Forum Discussion

Natalia_Wolosec's avatar
Natalia_Wolosec
Icon for Nimbostratus rankNimbostratus
Aug 31, 2011

Virtual Server Redirection Issue

Hi All,

 

 

I'm having some abnormailities with a virtual server and a redirection pool.

 

 

In total I have 3 seperate DMZ vlans.

 

 

Vlan 1 is used for the IP addresses of the virtual server

 

 

Vlan 2 is used for pool1

 

Vlan 3 is used for pool2

 

 

At the moment I have one virtual server which the default pool is pool1 which is working perfectly.

 

 

I've added an irule which has a redirection, that if it sees the string new in the uri path it redirects to pool2.

 

 

I can see that the irule is working as the statistics for the pool2 is incrementing when a connection attempt is made, however this does not communicate correctly to the server.

 

 

I'm able to see from the firewall that there are denied packets going from pool2 server back to the floating ip address of vlan 2 (pool1) which is confusing.

 

 

I would have expected that the load balancer would attempt to make the connection to pool2 using the self ip address assigned to vlan 3 so the response would not be blocked coming back.

 

 

Is anyone aware of how the load balancers behaviour is when making a connection to a pool? Should it be using the self ip address assigned to vlan3 which pool2 is hosted?

 

 

Sorry if this is confusing, however the health monitors show the pool to be up and the nodes within up also.

 

 

Thanks,

 

 

 

5 Replies

  • have u defined floating selfip on every vlan?

     

     

    sol7336: The SNAT Automap feature may use an unintended self IP address

     

    http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7336.html
  • Yes floating IP address for the new vlan has been configured.

     

     

    The server itself cannot ping the load balancer which they are both in the same subnet? Do I need to allow this to be openned on the F5?
  • The server itself cannot ping the load balancer which they are both in the same subnet? Do I need to allow this to be openned on the F5?

     

    selfip should be pingable. is network connectivity correct e.g. vlan, interface, cable?
  • Yes all is correct, however do I need to setup packet filtering to allow it to be pingable?
  • packet filter is not needed to make selfip pingable.

     

     

    by the way, if u run tcpdump on bigip, have u seen icmp packet hitting bigip?

     

    e.g.

     

    tcpdump -nni 0.0 host x.x.x.x and icmp

     

    x.x.x.x is client ip