Forum Discussion

garypayton_1346's avatar
garypayton_1346
Icon for Nimbostratus rankNimbostratus
Oct 16, 2013

Wildcard Virtuals & Partitions

I'm setting up a new LTM/AFM pair and want to use partitions to separate the AFM virtuals from the LTM virtuals. I am having a hard time understanding how to process outbound traffic to the internet (unknown destinations).

Normally I would just set up a wildcard forwarding VS and enable it on the specific VLANs I want to have outside access. Since the VLANs are in partitions, I have to create one for each. However I receive an error when attempting to create two 0.0.0.0/0 VSs even when they are enabled on different VLANs.

01070726:3: virtual server /SharedLB/FwdVS-Wildcard in partition SharedLB cannot reference virtual address /SharedFW/0.0.0.0 in partition SharedFW

Is this expected behavior? If so, what are my options?

The problem is I have separate VLANs for the normal VS addresses and I do not want to enable access for them. Would creating a wildcard VS and disabling only those VLANs work instead, regardless of which partition it resides?

Would I be better off creating a FastL4 VS and using a default gateway pool (the same one that my default route uses)?

I'm sure I could get this working with multiple route domains but I'd like to avoid that complexity if at all possible.

deployment
design
  • garypayton_1346's avatar
    garypayton_1346
    Icon for Nimbostratus rankNimbostratus
    Oct 16, 2013
    Thinking more about this, would a solution be to enable it on all VLANs but use AFM to deny traffic on self-IPs for the VLANs I do not want to have outside internet access?
  • bboyjnr_8532's avatar
    bboyjnr_8532
    Icon for Cirrus rankCirrus
    Oct 16, 2013

    you may want to look into route domains...

     

    http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos_management_guide_10_1/tmos_route_domains.html

     

    this isnt a RTFM but more of a pointer as my route domain understanding is very basic and may not include wildcard VS's but if it does then happy days!

     

  • garypayton_1346's avatar
    garypayton_1346
    Icon for Nimbostratus rankNimbostratus
    Oct 16, 2013

    Yea I'm certain route domains would work but I want to avoid them as to not to confuse the lower level support guys. I've also heard many horror stories of route domain issues with upgrades...

     

  • Wahezu_23937's avatar
    Wahezu_23937
    Icon for Nimbostratus rankNimbostratus
    Feb 02, 2015

    Hi garypayton,

     

    I am having exactly the same issue creating wildcards for different partitions. Although we use route domains in other F5s without AFM, for the new ones I would like to avoid using Route domains for the same reasons you stated in the post.

     

    How did you configure your system eventually?

     

    Thanks, Wahezu.

     

  • brad_11440's avatar
    brad_11440
    Icon for Nimbostratus rankNimbostratus
    Feb 02, 2015

    Sorry I literally left that company a couple weeks after making that post, I am not sure how they ended up configuring it...

     

  • StephanManthey's avatar
    StephanManthey
    Icon for MVP rankMVP
    Feb 03, 2015

    A shared object (i.e. a wildcard virtual address 0.0.0.0/0) needs to be placed in the common partition to be referenced in different administrative partitions.

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Feb 03, 2015

    configuration partitions are just that, IP / routing wise you are in the same scope so you can't use the same IP / Subnet on two places.