No response after added virtual server IP address as floating self-IP address

Question

Hi,&nbsp;
I have an F5 HA pair that serves several virtual servers.&nbsp;
VS1: ip1&nbsp;
VS2: ip2&nbsp;
Now, the IP address of VS1 (ip1) was already defined as a floating self-IP, but I found out that the IP address of VS2 was not defined as a self-IP. So I added ip2 as a floating self-IP. &nbsp;
From that moment on, no traffic was accepted on either ip1 or ip2.&nbsp;
Moreover, when I add a floating self-IP (let's say ip3), the virtual servers stop accepting traffic.&nbsp;
Any idea what can be causing this?
Is it necessary to define the IP address of a virtual servers as a floating self-IP? Are there benefits of doing that?&nbsp;
On other units I manage, I always first add the floating self-IP and then I add the virtual server on that IP address.&nbsp;
I'm running version "BIG-IP 11.6.0 Build 0.0.401 Final"&nbsp;
Thanks.&nbsp;

mreco_159588 · Accepted Answer

It was driving me nuts, since I just want to understand what's going.&nbsp;
After reading this post: https://devcentral.f5.com/questions/self-ip-address-selection-with-multiple-to-choose-from, I checked the firewall logs again. And now the pieces fit.&nbsp;
On the Virtual Servers I have SNAT Automap enabled. When I only have one floating self IP, that floating self IP is used to initiate traffic to backend servers. When I add more floating self IPs, it will use any of those floating self IPs to initiate traffic towards the backend servers.&nbsp;
The firewall between the F5 and the backend servers does not accept this traffic, meaning not actually the VS stopped responding after I added the VS IP address as a floating self IP, but the firewall blocked traffic towards the backend servers. &nbsp;
So, conclusion (just to summarize):&nbsp;
only one floating self IP is needed for SNAT communication towards the backend servers (if the amount of connections is less than 65000, otherwise more are needed and I must define a SNAT pool or allow the other floating IP addresses to communicate to the backend servers)I will remove the unneeded floating self IP, since they're not needed for a VS to function as a listener IP
Thanks all for your help!&nbsp;

dragonflymr · Answer

Hi,&nbsp;
There is no need to add floating IP equal to VS IP. It is rather other way around.&nbsp;
You can use floating IP as your VS IP to save IPs - let's say you have only two free IPs in given subnet - one for self IP, one for floating IP.&nbsp;
But you need VS to configure - solution is to use same IP as floating IP.&nbsp;
If you use Floating IP as VS IP you need to modify Floating IP Port Lockdown setting. As incoming traffic is matching Floating IP first then this setting is evaluated (most often it's set to None or Default) and if there is no port/protocol match traffic is rejected.&nbsp;
So if you have VS at port 80 you need to add TCP port 80 to the Port Lockdown List (probably using Allow Custom).&nbsp;
Piotr&nbsp;

marin_266716 · Answer

Im confused, you said floating IP but you also said VS, are you adding a floating IP and thinking it will be the VIP for a pool?&nbsp;
VS1 = VIP1 (Application 1)
VS2 = VIP2 (Application 2)&nbsp;
Self IP = IP in segment used to to reach into segments for monitoring or other purposes. &nbsp;
A Self IP is just that, in an HA cluster you could have 2-3 IP's per VLAN. 2x would be 1 Self IP (Non-Floating) per device in your HA group. The 3rd IP would be the floating IP added to the Active node and synced across to the standby. Floating IP's sync, self IP's do not. The Floating IP can be used as a default gateway for instance since it will always follow the active member. &nbsp;
What are you trying to accomplish with said "Self/Floating IP"&nbsp;

mreco_159588 · Answer

I'm also confused ;-)&nbsp;
I have several virtual servers that use IP addresses that are not defined as self-IP or floating-IP.&nbsp;
Each unit of the HA pair has a non-floating IP address and they both share one floating-IP address in the same VLAN.&nbsp;
The IP addresses of the virtual servers are in the same VLAn as the non-floating and floating IP addresses.&nbsp;
Now, when I add the IP address used by a virtual servers as a floating IP address, the virtual server stops responding, even after setting port lockdown to 'Allow All'.&nbsp;
What I'm trying to accomplish is the following:
I thought it was weird that the unit has a virtual server running on an IP that is not defined as a floating IP.
On other units I manage I usually first add an IP address as a floating IP and then use that IP address for a virtual server.
So, to align the setup with other units I manage, I added the IP address of the virtual server as a floating IP. 
But then things stopped working...&nbsp;

mreco_159588 · Answer

I understand the difference between floating and non-floating IP addresses, but I don't understand that a virtual server can be hosted on an IP address that is not defined as a floating IP address.&nbsp;

marin_266716 · Answer

"I thought it was weird that the unit has a virtual server running on an IP that is not defined as a floating IP."&nbsp;
I dont have a single IP that is used as a VS also used as a Self-IP or Floating IP on either Active or Standby unit. &nbsp;
Well say for instance 192.168.10.0/24 is VLAN 10&nbsp;
Self IP Node1 = 192.168.10.2&nbsp;
Self IP Node2 = 192.168.10.3&nbsp;
Floating IP = 192.168.10.1&nbsp;&nbsp;
VS1 = 192.168.10.101&nbsp;
VS2 = 192.168.10.102&nbsp;
VS3 = 192.168.10.103&nbsp;&nbsp;
And so on.... &nbsp;
To add one more example on the same cluster.&nbsp;
Well say for instance 192.168.20.0/24 is VLAN 20&nbsp;
Self IP Node1 = 192.168.20.2&nbsp;
Self IP Node2 = 192.168.20.3&nbsp;
Floating IP = 192.168.20.1&nbsp;&nbsp;
VS4 = 192.168.20.101&nbsp;
VS5 = 192.168.20.102&nbsp;
VS6 = 192.168.20.103&nbsp;&nbsp;
A total of 6 VS's on 2 different networks serviced by the same cluster without using a VS IP as a self and/or floating IP.&nbsp;

Forum Discussion

No response after added virtual server IP address as floating self-IP address

12 Replies

Recent Discussions

Errors in setup of BIGIP-NEXT CM VE on KVM

CWE-20: Improper Input Validation

F5Access | MacOS Sonoma

Using Terraform to update / modify an existing iRule

monitor a pool that consists of Linux Squid Servers

Related Content

Introduction of Incident Response

Integrating SSL Orchestrator with Fortinet FortiGate Virtual Edition as a Virtual Wire

FIX Message Response

Can a floating IP be the next hop for routing?

Virtual Server graphical App for F5 LTM