F5 wildcard outgoing with default gateway pool issue

Hello Angus,

First of can you tell me if you set snat automap or snat pool on your VS? Additional I recommend you to set transparent monitor in order to validate that your ISP is functional (it has internet access).

Regards,

Please can you share the configuration: VS, pools etc? It is a bit odd that it only selects one ISP in your pool. Is there any irule in place?

I set a wildcard VS with source 0.0.0.0 and dest 0.0.0.0, the pool is a gateway pool with 2 ISP link gateway (Round robin load balance). No any irule applied.

I keep ping the public IP and then unplug of the ISP link, the ping result will become destination host unreachable until one re-plug the ISP which I unplugged.

Can you send the output of tmsh list ltm pool you_pool and tmsh list ltm virtual your_virtual?

ltm virtual vs_wildcard { destination 0.0.0.0:any mask any pool GW_Pool_Round profiles { fastL4 { } } source 0.0.0.0/0 source-address-translation { type automap } translate-address disabled translate-port disabled vlans { Internal } vlans-enabled vs-index 26 }

ltm pool GW_Pool_Round { members { 203.193.x.x:any { address 203.193.x.x session monitor-enabled state up } 218.213.x.x:any { address 218.213.x.x session monitor-enabled state up } } monitor gateway_icmp }

Thanks Daniel!

To be honest I don't see where the problem can be. I'd recommend you to open a support case. In addition you can add an irule to log information about the load balance decissions, active members, etc:

when LB_SELECTED {
  log local.0 "Active members: [active_members [LB::server pool]]"
  log local.0 "Pool member: [LB::server addr]:[LB::server port]"
}

A packet capture will help to see what is happening underneath, destination mac address, etc.

Sorry to not be of more help.

Hi

In your case, It seems that ISP bgp setting seems to wrong.

but If ping dst IP is belong to just one ISP, dst unreachable is expected result.

First, ping to google(belong to lots of ISP), unplug one ISP, stop ping and retry ping.

Second, check ISP`s bgp hold time. -> normally long as you expected.

thank you.