F5 BIG-IP how to disable ICMP redirect?
I noticed that in Network -> Packet Filtering one can enable checkbox "Always accept important ICMP". However I don't really see any other option to precisely specify which ICMP types and codes should be accepted. Precisely I'd like to accept fragmentation needed messages because jumbo frames are actively used in network but I don't want ICMP redirect messages to be accepted and interpreted. So is there any way to precisely point out which ICMP types should pass packet filtering?
Linerate 2.6.1 / ICMP Echo
Just finished as a lab test, a basic LB scenario 1 Public IP ( 46.128.xx.xx ) as VIP --> VS --> RealServer (10.1.0.100 ) This is working however, the Public IP is not reachable through ICMP. My question is how to force ( if supported ) the public interface to be ICMP reachable ?
vCMP route-domain issue
Having a strange issue. F5 is logically inline between a firewall and the servers. I attempted to migrate from a virtual edition to vCMP guest and ran into a few issues. The main issue I am struggling with is that the vCMP guest, configured with partitions and route-domains is not reachable on the server facing Self-IP from the client side. Code 12.1.2 Let's say we have 2 VLANs in one parition/route-domain. VLAN 10, 192.168.10.0/24 client facing VLAN 20, 192.168.20.0/24 server facing The route-domain in question has a default route with the gateway being a layer 3 VLAN on the firewall. The servers have a default gateway of the Floating Self-IP on the F5. Virtual Edition: VLAN 10 and VLAN 20 Self-IP addresses are pingable from user networks through the firewall F5 can ping servers in VLAN 10 from VLAN 10 Self-IP Users can ping servers in VLAN 10 through the firewall vCMP Guest: VLAN 10 Self IP addresses are pingable from the user networks through the firewall VLAN 20 Self IP addresses are unresponsive F5 can ping servers in VLAN 10 from VLAN 10 Self-IP Users CANNOT ping server in VLAN 10 through the firewall bigip.conf file objects were copied from Virtual Edition partition to vCMP guest partition. All bigip_base.conf objects were created manually. 4 partitions/route-domains in total each setup similarly, all have the same issue. Per F5 instructions: - inherited VLANs from host - deleted VLANs in guest - created route-domains - created partitions with appropriate route-domain set as default for partition - re-created VLANs inside appropriate paritions Not really sure where to begin. Probably should have restarted MCPD, but didn't get a chance before rollback. Am I missing something, or could it have just been an MCPD issue?
Using Selective ACK on Virtual Address
We have a 2 tier system whereby Tier 1 needs to know quickly if Tier 2 services have stopped, be that VS or the pools or the box itself. To that end we've setup an ICMP monitor at tier 1 to ping the VS at Tier 2 and we've configured the ICMP option within Virtual Address to be Selective (ie don't respond if VS is red). This works well most of the time. However every now and again we'll see that a service has been marked down at Tier 1 and the ICMP monitor is the one saying it had marked the service down. You go to Tier 2 and the VS is green (it has been down but come back up) and a TCPDUMP shows that the ICMP request is getting to Tier 2 but Tier 2 is NOT sending an ICMP response. Typically the only fix is to reboot the Tier 2 box - which is not ideal in a production environment. I have opened a case with F5 for this but wondered if anybody else had come across something similar etc.
