Forum Discussion

ssam_189734's avatar
ssam_189734
Icon for Nimbostratus rankNimbostratus
Apr 20, 2015
Solved

Wild card virtual servers ?

Can anyone pls help me in understanding the wildcard virtual servers with an example ? when it is used ?  
application delivery
availability
BIG-IP Access Policy Manager (APM)
management
performance
security
  • Salim_83682's avatar
    Salim_83682
    Apr 20, 2015

    Wildcard VS are useful when the destination is unknown (any). I will give you two examples, but they are virtually unlimited depending on your use case.

     

    What if you have servers in your infrastructure that needs to connect to the Internet to download binaries using HTTP and your BIG-IP is their gateway ? Also, you need to load balance through 2 ISP with your BIG-IP when going to the Internet. To allow the traffic through, you could use a Wildcard VS 0.0.0.0:80, disable Address Translation and load balance through a pool of gateways (ISP).

     

    Another example could be, you are loadbalancing forward proxy caching device and you want to ensure that for the same destination, you use the same caching proxy (a pool member in this case) (so a.com requests are only cached on cache1 and not others to avoid cache duplicates). Clients requests various websites a.com, b.com etc... that resolves to various IP addresses 1.1.1.1, 2.2.2.2 ; to allow that traffic through you will need a 0.0.0.0:* VS in place and you may use a destination address persistence profile to achieve the requirement. Connection to 1.1.1.1 is allowed and loadbalanced to cache 1; you set a persistence record. Future requests to 1.1.1.1 will persist to cache 1.

     

    In the end, it's just an 'any' destination that needs processing in your BIG-IP.

     

Salim_83682's avatar
Salim_83682
Historic F5 Account

Wildcard VS are useful when the destination is unknown (any). I will give you two examples, but they are virtually unlimited depending on your use case.

 

What if you have servers in your infrastructure that needs to connect to the Internet to download binaries using HTTP and your BIG-IP is their gateway ? Also, you need to load balance through 2 ISP with your BIG-IP when going to the Internet. To allow the traffic through, you could use a Wildcard VS 0.0.0.0:80, disable Address Translation and load balance through a pool of gateways (ISP).

 

Another example could be, you are loadbalancing forward proxy caching device and you want to ensure that for the same destination, you use the same caching proxy (a pool member in this case) (so a.com requests are only cached on cache1 and not others to avoid cache duplicates). Clients requests various websites a.com, b.com etc... that resolves to various IP addresses 1.1.1.1, 2.2.2.2 ; to allow that traffic through you will need a 0.0.0.0:* VS in place and you may use a destination address persistence profile to achieve the requirement. Connection to 1.1.1.1 is allowed and loadbalanced to cache 1; you set a persistence record. Future requests to 1.1.1.1 will persist to cache 1.

 

In the end, it's just an 'any' destination that needs processing in your BIG-IP.

 

Salim_83682's avatar
Salim_83682
Historic F5 Account
Apr 21, 2015
Did not mean to add more confusion to this, but this could be a real scenario where you'd use wildcard VS. In this second example, you'd need Destination Address persistence profile to map a destination IP address to a Pool member. It has nothing to do with TLD. Here is a dummy example: Client tries http://www.f5.com . www.f5.com resolves to 5.6.7.8. Client opens a TCP connection to 5.6.7.8:80 and sends packet to LTM self/floating IP (it's default gateway). LTM handles the connection because it's configured with a 0.0.0.0:0 VS and the VS is configured with Address translation disabled and destination address persistence profile. LTM load balances to Caching server Pool -Pool member 1 (it 'forwards' the packet to Pool member 1 MAC Address but does not alter the destination IP address (which remains 5.6.7.8), this is why you need Address translation disabled, otherwise you'd send the packet TO the pool member and not THROUGH). A persistence record is created with : destination IP Address 5.6.7.8 and pool member 1. Subsequent connections through this wildcard VS to 5.6.7.8 will be sent through pool member 1. Hope that makes sense. Salim