Health Check when VIP and Node in different VLANS

This behaviour does indeed sound correct.

The F5 sends health monitor probes from its non-floating self IP on the egress VLAN (i.e. the VLAN on the F5 facing closest to the pool member). Since your pool members sit behind the firewall and not the F5, it will be sourcing the health probes from the front-side VLAN (i.e. Firewall-DMZ-30 - 192.168.30.5) and sending it to the upstream next hop which is the firewall (192.168.30.1). The firewall will then route the traffic to the nodes on Firewall-DMZ-10 - 192.168.10.x

Adding to Michael Saleem's comment. What is your default gateway? Do you have any routes configured for those pool members?

Thanks for the quick responses. We only have one default route static route to 192.168.30.1. There is a self IP in 192.168.10.x, so I think it should use the connected route 192.168.10.0/24 via the self IP?

Yes. I would expect the health check probes to be sent directly from the F5 self IP in the 192 .168.10.0/24 network if that’s the case (since it’s a directly connected network)

For client data traffic coming in via the firewall then then the F5 will send the response traffic from the servers back upstream to the firewall.

So client data traffic would not SNAT automap from the 192.168.10.x self IP and drop on that VLAN? It would come from the self IP 192.168.30.x self IP? Thanks.

Do you have a simple network diagram by any chance? It may help to give more accurate information and avoid confusion.

sorry for the delay had to throw something together.

Thanks for the diagram!

I would expect that the health monitor traffic from the F5 to the servers to be sourced from the VLAN 6 Self IP 192.168.10.5

I would also expect that for client traffic coming through to the virtual server with SNAT automap that the source IP also gets SNAT'd to the VLAN 6 Self IP 192.168.10.5

Thanks for the help. I figured it out. Actually should've taken a closer look. Apparently the VLANs are on the trunk/tagged port at all. They aren't even created on the F5! Turned out to be rather simple, just went about troubleshooting the long way. Have a good weekend..

Glad you figured it out in the end :)