Forum Discussion

EAX_25745's avatar
EAX_25745
Icon for Nimbostratus rankNimbostratus
Feb 12, 2013

Wildcard Virtual Servers

Hi,

 

I am struggling to get wilcard virtual servers to work properly in v11.3.0 with HF1.

 

VLANs:

 

1) External (Internet) - GW Router x.1.240.128/29

 

2) Proxies - Connects to Cache farm - x.1.222.48/28

 

3) HA

 

4) Internal - not used currently

 

 

I created a wildcard virtual server for the proxies vlan as follows:

 

 

ltm virtual Proxies_All_Out {

 

description "Proxies Outside Access"

 

destination 0.0.0.0:any

 

ip-forward

 

mask any

 

profiles {

 

fastL4 { }

 

}

 

source 0.0.0.0/0

 

translate-address disabled

 

translate-port disabled

 

vlans {

 

Proxies

 

}

 

vlans-enabled

 

}

 

 

Another wildcard virtual server was created for the external vlan to accept incoming proxy request as follows:

 

 

ltm virtual Proxies_FWR_VIP_80 {

 

description "Proxies External Virtual Server"

 

destination 0.0.0.0:http

 

ip-protocol tcp

 

mask any

 

pool Proxies_Pool

 

profiles {

 

analytics { }

 

http { }

 

tcp { }

 

}

 

source 0.0.0.0/0

 

translate-address disabled

 

translate-port disabled

 

vlans {

 

external

 

}

 

vlans-enabled

 

}

 

 

 

But for the life of me, the proxies can't access the internet when their gateway is the floating IP on F5 for the proxies VLAN.

 

When i change the Proxies_All_Out virtual server to a specific destination like an internal nameserver, i can ping that nameserver.

 

But when using source 0.0.0.0/0 and destination and mask any it is not working.

 

 

So something tells me that F5 don't detect that the traffic should go to the Proxies_All_Out virtual server properly.

 

 

What i basically want to achieve is to create a wildcard virtual server for the proxies that will allow them to access the internet via VLAN external.

 

And for incoming traffic a wildcard virtual server that will catch all traffic on port 80 on the external VLAN and send them to the proxies pool.

 

 

Any help or suggestions will be appreciated.

 

 

 

 

  • Great. You could use the same VA if the Service Port is different, otherwise no you can't unless you want to start using Route Domains?

     

  • Another thing... if i have an active / active pair, is it possible to have a virtual address 0.0.0.0 in traffic-group 1 and the same virtual address 0.0.0.0 in traffic-group 2?you can put 0.0.0.0 in traffic-group-local-only traffic group. it won't be synchronized. anyway, 0.0.0.0 will be listening on both units.