Forum Discussion
Wildcard Virtual Servers
Hi,
I am struggling to get wilcard virtual servers to work properly in v11.3.0 with HF1.
VLANs:
1) External (Internet) - GW Router x.1.240.128/29
2) Proxies - Connects to Cache farm - x.1.222.48/28
3) HA
4) Internal - not used currently
I created a wildcard virtual server for the proxies vlan as follows:
ltm virtual Proxies_All_Out {
description "Proxies Outside Access"
destination 0.0.0.0:any
ip-forward
mask any
profiles {
fastL4 { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
vlans {
Proxies
}
vlans-enabled
}
Another wildcard virtual server was created for the external vlan to accept incoming proxy request as follows:
ltm virtual Proxies_FWR_VIP_80 {
description "Proxies External Virtual Server"
destination 0.0.0.0:http
ip-protocol tcp
mask any
pool Proxies_Pool
profiles {
analytics { }
http { }
tcp { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
vlans {
external
}
vlans-enabled
}
But for the life of me, the proxies can't access the internet when their gateway is the floating IP on F5 for the proxies VLAN.
When i change the Proxies_All_Out virtual server to a specific destination like an internal nameserver, i can ping that nameserver.
But when using source 0.0.0.0/0 and destination and mask any it is not working.
So something tells me that F5 don't detect that the traffic should go to the Proxies_All_Out virtual server properly.
What i basically want to achieve is to create a wildcard virtual server for the proxies that will allow them to access the internet via VLAN external.
And for incoming traffic a wildcard virtual server that will catch all traffic on port 80 on the external VLAN and send them to the proxies pool.
Any help or suggestions will be appreciated.
13 Replies
- nitass
Employee
But for the life of me, the proxies can't access the internet when their gateway is the floating IP on F5 for the proxies VLAN. - EAX_25745
Nimbostratus
Yes i did try SNAT Automap but it didn't work either. - nitass
Employee
you have defined default route in bigip, haven't you? - EAX_25745
Nimbostratus
Yes default GW is the router which is the same IP range as the external VLAN - nitass
Employee
can you run tcpdump on bigip to see what happens? - What_Lies_Bene1
Cirrostratus
Does the router have a route back to the F5 for the proxy VLAN/subnet? - EAX_25745
Nimbostratus
I made two changes now.- Jason_Adams
Employee
I know this is a little old, but I just want to make very clear that, when you enable ICMP-Echo on a 0.0.0.0 Virtual-Address, you are not actually performing a ping Through the BIG-IP. The virtual-address is responding directly. And because 0.0.0.0 will encompass ALL IP Addresses, this means that the BIG-IP will ICMP Respond to ALL IP Addresses This is generally an undesired behavior, and can cause a large amount of confusion.
- What_Lies_Bene1
Cirrostratus
For any external routers, yes, that's exactly it. - What_Lies_Bene1
Cirrostratus
For any external routers, yes, that's exactly it. - EAX_25745
Nimbostratus
Ok i will do the routing changes and test.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com