Forum Discussion

Dmetcalfe_13626's avatar
Dmetcalfe_13626
Icon for Nimbostratus rankNimbostratus
Jul 17, 2014

Inline load balancing

So, I know this question has been asked before but there appears to be no clear answer. I need to preserve the source IP so that our spam server can detect brute force hack attempts on a customer facing mail build. I have made the DG of the mail servers the F5's self IP (this is just in a lab atm, to experiment before deployment so there is no failover). I need to be able to load balance to the mail servers while also maintaining that source ip. Do I create virtual servers for the mail protocols AND create a forwarding virtual server, or is there some way I can just allow all that traffic through while still load balancing? What is the best design for this? I've only ever done SNAT which is much simpler. Any help would be appreciated.

 

6 Replies

  • If your DG is the F5, then you shouldn't have to use SNAT and the source IP will be maintained. Create Virtual servers for your inbound mail protocols, and I imagine you will need a forwarding virtual server for your servers to get out via the F5.
  • You need a forwarding virtual server if your backend servers initiate new connections out their default gateway(the F5) The F5 isn't a router, it needs a VS that maps to a pool containing your upstream router to handle the requests.

     

    Being these are mail servers and probably deliver mail outside of your network as well as probably grab updates/signatures, I would assume you need this. There are other implementations though where the backend servers only receive traffic through the default gateway, so a forwarding virtual isn't necessary.

     

    A real-world example I have is a VPN gateway that only accepts connections, it learns routes to internal networks via other interfaces, gets managed/updated through a management interface, and never needs to initiate a new connection outbound to the internet via its default gateway. No forwarding vs was needed in this implementation.

     

    • Dmetcalfe_13626's avatar
      Dmetcalfe_13626
      Icon for Nimbostratus rankNimbostratus
      Thanks for replying. Right now I have a forwarding virtual server that has the gateway as its pool member, but what your saying is that it should be the upstream device thats a pool member instead? That makes sense and that's where I was having a gap, because I couldn't figure out how it would route beyond that without a static route or some other means of getting outside. I am still foggy on how the traffic will work though. Are you saying its ok to have a bunch of VS serving different ports AND a forwarding VS? The traffic will still get load balanced to my backend servers with this config?
  • So I can leave the protocols in place to receive mail, but for SMTP I need a forwarding virtual server is what you are saying. How do I configure said server to still load balance and get outside? I have this configuration already but it doesn't work. I think I need a route somewhere.
  • The way I have implemented this is as follows.

     

    I have an external interface, this is the interface/subnet that my virtual server IP addresses are on. I have an internal interface, this is the interface/subnet that the backend virtual servers are on. There is a router on the external interface, which is the default gateway for the F5.

     

    On the internal interface, I have a virtual server, with a destination network of 0.0.0.0 mask 0.0.0.0. It is a Performance Layer 4 type VS, for all ports and all protocols. The default pool for this VS contains the IP address of the router that sits infront of the external interface. My backend servers then use the floating self-ip as their default gateway.

     

    There are other ways to accomplish this as well. See http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html for more info. You can setup a forwarding server that does use the routing table of the F5 to determine the next hop.

     

    • Dmetcalfe_13626's avatar
      Dmetcalfe_13626
      Icon for Nimbostratus rankNimbostratus
      Wow, that is super helpful. Thanks mimlo! Your second suggestion was the one I first tried but the first suggestion is an awesome idea too. I will try it. Thanks again.