VS (forwarding layer 2) doesn't respond to syn from client

Hello Experts,

I am preparing for a project recently in which I need to deploy a forwarding layer 2 VS. The topology is quite sample as below:

client (win7): 10.128.20.99

pool: 10.128.20.11

As they're on the same subnet, I assign them to vlan100 (win7) and vlan 200 (pool) , in order to make traffic from win7 will go through ltm and then to pool member. The switch port facing LTM is set to 802.1q trunk.

The steps on LTM:

1. create vlans for client and pool
2. binding these 2 vlans to a vlan-group
3. set a self ip 10.128.20.100 to vlan-group
4. create a forwarding layer 2 VS, the destination IP is set to same as real pool member (10.128.20.11)

However the result is I can ping 10.128.20.11 via win7 but can not access to it via http. The arp table on WIN7 shows the MAC address is of LTM's tmm interface.

ping 10.128.20.11 -t

Pinging 10.128.20.11 with 32 bytes of data: Reply from 10.128.20.11: bytes=32 time=2ms TTL=255 Reply from 10.128.20.11: bytes=32 time=1ms TTL=255 Reply from 10.128.20.11: bytes=32 time=3ms TTL=255 Reply from 10.128.20.11: bytes=32 time=2ms TTL=255 Reply from 10.128.20.11: bytes=32 time=2ms TTL=255 Reply from 10.128.20.11: bytes=32 time=2ms TTL=255

Ping statistics for 10.128.20.11: Packets: Sent = 6, Received = 6, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 3ms, Average = 2ms

From tcpdump on LTM, I can see syn was re-transmitted multiple times to LTM, but LTM didn't respond to it... It looks like an issue on LTM side so far...

I also checked the /var/log/ltm but nothing shown there while the test. I would appreciated anyone can share some ideas in this case... I suspect it may be due to a common configuration issue as the test is actually quite sample... thanks a lot!

Here is my configuration snippet:

forwarding layer 2 vs:

ltm virtual /Common/f2 { destination /Common/10.128.20.11:80 ip-protocol tcp l2-forward mask 255.255.255.255 profiles { /Common/fastL4 { } } source 0.0.0.0/0 translate-address enabled translate-port enabled }

vlan & vlan groups:

net vlan /Common/client-vlan { interfaces { 1.1 { tagged } } tag 100 } net vlan /Common/pool-vlan { interfaces { 1.1 { tagged } } tag 200 } net vlan-group /Common/vlan-group-1 { members { /Common/client-vlan /Common/pool-vlan }

self-ip:

net self /Common/vlan-group { address 10.128.20.199/24 allow-service all traffic-group /Common/traffic-group-local-only vlan /Common/vlan-group-1 }