Forum Discussion

JamesCrk's avatar
JamesCrk
Icon for Cirrus rankCirrus
Oct 10, 2023

Stateless routing

HI all, as per K7595 we created a route forwader with loose initation and loose close enabled, however we still have traffic hitting this route forwarder get dropped as out of state every month or so usually after another unrelated network glitch seems to trigger it. We see the F5 sending Reset packets during the issue,  the remmedy, we delete and re-add the forwader and the traffic starts flowing again. (the forwader is a /32 mask)

 

Is there some other setting we can use to make it a complelety dumb packet pusher for this IP address? 

security

7 Replies

Sort By
  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Icon for MVP rankMVP
    Oct 11, 2023

    Hi JamesCrk , 

    Have you added the correct routes on bigip ip , for instance ( Static routes ). 

    Creating forward virtual server will help to make bigip process traffic that destinated to the Forwarder Virtual server ip , but you need to adjust the routes of bigip itself. 

    another thing : 
    take a packet capture in both directions ( Client/server ) to see if bigip send/receive traffic on both sides or not.

    • JamesCrk's avatar
      JamesCrk
      Icon for Cirrus rankCirrus
      Oct 11, 2023

      Hi, the routing works fine, its only when the tcp gets out of state for some reason the F5 starts rejecting it, we just want to allow that through regardless of state

      • Mohamed_Ahmed_Kansoh's avatar
        Mohamed_Ahmed_Kansoh
        Icon for MVP rankMVP
        Oct 11, 2023

        Hi JamesCrk , 
        I believe you can retrieve your dropped connections by deleting it's entry from Connection table , no need to create the forwarder VS again. 
        use this article to delete it : https://my.f5.com/manage/s/article/K53851362

        If your connections are continous and not reach to idle timeout and there is a glitch in your network , sure this is may cause an impact for these connections and deleting them from connection table will solve it. 

        I faced an issue like this before similar to your scenario

  • wtwiggs's avatar
    wtwiggs
    Icon for Altocumulus rankAltocumulus
    Oct 11, 2023

    what do you have configured for "Reset on Timeout" on the profile? also what is your timeout value set to?

    also is SYN cookie protection (challenge) disabled? see https://my.f5.com/manage/s/article/K99545311

    can you share more details on the virtual server configuration (you mention /32 mask) as well as the protocol profile configuration? and what version are you running?

    • JamesCrk's avatar
      JamesCrk
      Icon for Cirrus rankCirrus
      Oct 12, 2023

      Hi this is what we have configured:

       

      ltm profile fastl4 /Common/my_route_friendly_fastl4 {
      app-service none
      defaults-from /Common/fastL4
      idle-timeout 300
      loose-close enabled
      loose-initialization enabled
      reset-on-timeout disabled
      syn-cookie-enable disabled
      syn-cookie-whitelist disabled

      • wtwiggs's avatar
        wtwiggs
        Icon for Altocumulus rankAltocumulus
        Oct 12, 2023

        that looks good. fyi, we are using similar "stateless" ip forwarding virtual servers extensively in our datacenter with inline i5800 appliances and no issues. we use wildcard forwarders (0.0.0.0/0) and route domains to carve up different segments. combination of static and dynamic routing. this way our clients go thru the F5 with no SNAT requirement on datacenter apps.

        other couple of things comparing configs you might check/verify:

        in the forwarding virtual server properties do you have source-port preserve-strict enabled? ran into a "bug" where sometimes this can be a problem if not set to "strict" and ports were translating and that could cause a RST if the end to end port pair/socket is now different.

        and translate-address and translate-port disabled?

        and is your protocal set to any (not just tcp or udp)?

        sample:

        ltm virtual sample_forwarder {
        destination 0.0.0.0%4:any
        ip-forward
        mask any
        profiles {
        profile_dc_fastl4 { }
        }
        source 0.0.0.0%4/0
        source-port preserve-strict
        translate-address disabled
        translate-port disabled
        vs-index 4
        }

        also curious about your /32 on the listener? what is the use case you are doing? as mentioned ours are wildcard and we then let routing decide how to move the packet. we don't have any gateway IP on the F5 since a downstream router is the subnet's gateway, and we have routing established between the F5 and router. but if you do have gateways on the F5 are they being accomplished thru this /32 or via a separate self IP (floating if you are doing redundant and basically similar to vrrp/hsrp)?  we've done that before, using self IP as the subnet gateway and wildcard forwarder to pass all the stateless packets thru once the devices arp for the gateway.

        hope this helps please share more info and maybe another idea/detail will surface...