Forum Discussion

dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Sep 17, 2014

Routing Domains, HA and wrong ARP entries

Hi,

 

I am new to F5 so sorry for any obvious questions. My setup is based on two LTM VE in Active-Passive config using 1.5.1 HF4. Two Routing Domains configured: default (ID0) with internal, external, HA, http-tunnel, socks-tunnel RD2 (ID1) with DMZ, Route2

 

internal use port 1.2 connected to separate VMWare port group (ESX) on both LTM VE with MAC address ending: bigip1 - 6c:d8 bigip2 - 68:f7

 

DMZ use port 1.4 connected to separate VMWare port group (ESX) on both LTM VE with MAC address ending: bigip1 - 4c:45 bigip2 - 32:75

 

Route2 is irrelevant for this issue

 

Self IP assigned internal: bigip1 - 10.128.50.102 bigip2 - 10.128.50.103 DMZ bigip1 - 10.128.50.102%1 bigip2 - 10.128.50.103%1

 

When doing ping from bigip1 CLI I can ping both internal and DMZ IP on bigip2 Problem is when looking into ARP cache on bigip1 After ping 10.128.50.103 and tmsh show net arp I can see: 10.128.50.103 10.128.50.103 00:50:56:a9:68:f7 /Common/internal 295 resolved That is OK as ping is using internal on bigip1 and response is from port 1.2 (internal) on bigip2

 

After ping 10.128.50.103%1 and tmsh show net arp I can see: 10.128.50.103%1 10.128.50.103%1 00:50:56:a9:68:f7 /Common/DMZ 264 resolved That is part I don't get. Ping is using DMZ on bigip1 but reply is from port 1.2 (internal) on bigip2 (68:f7). I expected to get reply from port 1.4 (DMZ) on bigip2 - 32:75

 

After creating floating IP 10.128.50.201 (internal) and 10.128.50.201%1 (DMZ) ping from bigip2 to both of those addresses is responded from internal port 1.2 on bigip1 (6c:d8), form me when 10.128.50.201%1 is pinged response should be from port 1.4 (DMZ) on bigip1 - 4c:45.

 

Is that normal behavior or something is messed up in my config or there is some bug in 1.5.1HF4?

 

Piotr

 

application delivery
design
LTM
network
TMOS
virtualization

7 Replies

Sort By
  • jgranieri's avatar
    jgranieri
    Icon for Nimbostratus rankNimbostratus
    Sep 17, 2014

    My understanding of route domains is that it can share routes/pools/nodes and virtual servers but it cannot have the same self ip's unless they are on different vlans. I think your route domains must have unique self ip's IF on the same vlan. if on different vlans then you can use the same self ip's

     

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Sep 17, 2014

    Well,

     

    DMZ VLAN is assigned to own Route Domain (ID1), internal VLAN is assigned to default (ID0). Both of mentioned VLANs are using separate ports on LTM, DMZ port 1.4, intrnal port 1.2. Each port is connected to separate port group on vSwitch. So everything is as far as I understand separated. I have no issue to apply same ip (except %1) to self and floating IP. Each self is assigned to separate VLAN so 10.128.50.102 is assigned to internal and 10.128.50.102%1 to DMZ. There are no other errors or issues reported in log except that wrong MAC addresses are listed in ARP - at least for me those are wrong but maybe I am wrong.

     

    Piotr

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Sep 17, 2014
      Additionally new Route Domain (ID1) has Strict Isolation: Enabled and Parent Name: None so no traffic should be routed between RD. Piotr
  • Eric_St__John's avatar
    Eric_St__John
    Icon for Employee rankEmployee
    Sep 17, 2014

    What are the results if you perform the ping command within rdexec? 'rdexec 1 ping 10.128.50.103'

     

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Sep 17, 2014

    Hmm, result is the same, reply from port 1.2 (internal) on bigip2

     

    What is even stranger form me is how other ping is working: 1. DMZ port group on vSwitch - connetcted VM with 10.128.50.10 IP and port 1.4 (DMZ) on both bigip LTM 2. Intenral port group on vSwitch - connetcted other VM with 10.128.50.10 IP and port 1.2 (internal) on both bigip LTM

     

    When issuing ping on bigip1 to 10.128.50.10%1 I am getting response from VM connected to internal VLAN even if show net arp is reporting that 10.128.50.10%1 address responded on DMZ VLAN.

     

    There should be no routing between default and ID1 Route Domains so I can't figure out how ping using DMZ can be responded by host using only Internal VLAN.

     

    Piotr

     

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Sep 17, 2014

    That is effect of pinging ip that should reach host in DMZ VLAN only

     

    10.128.50.10%1 10.128.50.10%1 00:50:56:a9:08:24 /Common/DMZ 186 resolved 10.128.50.11%1 10.128.50.11%1 00:50:56:a9:08:24 /Common/DMZ 262 resolved 10.128.50.12%1 10.128.50.12%1 00:50:56:a9:25:75 /Common/DMZ 270 resolved

     

    As you can see for some reason ip 10 and 11 are replied by host in internal VLAN but 12 by correct host in DMZ vlan. It seems to be a bit random. Sometimes 11 is replied by host in DMZ sometimes by host in internal. For some strange reason ip 12 is always replied by host in DMZ even if same IP is assigned to hosts in both VLANS. I can see in wireshark that indeed ping for 10 and 11 is send to host in internal VLAN.

     

    Piotr

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Sep 17, 2014
      As you can see all is working correct for 10.128.50.12 10.128.50.12 10.128.50.12 00:50:56:a9:08:24 /Common/internal 272 resolved 10.128.50.12%1 10.128.50.12%1 00:50:56:a9:25:75 /Common/DMZ 18 resolved