Forum Discussion

benmgood36's avatar
benmgood36
Icon for Nimbostratus rankNimbostratus
Dec 09, 2015

Source port being changed when nothing else appears to be using the port

I've got some devices (Infoblox DNS) which use OpenVPN UDP port 1194 to communicate. The devices expect the source and destination port to be 1194. On the devices that are behind my F5 10200v devices, every so often the VPN terminates and logs that the source port was different than 1194.

 

The traffic is routed through the F5 and I have a IP forwarding virtual server for UDP with a fastL4 profile set for idle timeout of 5 seconds, and loose initiate/loose close enabled. Source Port is set to Preseve, not Preserve Strict.

 

What I'm unclear about is why the port is getting changed in the first place. This occurred 8 times overnight, and in none of those instances was anything else communicating from or to UDP port 1194 at the same time (I've got a packet capture). This is a system that averages between 200,000 and 500,000 concurrent connections, but almost everything is TCP. TCP port 1194 is going to show up a lot as the source port for other routed traffic, but not between these Infoblox devices.

 

What I'd considered doing was creating a port 1194 IP forwarding virtual server and setting it to Preserve Strict. The documentation says if a collision occurs, it resets the client side connection. While that makes sense for TCP, I'm not really sure what it would do with a UDP connection.

 

Has anyone seen this behavior before?

 

4 Replies

    • benmgood36's avatar
      benmgood36
      Icon for Nimbostratus rankNimbostratus
      After reading this, I suppose I should have a stateless VS for 0.0.0.0/0 for UDP instead of IP forwarding. I followed the guidelines in https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html and set up a forwarding VS for TCP, UDP, and non-TCP/UDP with their own fastL4 profiles.
    • benmgood36's avatar
      benmgood36
      Icon for Nimbostratus rankNimbostratus
      After reading this, I suppose I should have a stateless VS for 0.0.0.0/0 for UDP instead of IP forwarding. I followed the guidelines in https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html and set up a forwarding VS for TCP, UDP, and non-TCP/UDP with their own fastL4 profiles.