Hi Guys, I'm new to F5, and something annoy me i can't find why it happen. My topology: Network (Public IP - Pretend its 100.100.100.0/24) --> Switch Stack --> LAG --> Viprion LTM --> Cisco CRS --> WWW I have Viprion 4800 and for now i just wanna allow traffic to go outside, here are my questions : 1. I've added virtual-server with 0.0.0.0/0.0.0.0 as Forwarding (IP) to allow the LAN to have connectivity. but unless i open virtual server back inside (100.100.100.0/255.255.255.0) i have no connectivity. Isn't it statefull ? 2. After i open the rule I talked about in (1). i have this message when i try simple resolving from server behind the F5. [ip@qa-env ~]$ host google.com 8.8.4.4 ;; reply from unexpected source: 8.8.4.425965, expected 8.8.4.453 tcpdump show this 22:45:39.033309 IP 100.100.100.40.39945 > 8.8.4.4.53: 8917+ A? google.com. (27) 22:45:39.033315 IP 100.100.100.40.39945 > 8.8.4.4.53: 8917+ A? google.com. (27) 22:45:39.123868 IP 8.8.4.4.53 > 100.100.100.40.39945: 8917 1/0/0 A 173.194.41.69 (43) 22:45:39.123884 IP 8.8.4.4.25965 > 100.100.100.40.39945: UDP, length 43 So the packets goes all good until the return packet back to the F5 and then he alter the port! What am i missing ? *remember, i have public ip on the server. i just changed it to 100.100.100.40 for the example. my Virtuals ltm virtual MNG_ALLOW_ALL_OUT { description "Management Rule - Allow All Traffic Outside" destination 0.0.0.0:any ip-forward mask any profiles { fastL4 { } } translate-address disabled translate-port disabled vlans { DNS_LAN LDAP_LAN RADIUS_LAN } vlans-enabled } ltm virtual MNG_QA_ENV_IN { description "Management Rule - Allow Radius traffic in" destination 100.100.100.0:any ip-forward mask 255.255.255.0 profiles { fastL4 { } } translate-address disabled translate-port disabled vlans { CRS1.WAN CRS2.WAN } vlans-enabled }

OK, I think you should enable the external VLANs on the first Virtual Server and apply a packet filter or iRule to restrict inbound traffic to the 100.x addresses, and the necessary source ports, remove the 100.x Virtual Server. If you don't like the sound of that I'd suggest you create a Virtual Server for each outbound service instead and again, enable on the external VLANs. Make sure in the FastL4 profile you use that Loose Initiation and Loose Close are disabled. Currently, the second more specific VS is handling the return traffic rather than the first VS the outbound connections pass through and this is the cause of your issue.

Thanks for the answer, gonna give it a try. To be honest i'm very unsetisfied with the F5 Firewall handling. since it a "MUST" i guess F5 could have implemented this way better. Where can i find best cases how to handle un-LB traffic. should i open 0.0.0.0/0 and use traffic filter ? any good article about this ? Thanks again.

F5's firewall approach is a bit different as it's based on LTM, it's also pushed as an enterprise (read: internal) firewall rather than an Internet facing one. The latest guide I know of is here: http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-datacenter-firewall-config-11-1-0/7.html. The general approach is to configure specific Virtual Servers for each service you wish to allow and if you take that approach and keep it in mind, you'll be just fine.

Agreed. My issue is with management to the REAL's behind the VIP. Also, for services behind the F5 that wont LB.

Hi, I tried allowing this virtual on the WAN too. no help, still same. (no traffic filtering applied). Also, the fastL4 looks as you asked for. Any other idea ? ltm virtual MNG_ALLOW_ALL_OUT { destination 0.0.0.0:any ip-forward mask any profiles { fastL4-Clear { } } translate-address disabled translate-port disabled vlans-disabled ltm profile fastl4 fastL4-Clear { app-service none defaults-from fastL4 idle-timeout 300 ip-tos-to-client pass-through ip-tos-to-server pass-through keep-alive-interval disabled link-qos-to-client pass-through link-qos-to-server pass-through loose-close disabled loose-initialization disabled mss-override 0 pva-acceleration partial pva-offload-state syn reassemble-fragments disabled reset-on-timeout disabled rtt-from-client disabled rtt-from-server disabled software-syn-cookie disabled tcp-close-timeout 5 tcp-generate-isn disabled tcp-handshake-timeout 5 tcp-strip-sack disabled tcp-timestamp-mode preserve tcp-wscale-mode preserve $ host google.com 8.8.4.4 ;; reply from unexpected source: 8.8.4.464949, expected 8.8.4.453 ;; reply from unexpected source: 8.8.4.464949, expected 8.8.4.453

Forum Discussion

Chura_16140

Nimbostratus

Nov 15, 2012

DNS Query - reply from unexpected source

Hi Guys,

I'm new to F5, and something annoy me i can't find why it happen.

