Saturday, 21 December 2019

F5 Oneconnect profile

F5 : ONECONNECT MASK
=============================
Eligibility for Reuse
=============================
When new connection is initiated to the Virtual Server, F5 performs SNAT on the source IP address and then applies OneConnect source mask to SNAT IP to determine if connection is eligible for reuse.
=============================
OneConnect Mask
=============================
OneConnect Mask is applied to SNAT IP address to determine if any TCP connection is eligible for reuse.
Mask can be 255.255.255.255, 255.255.255.0, 255.255.0.0, 255.0.0.0, 0.0.0.0
=============================
Example : Mask Applied 255.255.255.0
=============================
Client A with Source IP 10.10.10.10 establish connection to Virtual Server
=============================
Client B with Source IP 10.10.10.20 connects to the same Virtual Server
=============================
F5 applies OneConnect Mask to the Server side flow and finds eligible idle TCP connection
=============================
F5 aggregates this request from Client B over the already existing TCP connection for Client A
=============================
Client C with Source IP 10.10.20.20 connects to the same Virtual Server 
=============================
F5 applies OneConnect Mask to the Server side flow and finds no eligible idle TCP connection
=============================
F5 creates new TCP connection for Client C

No comments:

Post a Comment

🔥 The Hidden Risk of “Wide Open” Internal Policies — And How To Remove Them Safely

In one of my recent projects, I noticed a wide open internal traffic policy in place. Later, I was asked to work on this issue and remove th...