Policy to forward to a range of ports

[Chause1]

Good day,

We require a configuration that sends as an example ports 7001 - 7999 to a pool of backends servers.

The idea is to create a wildcard VIP (client ssl) and pool. Allow only those ports to connect to the VIP and load balance to the backend servers with the port it connected on.

How would we be able to go about creating a policy to achive this configuration?

Thanks for helping

[Daniel_Wolf · Accepted solution]

Hi @Chause1,

as an alternative you could use a Port List. Simply create on in Shared Objects ›› Port Lists.

And assign it to the virtual server.

KR
Daniel

[Sebastiansierra]

Hi @Chause1 ,

You have to create an LTM policy and apply it to the VS, the rule is:

Hope it´s work.

[Chause1]

Hi,

Thanks for the response.

I will test, I would like to deny the rest of the ports within the same policy. 

When I apply the following it seems to stop working 

[Sebastiansierra]

Hi @Chause1 ,

You have to modify policy 1 and change Apply to traffic: local for both rules:

Hope it´s work.

[Chause1]

Thanks,

Would a client SSL profile have any influance on the traffic?

We receive traffic encypted and need to decrypt to backends. I think this is causing my headace at the moment

[Sebastiansierra]

Hi @Chause1 ,

Yes, you have to load the certificates to decrypt the traffic, because if you apply an HTTP profile without SSL certificates it gonna fail.

[Chause1]

Hi,

I have setup the policy as follows 

When I run a curl I receive:

* SSL read: error:00000000:lib(0):func(0):reason(0), errno 104
* Closing connection 0
curl: (56) SSL read: error:00000000:lib(0):func(0):reason(0), errno 104

I am still able to telnet t the VIP on any of those ports

[Chause1]

I am connecting on port 7791.

Am I wrong to be expecting a RST only or that Telnet should not work to any of those ports?

[Chause1]

Seems that the rule worked as expexted.

We decided to go the data group route.

Thanks for your time and input 

[Daniel_Wolf · Accepted solution]

Hi @Chause1,

as an alternative you could use a Port List. Simply create on in Shared Objects ›› Port Lists.

And assign it to the virtual server.

KR
Daniel

[Chause1 · Accepted solution]

Thanks Daniel,

Will give it a go

[Chause1]

Worked like a charm!!!

Thanks!!