Forum Discussion
Wildcard Virtual Servers
Hi,
I am struggling to get wilcard virtual servers to work properly in v11.3.0 with HF1.
VLANs:
1) External (Internet) - GW Router x.1.240.128/29
2) Proxies - Connects to Cache farm - x.1.222.48/28
3) HA
4) Internal - not used currently
I created a wildcard virtual server for the proxies vlan as follows:
ltm virtual Proxies_All_Out {
description "Proxies Outside Access"
destination 0.0.0.0:any
ip-forward
mask any
profiles {
fastL4 { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
vlans {
Proxies
}
vlans-enabled
}
Another wildcard virtual server was created for the external vlan to accept incoming proxy request as follows:
ltm virtual Proxies_FWR_VIP_80 {
description "Proxies External Virtual Server"
destination 0.0.0.0:http
ip-protocol tcp
mask any
pool Proxies_Pool
profiles {
analytics { }
http { }
tcp { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
vlans {
external
}
vlans-enabled
}
But for the life of me, the proxies can't access the internet when their gateway is the floating IP on F5 for the proxies VLAN.
When i change the Proxies_All_Out virtual server to a specific destination like an internal nameserver, i can ping that nameserver.
But when using source 0.0.0.0/0 and destination and mask any it is not working.
So something tells me that F5 don't detect that the traffic should go to the Proxies_All_Out virtual server properly.
What i basically want to achieve is to create a wildcard virtual server for the proxies that will allow them to access the internet via VLAN external.
And for incoming traffic a wildcard virtual server that will catch all traffic on port 80 on the external VLAN and send them to the proxies pool.
Any help or suggestions will be appreciated.
- nitassEmployeeBut for the life of me, the proxies can't access the internet when their gateway is the floating IP on F5 for the proxies VLAN.
- EAX_25745NimbostratusYes i did try SNAT Automap but it didn't work either.
- nitassEmployeeyou have defined default route in bigip, haven't you?
- EAX_25745NimbostratusYes default GW is the router which is the same IP range as the external VLAN
- nitassEmployeecan you run tcpdump on bigip to see what happens?
- What_Lies_Bene1CirrostratusDoes the router have a route back to the F5 for the proxy VLAN/subnet?
- EAX_25745NimbostratusI made two changes now.
- Jason_AdamsEmployeeI know this is a little old, but I just want to make very clear that, when you enable ICMP-Echo on a 0.0.0.0 Virtual-Address, you are not actually performing a ping Through the BIG-IP. The virtual-address is responding directly. And because 0.0.0.0 will encompass ALL IP Addresses, this means that the BIG-IP will ICMP Respond to ALL IP Addresses This is generally an undesired behavior, and can cause a large amount of confusion.
- What_Lies_Bene1CirrostratusFor any external routers, yes, that's exactly it.
- What_Lies_Bene1CirrostratusFor any external routers, yes, that's exactly it.
- EAX_25745NimbostratusOk i will do the routing changes and test.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com