F5 not routiing traffic through floating IP

Question

Server DFG is pointed to the flaoting IP on  was not able to access out the subnet , with in the same subnet it was reachable.
Configured virtual forwading IP vip. and also enabled fastl4 with loose initiation and loose close enabled.
For this vip we dont have SNAT enabled as src need to passed to backend server.&nbsp;
(192.168.x.x)user----FW-------F5(VIP)----Server
                                |
                     F5      &lt;----DFG 
  route on  F5 for 192.168.x.x  DFG FW
  When user is accessing the server directly   , requests comes into firewall and firewall passing it to the server , when server responding back  the traffic is going through F5.
From the captures on f5  I am able to see only syn,ack  for server to user and followed by a RST from src to the server.&nbsp;
Let me know if I need to add any routes on f5 .
Dont see the complete handshake                   &nbsp;

anesh · Answer

Use SNAT with a combination of a HTTP profile and select Insert X-Forwarded-For option it will insert client ip address into the header and hence your server can identify client-ip&nbsp;

dragonflymr · Answer

Hi,
I am not sure if I understand your traffic flow:
When user is accessing the server directly , requests comes into firewall and firewall passing it to the server , when server responding back the traffic is going through F5.
Do you mean that SYN packet from the user is going directly to the server and then SYN, ACK from the server is going not directly to user but via F5?
So it would be a bit different that flow you provided, from description it looks for me like that:
ACK packet: (192.168.x.x) user -&gt; FW -&gt; Server
SYN, ACK packet: Server -&gt; F5(VIP) -&gt; FW -&gt; (192.168.x.x) user
What is the reason for asymmetric routing here? Why not send all traffic via F5?
If this is the case, then tcpdump on F5 is showing correct results.
For such flow SNAT would not change client IP because F5 is processing only traffic returning from server not traffic coming from client to server.
If you say followed by a RST from src to the server what do you mean by src - IP of the client that originally send ACK packet? 
If so then for some reason client is not accepting SYN, ACK from server - best way is to capture traffic on the client to see why. That will as well prove who is sending RST - client or F5 or maybe FW? For flow like that there is change in MAC address that could cause FW to drop packet:
ACK packet will have src MAC: FW NIC, dst MAC server NIC
SYN, ACK packet (when received by FW) will have: src MAC F5 interface (instead of server NIC), dst MAC FW NIC
Could be that your VS config is wrong, as already mentioned could you post VS config: tmsh list ltm virtual  
Could you post your fastL4 profile listing tmsh list ltm profile fastl4 
Piotr

sandiksk_35282 · Answer

SYN packet from the user is going directly to the server and then SYN, ACK from the server is going not directly to user but via F5. This is what we are observing on the captures from f5.&nbsp;
If i need to fix this issue how can i do this.&nbsp;

sandiksk_35282 · Answer

For such flow SNAT would not change client IP because F5 is processing only traffic returning from server not traffic coming from client to server.&nbsp;
The above flow applies when user tried to access the server directly .But when they access the vip , request is coming into the F5  and from pool we never see any response back to the client .
For request processing on f5 if i use SNAT , client IP will not be passed to the server .&nbsp;

dragonflymr · Answer

Hard to say, depending what is your target solution.&nbsp;
If you would like to have client ACK and server SYN, ACK to be passed via F5 then you need to modify configuration of your FW.&nbsp;
As far as I understand it's FW that is sending client ACK directly to server. Instead of this it should send it to external Self IP of your F5 (one via which F5 can reach FW - if your VS is ForwardingIP type) or to VS IP (if your VS is PerformanceL4 type - in this case you will have to change Destination IP of VS to be in the same subnet as FW). Then all traffic between client and server will be processed by F5.&nbsp;
So flow should be like that:&nbsp;
ACK: client -&gt; FW -&gt; F5 192.168.x.x Self IP -&gt; server&nbsp;
SYN, ACK: server -&gt; F5 self IP in subnet used by server -&gt; FW -&gt; client - this one is already working&nbsp;
Of course for that to work your VS has to be configured to be enabled on F5 VLAN via which F5 is accessing FW.&nbsp;
For such configuration you don't need Loose Initiation/Close and you can as well use Standard type VS with Pool containing your SMTP server.&nbsp;
Or you can keep using current fastL4 VS (don't know if it's PerformanceL4 or Forwarding type).&nbsp;
Piotr&nbsp;

Forum Discussion

F5 not routiing traffic through floating IP

6 Replies

Recent Discussions

F5Access | MacOS Sonoma

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Enabling AVR and creating Profiles

Get associated pool name from VIP IP using F5-LTM

Disacard SSL::cert mode to ignore when default SSLClient profile is set to request or require

Related Content

Floating IPs on new traffic group members

fellow traffic

Block traffic

Can a floating IP be the next hop for routing?

Traffic Intelligence in AFM through Categories