F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

scarville's avatar
scarville
Icon for Nimbostratus rankNimbostratus
Sep 26, 2022

Restricting traffic between Vlans.

We have an F5 servicing our DMZ. It hosts the external IPs and acts a router for the DMZ servers.                                         +--- [ VLAN_2110 ] [ Internet ] ---- [ F/W ] ---- [ F5 ] --...
firewall
security
vlan
CA_Valli's avatar
CA_Valli
Icon for MVP rankMVP
Sep 27, 2022

F5 is a default deny deivce, so inter-VLAN routing is denied out-of-the-box unless you explicitly allow it (using something like an IP forwarding Virtual Server). 

To prevent clients in a VLAN from accessing Virtual Servers on the "Internet" side potentially leading to servers in the other VLAN, you can configure the VS to listen only on Internet VLAN. This is usually common practice. 

If the requirement is to have completely dedicated VRF's as well, you might want to take a look at F5 Routing domain feature https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-routing-administration-11-6-0/8.html