My topology:

Network (Public IP - Pretend its 100.100.100.0/24) --> Switch Stack --> LAG --> Viprion LTM --> Cisco CRS --> WWW

I have Viprion 4800 and for now i just wanna allow traffic to go outside, here are my questions :

1. I've added virtual-server with 0.0.0.0/0.0.0.0 as Forwarding (IP) to allow the LAN to have connectivity.

but unless i open virtual server back inside (100.100.100.0/255.255.255.0) i have no connectivity. Isn't it statefull ?

2. After i open the rule I talked about in (1). i have this message when i try simple resolving from server behind the F5.

[ip@qa-env ~]$ host google.com 8.8.4.4

;; reply from unexpected source: 8.8.4.425965, expected 8.8.4.453

tcpdump show this

22:45:39.033309 IP 100.100.100.40.39945 > 8.8.4.4.53: 8917+ A? google.com. (27)

22:45:39.033315 IP 100.100.100.40.39945 > 8.8.4.4.53: 8917+ A? google.com. (27)

22:45:39.123868 IP 8.8.4.4.53 > 100.100.100.40.39945: 8917 1/0/0 A 173.194.41.69 (43)

22:45:39.123884 IP 8.8.4.4.25965 > 100.100.100.40.39945: UDP, length 43

So the packets goes all good until the return packet back to the F5 and then he alter the port!

What am i missing ?

*remember, i have public ip on the server. i just changed it to 100.100.100.40 for the example.

my Virtuals

ltm virtual MNG_ALLOW_ALL_OUT {

description "Management Rule - Allow All Traffic Outside"

destination 0.0.0.0:any

ip-forward

mask any

profiles {

fastL4 { }

}

translate-address disabled

translate-port disabled

vlans {

DNS_LAN

LDAP_LAN

RADIUS_LAN

}

vlans-enabled

}

ltm virtual MNG_QA_ENV_IN {

description "Management Rule - Allow Radius traffic in"

destination 100.100.100.0:any

ip-forward

mask 255.255.255.0

profiles {

fastL4 { }

}

translate-address disabled

translate-port disabled

vlans {

CRS1.WAN

CRS2.WAN

}

vlans-enabled

}

basic

getting started

new to f5

29 Replies

What_Lies_Bene1
Cirrostratus
Nov 16, 2012
I feel vindicated =]

Persistence would only work on the outbound connection anyway. I'm still not sure why the source port would change regardless of the link used, although the MAC would which could be an issue in itself?
Chura_16140
Nimbostratus
Nov 16, 2012
i'm not sure, i'm still learning this F5 and i dont get why it behave this way.

I have dozen of devices in my network, every single one of them have 2 uplinks to my COREs and non of my client/server have issue.

I find the F5 might be very good LB and in he's main features however very bad routing device (which after all goes hand to hand)
What_Lies_Bene1
Cirrostratus
Nov 16, 2012
Sorry, I thought you meant the internet links, did you mean the LAG?
Chura_16140
Nimbostratus
Nov 16, 2012
i did, the internet links (My CORES)

the Lag is toward the stack switch, its not related.

Anyway, its time to contact F5 (Again unfortunately).

Steve, Thanks for the time invested, great community!
What_Lies_Bene1
Cirrostratus
Nov 16, 2012
OK, you're welcome. Let us know if you get a resolution, I'm dying to know.
Chura_16140
Nimbostratus
Nov 17, 2012
Ok, Here's the deal.

I have two uplinks that does Active-Active load sharing with IS-IS. Vlan for each uplink.

The F5 doesnt know how to handle Asymetric traffic therefore consider the return packet as new connection.

For now i've changed the IS-IS metrics to one uplink only to solve this. meanwhile the vendor here check the effect of activating a "Allow Asymetric" route on the chassic performance.

Once again, thanks for time invested in my case :)
What_Lies_Bene1
Cirrostratus
Nov 18, 2012
Thanks, very interesting, especially the information that there's a dedicated VLAN per link. I wonder if a VLAN Group could be useful? Please do post again if there's some setting on the F5 that resolves the issue.
Cellcom_IP_Engi
Nimbostratus
Nov 19, 2012
Since i'm using IS-IS i'm not happy to have shared vlan between my CORE and F5.

The IS-IS will built neighbor with F5, however with each other as well.
What_Lies_Bene1
Cirrostratus
Nov 19, 2012
Fair enough. Again, let us know what that magic setting is when you do.

Forum Discussion

DNS Query - reply from unexpected source

29 Replies

Recent Discussions

Reset cause

F5Access | MacOS Sonoma

Inquiry on F5's Maintenance Mode Feature for Pool Members

BIG-IP Next

GTM Design | LTM+ ASM+GTM on same VM

Related Content

Pool downtime query

iRule Processing query

Solving for true-source IP with global load balancers in Google Cloud

iRuleLX Solution for OAUTH JWT authenticated Salesforce Query

DNS: reply from unexpected source