GRE Tunnel Issue
Has anyone run into an issue with GRE tunnels on a BIG-IP? I have a few setup running into a TGW in AWS and something seems to break them. Config change, Module change, ?? I haven't been able to pin down an exact trigger. Sometimes I could failover and have the tunnels on the other HA member work fine and failing back would results in tunnels going down again. (The tunnels are unique to each BIG-IP) They start responding with ICMP protocol 47 unavailable. Once this happens a reboot doesn't seem to fix it. If I tear down the BIG-IP and rebuild it, I can keep them working again for X amount of time before the cycle repeats. Self-IPs are open to the protocol, also tried allow all for a bit. No NATs involved with underlay IPs.
Using the WAF instead of a jump server for ssh-tunneling?
Hello everyone, This is how it works at the moment: We go from server A, in the internal network, with a public IP via ssh to a jump server in the DMZ. From the jump server we then go on to server B in the secure zone. I am relatively new to this and have been given the task of seeing if the WAF can replace the jump server. We use Advanced Web Application Firewall, r2600 with BIG-IP 17.1.1.3 Is this possible and what do we need for it? Thank you in advance for your help ! Best regards.
Multiple IPSec tunnels to the same remote peer
Hello everyone, I need to load balance traffic to a third party with IPSec. I have configured an IPsec tunnel using the IPSec Interface mode, assigning a /30 self-ip to the tunnel and creating a virtual server that forwards the traffic to the node with the tunnel remote IP. All this setup works as expected but the IPSec tunnel has a bandwidth limitation of 1Gbps and I need to reach 3Gbps. The problem that I am facing is: when I try to create a new ike-peer with the same destination IP address, I get the error: 01070734:3: Configuration error: remote-address (a.a.a.a) is also used by ike-peer (/Common/peer1) Does someone know how can I create multiple ipsec tunnels to the same remote IP? I can add different IPs in the local site, but not in the remote one. Regards and thanks in advance
F5 BIG-IP Unicast VXLAN-GPE Tunnel Sample Config
Hello Everyone, I'm looking for a Unicast VXLAN-GPE Tunnel Sample Config on BIP-IP. It will be a great help if anyone can share or point to documentation. I already checked the official documentation but that is only available for the VXLAN-GPE multicast scenario but in my case, it's a unicast tunnel. Also, I want to use IPv4 as the next protocol, looks like ethernet is used by default and I don't see in the documentation on how to change to IPv4. You can configure a VXLAN Generic Protocol Extension (GPE) tunnel when you want to add fields to the VXLAN header. One of these fields is Next Protocol, with values for Ethernet, IPv4, IPv6, and Network Service Header (NSH). Thanks!
nexthop and tunnel - is that working for VIP to VIP?
Hi, Best practice for explicit forward proxy with SSL Intercept is to set BIGIP like that: proxy VS - explicit HTTP profile with tunnel configured (via Tunnel Name option), Default Connect Handling option set to Deny. This is main VS - clients are using it's IP and port as proxy HTTPS VS - standard reverse type HTTP profile, client/server SSL profiles attached, VS Enabled on tunnel configured via explicit HTTP profile attached to proxy VS (see above). Can be set to listen on 443 port or any other port, or all ports. tunnel used is defined as tcp-forward type Above config is working without issue, all CONNECT type request are passed to HTTPS VS via configured tunnel. Considering above I hoped that it's possible to use similar setup using iRule with nexthop command configured like that: nexthop "tcp-forward type tunnel name" (used as well /Common/tunel_name) But I never managed to pass any traffic via this tunnel - CLIENT_ACCEPTED event was never triggered on VS enabled on tunnel used in nexthop. Is that possible to use nexthop like that? If so how to do that: * in which event it should be called - or it does not matter? * what tunnel type can be used - if not tcp-forward type? PiotrHelp needed to Explain what Vlan and Tunnel Traffic is for?
Hi, I am new to F5 and I am trying to configure a new virtual server. One of the parameters is the vlan and tunnel traffic, which by default is enabled on. help needed here to explain what is this for? If I configure my virtual server to have virtual address in VLAN_3, and I enable vlan traffic only on VLAN-3, does this mean only requests sourced from VLAN-3 network will be accepted by F5 ltm? Thank You