Forum Discussion
ltp_55848
Jun 29, 2011Nimbostratus
Wildcard forwarding for direct node traffic with PBR
Hi All,
Apologies if this question has been asked before; I've waded my way through a lot of forum posts but haven't seen the problem I'm facing - feel free to prove otherwise.
I am currently have a HA LTM pair with a single trunked interface (eight trunk members aggregated using LACP and with VLANs trunked on the connected switch). Policy based routing is used on the node VLANs to route matching traffic back to the F5 self IP interface for that VLAN. The default gateway on the nodes is not set to the F5 and all other traffic not matched by PBR uses the default gateway.
Everything works fine, however it is occasionally necessary to connect directly to a service on a node rather than the virtual server. In this case, return traffic is still being routed by PBR to the F5's. I have created a forwarding wildcard virtual server on 0.0.0.0/0 and all ports (with loose connection initiation, etc.), but am still not seeing the traffic being forwarded.
I am seeing the "in" traffic in the virtual server statistics and can match it to individual requests, but I am not seeing "out" traffic be incremented. Before I spend hours poring over packet dumps, can anyone suggest what the problem is likely to be? Is it possible that the F5 is not able to route the traffic, and if so where would I see evidence of this (if anywhere)?
Cheers
21 Replies
Sort By
- Hi Ltp,
- Hi LTP,
- Hi Bhattman,
- F5's don't like asymetric routing.
- Hi Hamish,
- Hmm... That might be possible if you have a second network vs that leads back to the client...
- Have you try to disable Auto Last Hop feature ?
- The diagram seems to indicate that the return traffic is coming in a different interface from the outbound to the poolmember. The F5 doesn't like this (AFAIK it hasn't been fixed between 9.4 where I first experienced it, and 10.x).
- Hi Ltp,
- Thanks for the responses guys. To clarify; I'm running 10.2.1, I tried disabling the auto last-hop feature and VLAN keyed connections without success.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects