F5OS VLAN naming length restrictions
I must notice, that there seems to be a length restriction when creating VLANs on F5OS. I'm allowed to enter long names on F5OS-level without any warnings or errors, but when assigning them to a tenant, the name within the tenant will be truncated if its longer than 31 characters. It looks like this, means there is a suffix in the format of "-T<VLAN-ID>.0" On F5OS-level it looks like this: Is this a normal behavior? Can or will this be fixed? And are there any other such restrictions for other configuration items? For your reference, we are running F5OS 1.8.3 and BIG-IP 17.5.1.3. Thank you! Regards, Stefan :)
Floating IP responds from wrong VLAN/trunk
I have a routing issue I can't seem to figure out the cause of. I have two trunks defined, T1 on 1.1 and 1.2, and T2 on 1.3 and 1.4. Both trunks are connected to the same switch (on the same VLAN on the switch). I have two VLANs tied to the respective trunks, V1 on T1 and V2 on T2. I have two traffic groups, TG1 and TG2, with masquerade MACs. I have two routing domains, 0 and 255. I have local self IPs defined on the respective VLANs, say 10.0.0.3 on V1 and 10.0.255.3%255 on V2. I have floating self IPs, such as 10.0.0.2 on V1 and TG1, and 10.0.255.2%255 on V2 and TG2. When I ping 10.0.0.3 and 10.0.255.3 I get proper responses. No problems there. When I ping 10.0.0.2 I proper responses. When I ARP 10.0.255.2, it resolves to the MAC of TG2 and the switch it's connected to routes that MAC to T2. However, when I ping 10.0.255.2 only the first response comes back - but it comes back from T1 and with the MAC of TG1. When the second (and further) ping is sent, it's consequently (due to MAC learning) sent to T1 - which is not accepting it. Why is the ping response sent back from T1 when the request was sent to T2? Why is the floating IP in V2, TG2 and routing domain 255 not responding from the same interface as it receives the ICMP package on?
F5 BIG-IP answers with a self-ip that is not associated with that VLAN
Hi, I am working on implementing av proxy-solution with the help of F5 BIG-IP to do SSL-decrypt. In short: Users surf the web, and the traffic hits the F5 internal VLAN over a fiber-trunk(2.1 and 2.2), the next hop for the traffic is a pool containing a proxy-solution(int 1.1). After the traffic has passed the proxy, it returns to the F5 on a different interface(1.2) and is Auto Mapped before being sent to the pool containing the internet facing router. But for some reason it all stops when the proxy tries to send the traffic back to the F5 on Int 1.2. In the tcpdump I can see that the F5 is responding to requests from the proxy with the same self-IP that is defined on the internal VLAN that is assigned to the fiber trunk. And for that reason the connection times out, and the users have no internet access. A tracert from a klient looks like this: 1 <1 ms 156 ms <1 ms 192.168.50.13 - Client 2 1 ms 147 ms <1 ms 192.168.50.1 - Router on the way 3 2 ms 1 ms 1 ms 192.168.1.12 - BIG-IP Local self-ip internal 4 2 ms 2 ms 3 ms 192.168.1.114 - Proxy IP 5 4 ms 211 ms 4 ms 192.168.1.12 - BIG-IP Local self-ip - Now on the vs_proxy_return VLAN (verifed with tcpdump) 6 Host unreachable Internal VLAN local Self-ip: 192.168.1.12 Internal VLAN floating Self-ip: 192.168.1.14 Proxy_return VLAN local Self-ip: 192.168.1.118 Proxy_return VLAN floating Self-ip: 192.168.1.119 The Proxy is connected directly to the F5, no switches involved. One TP into port 1 and out again of port 2. There is no NATing in the proxy, so the packet should be untouched. Config: ltm virtual /Common/vs_proxy { description destination /Common/0.0.0.0:0 mask any pool /Common/pool_proxy profiles { /Common/fastL4 { } } source 0.0.0.0/0 translate-address disabled translate-port disabled vlans { /Common/internal } vlans-enabled } } ltm virtual /Common/vs_proxy_return { description "" destination /Common/0.0.0.0:0 mask any pool /Common/pool_gateway profiles { /Common/fastL4 { } } source 0.0.0.0/0 translate-address disabled translate-port disabled vlans { /Common/cp_proxy_return } vlans-enabled } Is this a bug, or am I doing something very very wrong here? This works on a customer I have, but on 1.4.1, this is done on 1.5.1 HF3.
