CirrusWhen configuring firewall rules to allow clustered DMZ F5's to communicate with backend pool members, do i need to enter the Self IP's of both LTM's AND the floating IP, or just the Self IP's? My understanding is that the floating IP is strictly for clustering and heartbeat connectivity between the two F5 boxes in a traffic group.
CirrocumulusThe non-floating self ips on both big-ips will need access to the backend pool members for health monitoring.
The floating self ips, if configured and using SNAT Automap, for example, will be used for application traffic so may also need firewall rules in place. So floating self ips can be used for servers' default gateways in an inline setup and/or the source address of incoming client traffic if the servers' default gateways is not the bigips.
Hope this helps,
N
NimbostratusPossibly. If you are using SNAT automap on the LTM, then you will need to configure the floating IP address in your admission rule because all traffic will originate from it. If you configure an explicit SNAT IP or pool, those will require admission also. If you are not using SNAT, then you should only require the Self IP's to allow for monitoring, but would also need to permit all client traffic from the internet as well, since the F5 will not change the source IP of the packet without SNAT enabled.
Nimbostratushi, this may help you as well if you are using automap. https://support.f5.com/kb/en-us/solutions/public/7000/300/sol7336.html In short, there may be a chance (depending on you configurations) that self IPs are selected. But if configured correctly, I suppose that only the floating IP will be used (assuming that you require cluster failover feature).