Hi, I have configuration: NET => FW => F5 => SRV I have VS1 which forwards traffic to SRV (no SNAT used, not possible to do XFF so source address of client is seen). F5 is def gw for SRV. On F5 there is also forwarding IP VS 0/0 and def route to FW. FW also have static route for SRV subnet poiting to F5. Questions: 1. Client from net goes to VS1 (SNAT off) is redirected to SRV (source address is seen, destination nat is in place to pass traffic to SRV). I assume that return traffic from SRV is hitting VS 0/0 (am I right?) VS 0/0 have snat off. And I also assume that source address of SRV is changed to VS1 IP (am I also right?). If not, should I do some SNAT on VS 0/0? Second example. When server is originating connection to NET it hits VS 0/0, is that right? No SNAT is configured so source address of server is seen outside? The route on FW pass traffic back to SRV via F5. If point 1 is true (so when return traffic is automatically SNATed back to VS1 IP) what determines that traffic is SNATed or not? Is it previously created session/entry for DNAT when traffic originating from Net hits VS1?

There is mistake in question numbers. I do not know why I cannot edit it. Before "Second example" should be "2" and of course instead of 2 should be 3

Please paste full configuration of your 0.0.0.0/0 VS. There are many ways the routing can be done.

ltm virtual forward-all { destination 0.0.0.0%8:any ip-forward mask any profiles { fastL4-test { } } source 0.0.0.0%8/0 translate-address disabled translate-port disabled vlans { server-vlan } vlans-enabled vs-index 307 } ltm profile fastl4 fastL4-test { app-service none defaults-from fastL4 loose-close enabled loose-initialization enabled reset-on-timeout disabled }

inline configuration

26 Replies

thomass87_91937
Nimbostratus
Oct 30, 2014
There is mistake in question numbers. I do not know why I cannot edit it. Before "Second example" should be "2" and of course instead of 2 should be 3
Hannes_Rapp
Nimbostratus
Oct 30, 2014
Please paste full configuration of your 0.0.0.0/0 VS. There are many ways the routing can be done.
- thomass87_91937
  Nimbostratus
  Oct 30, 2014
  ltm virtual forward-all { destination 0.0.0.0%8:any ip-forward mask any profiles { fastL4-test { } } source 0.0.0.0%8/0 translate-address disabled translate-port disabled vlans { server-vlan } vlans-enabled vs-index 307 } ltm profile fastl4 fastL4-test { app-service none defaults-from fastL4 loose-close enabled loose-initialization enabled reset-on-timeout disabled }
- thomass87_91937
  Nimbostratus
  Nov 02, 2014
  I have question regarding my VS 0/0 configuration. It is enabled only on server-vlan. If I understand correctly when the server itself is originating connection outside it will hit VS 0/0. How does this configuration applies when connection is originating from another subnet (for example behind FW) to server IP address (not VS1). Connection will be dropped/rejected? Should VS 0/0 listen on all vlans to allow such connections?
Hannes_Rapp_162
Nacreous
Oct 30, 2014
Please paste full configuration of your 0.0.0.0/0 VS. There are many ways the routing can be done.
- thomass87_91937
  Nimbostratus
  Oct 30, 2014
  ltm virtual forward-all { destination 0.0.0.0%8:any ip-forward mask any profiles { fastL4-test { } } source 0.0.0.0%8/0 translate-address disabled translate-port disabled vlans { server-vlan } vlans-enabled vs-index 307 } ltm profile fastl4 fastL4-test { app-service none defaults-from fastL4 loose-close enabled loose-initialization enabled reset-on-timeout disabled }
- thomass87_91937
  Nimbostratus
  Nov 02, 2014
  I have question regarding my VS 0/0 configuration. It is enabled only on server-vlan. If I understand correctly when the server itself is originating connection outside it will hit VS 0/0. How does this configuration applies when connection is originating from another subnet (for example behind FW) to server IP address (not VS1). Connection will be dropped/rejected? Should VS 0/0 listen on all vlans to allow such connections?
Hannes_Rapp
Nimbostratus
Oct 30, 2014
Sorry, but I'll try to answer only your first question right now. We'll come back to others once we have time, or maybe others can help.