BIP-IP 1600 VLAN bridge performance degradation
Hello, I have a BIP-IP 1600 series setup as part of my thesis work. The setup is as follows: (VLAN=20) Client1 --- F5 --- Server1 (VLAN=10) 572 Mbit/s. Client1 --- Cisco --- Server1 (No VLAN) 937 Mbit/s In the setup I have two VLANs, one public and one private. I do bridge'ing between the VLANs in the BIG-IP, but for some reason that downgrades the performance. In the bridge'ed setup with two machines directly connected to the BIG-IP on two separated VLANs the reported speed is around 572 Mbit/s. For a normal link the iperf reported speed is 937 Mbit/s when the traffic is only directed through a cisco switch. Is this normal behavior for the BIP-IP to degrade the performance, or I am doing something wrong? Thanks!
How to forward traffic to detached vlan?
VLANs are visible in management plane. It makes it possible to run local process that has access to such vlan (it allows to run custom applications on F5 appliance such as nodejs web servers). Is it possible to create vlan interface that is purely virtual (not assigned to any physical interface) and forward traffic to it from eg. ip forwarding vs? Ultimately I'd like to test one L2 analyzer "inline" by running it on F5 and forwarding traffic to it. Final packets flow I'd like to achieve would be something like this: world -> vlan_world -> ip_forward_vs -> vlan_detached_1 -> my_analyzer -> vlan_detached_2 -> vlan_lan -> lan or functional equivalent. my_analyzer app forwards L2 packets in software (behaves like bridge). If necessary I accept solution using iRules. For now the only solution I see is to use 2 conventional vlans assigned to interfaces and make short loop using physical cable but that would be waste of 2 interfaces which I'd prefer to avoid.
Restricting traffic between Vlans.
We have an F5 servicing our DMZ. It hosts the external IPs and acts a router for the DMZ servers. +--- [ VLAN_2110 ] [ Internet ] ---- [ F/W ] ---- [ F5 ] --+ +--- [ VLAN_2310 ] Recently a new requirement has emerged to keep one group of Vlans from talking to another group. A for instance would be that VLAN_2110 and VLAN_2310 in the above sketch would not be allowed to talk to each other. Can the F5 do this?Multiple Route Domains in same partition
Hi all, So my doubt is, if there is anything wrong in creating more than one route domain in partition common? I want to create Route Domain 3 ( 0 is the default and already exists), in order to separate the routing table of a VIP/Network, that will be created for Internet traffic only. For what i know i will have to create: 1 - Vlan 2 - Route Domain 3 - Assign created Vlan to Route Domain 4 - Self IP like 1.1.1.248%3 and assign created Vlan to it. 5 - VIP like 1.1.1.1%3 6 - Nodes - 2.2.2.2%3 7 - Static Route - 1.1.1.0%3 Gateway 1.1.1.254%3 Is this correct or do we got to have anything more in attention? Is it better to create a partition for it, os its fine to just have the 2 route domains in same partition?Viprion: Modify VLAN tags in bigip_base.conf
Hello friends. I unfortunately have no lab viprions to test this. I have two VLAN tag mismatches on one of my hosts, and that VLAN is on all 5 guests that reside on the host. I need to rectify this mismatch in order to deploy BIG-IQ, otherwise I get error conditions and offline guests. My friend gave me this process: Take a backup of the bigip_base.conf Edit the bigip_base.conf tmsh load sys config verify tmsh load sys config Check the results, commit the change with tmsh save sys config My question is, in doing this on the host, what will then happen with the bigip_base.conf on the guests? Does "load sys config" on the host make the guests update their bigip_base.conf file as well?
