit lost when it comes to how the different VS types function.
I was hoping someone might be able to help me understand at a high lievel what we would need to do in our network gear, and on the LTM, to enable this communication?
57 Replies
Thomas_GobetNimbostratus
On 10.2 you don't have the "Source IP" directly from VS properties.
You have to use iRule on your forwarding virtual server to apply SNAT only if the source IP is your Microsoft server.when CLIENT_ACCEPTED { if { [IP::addr [IP::client_addr] equals "your_server's_IP"] } { snat automap } }
smp_86112I get the iRule, but what VS are you suggesting I apply it to?
Thomas_Gobet_91On 10.2 you don't have the "Source IP" directly from VS properties.
You have to use iRule on your forwarding virtual server to apply SNAT only if the source IP is your Microsoft server.when CLIENT_ACCEPTED { if { [IP::addr [IP::client_addr] equals "your_server's_IP"] } { snat automap } }- smp_86112I get the iRule, but what VS are you suggesting I apply it to?
- Thomas_Gobet
You told me you have a forwarding virtual server in your LTM configuration.
I don't which one it is, but it has to listen traffic coming from "Internal" VLAN and going to public adresses (the easier would be a 0.0.0.0/0 forwarding server).- smp_86112OK, yeah that's the one I thought you were talking about - Night proposed this model earlier in the thread, and I think understand how this would work. Not ideal in my case, as this LTM is very, very busy and hardware resources are limited. So I'm looking for alternatives to this. Based on what I've heard any my own limited understanding, I'm thinking my only other option is to create Forwarding, network virtual servers for each public network and enable SNAT. Then to get traffic there, we would need to add routes for these networks on our internal routers pointing at the LTM.
- Thomas_GobetYes what you suggested is right, it's an other possibility. You can do it "only" if you know all differents public networks your server will reach.
- Thomas_Gobet_91
You told me you have a forwarding virtual server in your LTM configuration.
I don't which one it is, but it has to listen traffic coming from "Internal" VLAN and going to public adresses (the easier would be a 0.0.0.0/0 forwarding server).- smp_86112OK, yeah that's the one I thought you were talking about - Night proposed this model earlier in the thread, and I think understand how this would work. Not ideal in my case, as this LTM is very, very busy and hardware resources are limited. So I'm looking for alternatives to this. Based on what I've heard any my own limited understanding, I'm thinking my only other option is to create Forwarding, network virtual servers for each public network and enable SNAT. Then to get traffic there, we would need to add routes for these networks on our internal routers pointing at the LTM.
- Thomas_Gobet_91Yes what you suggested is right, it's an other possibility. You can do it "only" if you know all differents public networks your server will reach.
