Forum Discussion

ESDRAS_368680's avatar
ESDRAS_368680
Icon for Nimbostratus rankNimbostratus
Aug 21, 2018

configure f5 big ip in front of cisco asa

i have node (servers) behind a cisco asa and these servers are reachable from cisco ASA outside interface by ACL and NAT and PAT. i have a f5 big ip asm configured and face to internet. the f5 internal and asa outside interface are in the same network. i create node whitch is the cisco asa outside interface And pool on a a specific port on that node (asa outside)

 

i need to create a vs so that all requests from internet be redirected to cisco asa (outside) on a specific port which will redirect the flow to my servers connected to the cisco asa inside. can you help me please ?

 

4 Replies

  • I would create a pool with the nodes (servers) ip's behind the ASA. The ASA is not a load balancer so it won't balance the traffic.

     

    Cheers,

     

    Kees

     

  • hello thanks for your reply. my configuration is the following : asa inside 10.100.72.4 asa outside 10.100.251.81 asa gateway f5 internal : 10.100.251.85

     

    f5 internal : 10.100.251.85 f5 external : 41.x.x.x f5 gateway : isp

     

    my servers are connected to asa inside : server 1 : 10.100.72.8 server 2 : 10.100.72.10

     

    i have configured NAT and PAT on port 10444 on asa outside so that when i type 10.100.251.81:10444, it redirect me to server 1 (10.100.72.8) when i type 10.100.251.81:10448, it redirect me to server 2 (10.100.72.10)

     

    i need that when my user hit f5 external ip (41.x.x.x) on port 20444 (41.x.x.x:20444) they are redirected to server 1 and when they hit 41.x.x.x:20445 ther redirected to server 2

     

    how can i do that ?

     

  • You need to create a load balancing pool with two members. Members have the same node address but different port.

    tmsh create ltm pool  members add { 10.100.251.81:10444 10.100.251.81:10448 } monitor tcp_half_open
    

    And the BIG-IP is not redirecting traffic to the pool members it is forwarding the traffic.

    Cheers,

    Kees

  • thanks for your reply. noted for the BIG IP forwarding. I test it now and give a reply.