"Questions: 1. Client from net goes to VS1 (SNAT off) is redirected to SRV (source address is seen, destination nat is in place to pass traffic to SRV). I assume that return traffic from SRV is hitting VS 0/0 (am I right?) VS 0/0 have snat off. And I also assume that source address of SRV is changed to VS1 IP (am I also right?). If not, should I do some SNAT on VS 0/0?"

If VS1 is from where client comes in (another VS with a pool attached), then the return traffic won't go past the VS 0/0, but it will be routed back from the same VS1. Client will see the source IP address of return packets, the same as VS1 external listener IP. Traffic will go through the VS0/0, only if the session was initiated by SRV. (E.g SRV making a DNS request to 8.8.8.8 will be routed via VS0/0, and no NAT will be applied in F5).
- thomass87_91937
  Nimbostratus
  Oct 30, 2014
  Connections come from FW to VS1 on F5 (not another VS with pool attached). I assume it is the same. How F5 knows that it should use VS1 not VS 0/0? Destination address of packet coming out from server is Client IP address therefore it is not any address configured on F5. Is it done on DNAT session matching or any other entry? Maybe I am just "digging" to much but I am very curious :)
- Hannes_Rapp
  Nimbostratus
  Oct 30, 2014
  In case you have VS1 listening on 192.168.1.1:any and another VS2 listening on 192.168.1.1:443 and incoming packet is for TCP 443 port, then VS2 gets the connection. Same "closest-match" logic works with per-IP/subnet for choosing which VS gets to serve the client.
- thomass87_91937
  Nimbostratus
  Oct 31, 2014
  Ok, maybe some example (SIP = source IP; DIP = destination IP): Packet from net/fw to F5 VS1:80 => SIP:1.1.1.1 DIP:192.168.1.1 (192.168.1.1 is VS1) Packet from F5 to SRV => SIP 1.1.1.1 DIP: 192.168.2.1 (no snat, 192.168.2.1 is server IP address) Response packet from SRV to F5 => SIP:192.168.2.1 DIP:1.1.1.1 Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1 However, according to: "when Local Traffic Manager does not find a specific virtual server match for a client’s destination IP address, LTM matches the client’s destination IP address to a wildcard virtual server," (https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic.
Hannes_Rapp_162
Nacreous
Oct 30, 2014
Sorry, but I'll try to answer only your first question right now. We'll come back to others once we have time, or maybe others can help.

"Questions: 1. Client from net goes to VS1 (SNAT off) is redirected to SRV (source address is seen, destination nat is in place to pass traffic to SRV). I assume that return traffic from SRV is hitting VS 0/0 (am I right?) VS 0/0 have snat off. And I also assume that source address of SRV is changed to VS1 IP (am I also right?). If not, should I do some SNAT on VS 0/0?"

If VS1 is from where client comes in (another VS with a pool attached), then the return traffic won't go past the VS 0/0, but it will be routed back from the same VS1. Client will see the source IP address of return packets, the same as VS1 external listener IP. Traffic will go through the VS0/0, only if the session was initiated by SRV. (E.g SRV making a DNS request to 8.8.8.8 will be routed via VS0/0, and no NAT will be applied in F5).
- thomass87_91937
  Nimbostratus
  Oct 30, 2014
  Connections come from FW to VS1 on F5 (not another VS with pool attached). I assume it is the same. How F5 knows that it should use VS1 not VS 0/0? Destination address of packet coming out from server is Client IP address therefore it is not any address configured on F5. Is it done on DNAT session matching or any other entry? Maybe I am just "digging" to much but I am very curious :)
- Hannes_Rapp_162
  Nacreous
  Oct 30, 2014
  In case you have VS1 listening on 192.168.1.1:any and another VS2 listening on 192.168.1.1:443 and incoming packet is for TCP 443 port, then VS2 gets the connection. Same "closest-match" logic works with per-IP/subnet for choosing which VS gets to serve the client.
- thomass87_91937
  Nimbostratus
  Oct 31, 2014
  Ok, maybe some example (SIP = source IP; DIP = destination IP): Packet from net/fw to F5 VS1:80 => SIP:1.1.1.1 DIP:192.168.1.1 (192.168.1.1 is VS1) Packet from F5 to SRV => SIP 1.1.1.1 DIP: 192.168.2.1 (no snat, 192.168.2.1 is server IP address) Response packet from SRV to F5 => SIP:192.168.2.1 DIP:1.1.1.1 Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1 However, according to: "when Local Traffic Manager does not find a specific virtual server match for a client’s destination IP address, LTM matches the client’s destination IP address to a wildcard virtual server," (https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic.
Hannes_Rapp
Nimbostratus
Oct 31, 2014
"... Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1"

