Forum Discussion

Steve_Baker's avatar
Steve_Baker
Icon for Nimbostratus rankNimbostratus
Sep 30, 2021

iquery traffic between two interfaces on same LTM routes external to device

First, I'm not an F5 administrator, so I'm fumbling my way through this, but I'm willing to read anything you all point me to so that I can better understand.

 

I'm not uber familiar with our entire setup but here is what I know and would like to troubleshoot or better understand. We have a couple of LTM setups that during the last year will occasionally start sending massive amounts of traffic through our firewalls on port 4353 which I've learned is typically iquery traffic. The traffic is sent from one IP address listed in the Self IP List to another IP address listed in the Self IP List. If the device is rebooted the traffic no longer seems to be routed through the firewall till some random time usually weeks sometimes months later when something triggers it again.

 

Not knowing much of anything about how these devices are supposed to be setup or how they work, it seems to me that in other systems if you want to send traffic from one interface on a device to another interface on the same device that traffic can and will be routed locally on the device and not have to make a layer 3 hop through a firewall, even when the IP addresses are on different VLANs. When I say massive amounts of traffic I mean our ASA logs jump from an average of about 2 million syslog entries per hour to close to 20 million. It can add an extra 50GB per day of logs to the log server.

 

Is this type of behavior normal or expected?

No RepliesBe the first to reply