Forum Discussion

thistuffjuice_3's avatar
thistuffjuice_3
Icon for Altostratus rankAltostratus
Aug 31, 2017

LTM Packet Filters Health Monitor Probes

Reading up on F5 LTM Packet-Filter's and rules, I believe that this is initially processed in order of inbound traffic before processing the traffic any further.

 

Assuming that the following configuration is set

 

  • Packet Filtering = Enabled
  • Unhandled Packet Action = Discard
  • Filter Established Connections = Disabled

I believe that this is all stateful, so example an LTM Layer4 TCP monitor (TCP SYN request on ANY alias service port) would not be denied as traffic is outbound from the LTM to the back-end pool-member's and back to the LTM.

 

However, at node level layer three ICMP monitor. Do you have to configure your LTM packet-filter to allow inbound ICMP protocol to ensure the ICMP echo-reply is allowed inbound to LTM? If so, can you confirm a syntax example for this rule? Does LTM packet-filter's perform stateful inspection on all protocols?

 

Is there any way to see a packet-filters stateful firewall table? Or any alternate way of troubleshooting on top of checking the LTM logs/packet-filter?

 

I am aware of the Always Accept Important ICMP option, however this would only be an ICMP echo-reply coming back from the server to the LTM and not any of the "special" ICMP types and codes listed in the config guide.

 

link text

 

link text

 

Cheers!

 

application delivery
BIG-IP
LTM
security

1 Reply

Sort By
  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Aug 31, 2017

    By default the packet rules accept all traffic. They also accept all traffic that matches an existing connection. So unless you explicitly configure a rule to deny, it will be allowed. You can view existing connections via the connection table using standard tmsh commands (tmsh show sys conn) but be aware that this can take a while to run on a busy box, and cancelling it can cause tmm to core.

     

    As such we really don't normally maintain a table for packet filters. You should not need to explicitly allow ICMP Echo response, but if you think your packet filters are catching your responses, you can try setting Allow Important ICMP and see if the observed behavior changes.