SIP is 192.168.1.1

"(https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic."

Response packets are already routed back as per connections table records, not as per virtual server configurations. You certainly don't have to configure 1.1.1.1 VS to ensure response packets are routed back.
- thomass87_91937
  Nimbostratus
  Nov 02, 2014
  Hannes, now it is clear for me. Thank you for explanation. I have also question regarding my VS 0/0 configuration. I asked it under VS 0/0 configuration above.
Hannes_Rapp_162
Nacreous
Oct 31, 2014
"... Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1"

SIP is 192.168.1.1

"(https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic."

Response packets are already routed back as per connections table records, not as per virtual server configurations. You certainly don't have to configure 1.1.1.1 VS to ensure response packets are routed back.
- thomass87_91937
  Nimbostratus
  Nov 02, 2014
  Hannes, now it is clear for me. Thank you for explanation. I have also question regarding my VS 0/0 configuration. I asked it under VS 0/0 configuration above.
Hannes_Rapp
Nimbostratus
Oct 31, 2014
"... Response packet from F5 to Client => SIP: ??? DIP:1.1.1.1 Instead of "???" which SIP is correct? 192.168.1.1 or 192.168.2.1? I assume and as you said previously (and I want to be) it is 192.168.1.1"

SIP is 192.168.1.1

"(https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/2.html) 1.1.1.1 is not configured on F5 and maybe VS 0/0 will be chosen. In other hand, this quotation does not say if it applies to first/incoming traffic or return traffic."

Response packets are already routed back as per connections table records, not as per virtual server configurations. You certainly don't have to configure 1.1.1.1 VS to ensure response packets are routed back.
nitass_89166
Noctilucent
Nov 03, 2014
Second example. When server is originating connection to NET it hits VS 0/0, is that right? No SNAT is configured so source address of server is seen outside? The route on FW pass traffic back to SRV via F5.

yes unless you also have snat list configuration.

It is enabled only on server-vlan. If I understand correctly when the server itself is originating connection outside it will hit VS 0/0. How does this configuration applies when connection is originating from another subnet (for example behind FW) to server IP address (not VS1). Connection will be dropped/rejected? Should VS 0/0 listen on all vlans to allow such connections?

yes connection will be rejected. bigip is default deny device. to allow traffic, object listener (i.e. virtual server, snat, nat) is required.

sol9038: The order of precedence for local traffic object listeners

https://support.f5.com/kb/en-us/solutions/public/9000/000/sol9038.html
- thomass87_91937
  Nimbostratus
  Nov 03, 2014
  OK, it is clear now. Thanks.
nitass
Employee
Nov 03, 2014
Second example. When server is originating connection to NET it hits VS 0/0, is that right? No SNAT is configured so source address of server is seen outside? The route on FW pass traffic back to SRV via F5.

yes unless you also have snat list configuration.

It is enabled only on server-vlan. If I understand correctly when the server itself is originating connection outside it will hit VS 0/0. How does this configuration applies when connection is originating from another subnet (for example behind FW) to server IP address (not VS1). Connection will be dropped/rejected? Should VS 0/0 listen on all vlans to allow such connections?

yes connection will be rejected. bigip is default deny device. to allow traffic, object listener (i.e. virtual server, snat, nat) is required.

sol9038: The order of precedence for local traffic object listeners

https://support.f5.com/kb/en-us/solutions/public/9000/000/sol9038.html
- thomass87_91937
  Nimbostratus
  Nov 03, 2014
  OK, it is clear now. Thanks.