Typically, we always use SNAT in our environment. I have a scenario now where I need to retain source IPs from clients thus disabling SNAT. Here is what I have configured thus far: 1) Created a new VS with a type of "Forwarding IP," a destination network of 0.0.0.0, and a mask of 0.0.0.0. The VS is bound to all ports. It also has a fastL4 profile assigned to it, and is bound to all VLANs and all protocols. 2) Defined a default route on the BIG-IP to a gateway that can reach all of our internal applicable networks. 3) Configured the server's default gateway as the floating self-IP on the corresponding VLAN. From the server, I can reach all external networks. However, I can not access the server FROM a remote network. I can however ping it, but all TCP connections fail (SSH, etc). What configuration am I missing here? My goal is to be able to access the server (which has the LTM defined as it's gateway) from any network via it's assigned IP address and not a VS. Is this possible? Thanks for any help!

Does a traceroute suggest it passes through the F5? Also, have you disabled port and address translation on the VS?

do the upstream routers know that traffic for the servers needs to be sent to the BIG-IP?

Jason, I'm assuming so since I can ping the host. I verified the ping is actually making it to the host by running tcpdump on it. Josh

icmp can be relayed by other gateways. Do you see the tcp request in a tcpdump on the BIG-IP or just the return traffic?

When I try to SSH from an "off-net" host, from the BIG-IP: tcpdump -i 0.0 -s0 host 172.21.101.71 (this is the IP of the off-net client/host = FC-RODNS01) 15:59:51.130145 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568921727 ecr 0,nop,wscale 7], length 0 15:59:52.129598 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568922727 ecr 0,nop,wscale 7], length 0 ... So, the BIG-IP is seeing the request. At the same time, I have a tcpdump running on the client (172.21.101.71/fc-rodns01): $ tcpdump host 172.26.100.223 (the IP of the server behind the BIG-IP = buildel564): 15:59:51.130145 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568921727 ecr 0,nop,wscale 7], length 0 15:59:52.129598 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568922727 ecr 0,nop,wscale 7], length 0 ... So, the off-net client seems to be ACKing requests from the server behind the F5. But, I'm not seeing anything else. Thanks, Josh

Routed VS SNAT Deployment

18 Replies

What_Lies_Bene1
Cirrostratus
Sep 05, 2013
Does a traceroute suggest it passes through the F5? Also, have you disabled port and address translation on the VS?
JRahm
Admin
Sep 05, 2013
do the upstream routers know that traffic for the servers needs to be sent to the BIG-IP?
Josh_41258
Nimbostratus
Sep 05, 2013
Jason,

I'm assuming so since I can ping the host. I verified the ping is actually making it to the host by running tcpdump on it.

Josh
JRahm
Admin
Sep 05, 2013
icmp can be relayed by other gateways. Do you see the tcp request in a tcpdump on the BIG-IP or just the return traffic?
Josh_41258
Nimbostratus
Sep 05, 2013
When I try to SSH from an "off-net" host, from the BIG-IP:

tcpdump -i 0.0 -s0 host 172.21.101.71 (this is the IP of the off-net client/host = FC-RODNS01)
15:59:51.130145 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568921727 ecr 0,nop,wscale 7], length 0 15:59:52.129598 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568922727 ecr 0,nop,wscale 7], length 0 ...

So, the BIG-IP is seeing the request.

At the same time, I have a tcpdump running on the client (172.21.101.71/fc-rodns01):

$ tcpdump host 172.26.100.223 (the IP of the server behind the BIG-IP = buildel564):

15:59:51.130145 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568921727 ecr 0,nop,wscale 7], length 0 15:59:52.129598 IP fc-rodns01.corp.domain.com.57417 > buildel564.corp.domain.com.ssh: Flags [S], seq 2672739120, win 14600, options [mss 1460,sackOK,TS val 3568922727 ecr 0,nop,wscale 7], length 0 ...

So, the off-net client seems to be ACKing requests from the server behind the F5. But, I'm not seeing anything else.

Thanks,

Josh
JRahm
Admin
Sep 06, 2013
so two syn packets to the front side, but we don't see any syn packets leaving the BIG-IP for the server (should see them with -i 0.0), so either there is not a route to the server, the vlan the traffic is arriving on is not enabled on the virtual server, or the traffic is still being snatted somehow (more specific match maybe) and evaded capture here.
Josh_41258
Nimbostratus
Sep 06, 2013
Are you saying that the VLAN is not enabled on the FORWARDING VS? All VLANs are currently enabled on that VS. No SNAT is enabled, either. Guess I need to take a second look at routing. Although, I'm not really sure how to fix that.
boneyard
MVP
Sep 06, 2013
why the second capture on the client?, the first already shows the big-ip recieves the SYN. a capture on the server would be more interesting. but as Jason says seeing how nothing leaves the big-ip probably something fails there.

also tcpdump with -nn stops resolving hostnames and ports, usually easier on the eyes.

as for the possible routing issue, how is the network behind the big-ip (where the server is located) setup? is it directly connected or behind a router?
What_Lies_Bene1
Cirrostratus
Sep 06, 2013
Have you checked the server has a route back to the network you are coming from that goes via the F5? Is the server on a VLAN hosted on the F5? If not, does the F5 have a route to the server network? Is auto last hop enabled?

Oh, and use the Basic/Advanced dropdown to see all your settings.
Josh_41258
Nimbostratus
Sep 06, 2013
@boneyard - You are correct.. I should have captured from the server, not the client.

The network that the server resides on is not directly connected to the BIG-IP. It is behind a router. This network is trunked to the BIG-IP via a VLAN. Auto Last Hop was set to "Default," but I have since set it to "Enabled." Even with advanced settings view, the options for translation do not appear on the Forwarding VS.

Since the network where the server resides is not directly connected to the BIG-IP, it sounds like I may need a static route for the server on the upstream router to point to the floating self-IP of the VLAN? Does this sound correct?

Josh