Forum Discussion

Eric_Radhik_123's avatar
Eric_Radhik_123
Icon for Nimbostratus rankNimbostratus
Feb 26, 2013

Using the F5 as a L2 pass-thru or as a L3?

Curious to hear the opinions of using the F5 as a Layer 2 pass thru instead of using it as a dedicated Layer 3 device. Networks and LTMs should be fast enough to pass through the traffic without any problem but what are the caveats?

 

 

Im in a scenario where we may change our network architecture to everything (meaning all vlans) behind an ASA and only route the VS subnet to the LTMs. This will give the ability for a cleaner N-Tier architecture design. We are currently having the problem of "too many hands in the pot" syndrome and all of them are not using the vlan allow access list and this is causing too many security zones to speak to each other when they are in separate zones.

 

basic
getting started
new to f5

3 Replies

Sort By
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Feb 27, 2013
    Hey Eric, the design you describe in your first paragraph doesn't seem to tally with the second paragraph. Could you clarify/be more explicit on what the intended design is please?
  • Eric_Radhik_123's avatar
    Eric_Radhik_123
    Icon for Nimbostratus rankNimbostratus
    Mar 01, 2013

    Our network infrastructure utilizes L3 interfaces in 3 different methods:

     

     

    1. L3 interface on the ASA (Vlan X)

     

     

    2. L3 interface as an SVI on a distribution switch (Vlan Y)

     

     

    3. L3 interface (self-IP/ Vlan Z) on the LTM (which was the de facto standard for use of LTMs awhile back...)

     

     

    My intent/goal is to remove all L3/vlan interfaces off of the LTM and migrate them to the ASA. (Layer 2 pass thru routing). I wanted to inquire if anyone has performed this method? Or are there any caveats to this architecture design?

     

     

    Thank you for inquiring further and I hope this new info will keep the dialogue going...

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Mar 04, 2013
    As in most cases as LTM is an endpoint in IP communications (a proxy) I doubt this is feasible. However, that will depend on the type of Virtual Servers you require. If all you need is Layer 2 forwarding then this might work, otherwise, this is not a workable design.

     

     

    You could of course remove the SVI without issue as long as you plan appropriately.

     

     

    You also seem to be suggesting you have three VLANs in play (X, Y and Z); one would suffice.