Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Dec 02, 2013

Using LTM for network forwarding

Our data center architecture has a pretty standard model, with an "internal" network and a "DMZ". Our internal network does not have a direct route to the Internet. However, I have LTMs in our DMZ th...
deployment
design
Thomas_Gobet's avatar
Thomas_Gobet
Icon for Nimbostratus rankNimbostratus

You can do 2 things (or more) :

 

  1. Create as many Virtual Server as there's Microsoft public networks (exhausting work)
  2. Create one virtual server with a wildcard IP (0.0.0.0/0) and limited to your internal Microsoft server IP as source.

I'll detail the second point, which is the easiest way to make it.

 

You have to create a virtual server with these parameters :

 

  1. Type : Forwarding (IP)
  2. Destination : Network with Address 0.0.0.0 and Mask 0.0.0.0
  3. Service Port : Any or one virtual server per ports you have
  4. VLAN : Enabled on "Your_Internal_VLAN"
  5. SNAT Automap to be sure the traffic will be send back through the F5
smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Dec 02, 2013
Oh for sure I would have to SNAT this traffic, though not because the server is in private address space (it's not). True I could write an iRule, but I was hoping to create new objects to facilitate this communication instead of relying on an iRule. I didn't intend to get into this, but there's a number of reasons I don't want to do that. But let me consider how this might work for a minute. Using your approach, first we would need to configure our internal routers to say if the destination is one of the Microsoft public networks, it should route to our LTMs. Then I would need to apply an iRule on the LTM which says if the destination is one of those Microsoft public networks, enable SNAT. Then our LTM would forward the connection to its default gateway, which would then forward it out to the Internet. Is that how it would work, or is that nonsense?