Monitor on Management Interface?

Is this LDAP traffic for load balancing or admin authentication? I'm assuming it's the former.

 

 

I assume the load balanced traffic from LTM to the LDAP pool is going out a switch interface and you just can't add the static self IP addresses to the firewalls? If so, I imagine you could technically create an admin route (b mgmt route from the command line) which points the LDAP destined traffic over the mgmt port. I'm not sure if you just get warning messages or if the route is ignored.

 

 

If you're actually trying to route load balanced traffic out the management port, it's strongly discouraged. The mgmt port should be isolated from client traffic so the mgmt interface will be available to administrators. Also, the mgmt port is limited to 100Mb. I'm sure there are other reasons to avoid this as well.

 

 

Are you sure it's not possible to allow monitor traffic via the switch ports? That's the best practice method for a reason.

 

 

Aaron

Posted By hoolio on 05/28/2009 11:20 AM

 

I'm sure there are other reasons to avoid this as well.

 

 

 

 

The big one being you don't want client traffic having to traverse in and out of tmm to the Linux kernel. Major resource penalty for the host and probably not too good for tmm either.

 

 

Denny

 

Is this LDAP traffic for load balancing or admin authentication? I'm assuming it's the former.

 

 

 

Neither. The purpose of the monitor is to intermittently send a request out of the management interface to the AD server to see if it is up and running. The F5s are not loadbalancing the LDAP traffic nor are they using AD for admin authentication.

 

 

Are you sure it's not possible to allow monitor traffic via the switch ports?

 

 

 

Yes. We want no outside traffic from the F5 1.x interfaces to the switch ports.

 

 

If you're actually trying to route load balanced traffic out the management port, it's strongly discouraged.

 

 

 

We're not trying to do this. We would like to set up a monitor that would come out of the managment interface that would check to see if the AD/LDAP server is available. It would not be tied to the load balanced traffic in any way.

 

 

Thanks for the replies!

Thanks for the feedback Denny! The F5s are load balancing to servers who will perform a Kerberos check for incoming users. The client is requesting that we run a monitor on the F5 to the LDAP server to monitor the LDAP server in the event that the Kerberos check fails.

 

 

Thanks again!