Bug ID 1041261: iRule sideband connection might use a local MAC address for a floating IP address

Last Modified: Jan 20, 2023

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
13.1.0,,,,,,,,, 13.1.1,,,,, 13.1.3,,,,,,, 13.1.4,, 13.1.5,, 14.1.0,,,,,, 14.1.2,,,,,,,,, 14.1.3,, 14.1.4,,,,,,, 14.1.5,,,, 15.1.0,,,,,, 15.1.1, 15.1.2,, 15.1.3,, 15.1.4,, 15.1.5,, 15.1.6,, 15.1.7, 15.1.8,, 16.1.0, 16.1.1, 16.1.2,,, 16.1.3,,,, 17.0.0,,

Opened: Aug 17, 2021
Severity: 4-Minor


When MAC masquerade is in use and sideband connection is generated with iRule (using 'connect' and 'send' commands) and floating self-ip is used as a source of the connection, the outgoing sideband packets are not using the masquerade MAC address.


Duplicate MAC warnings. Traffic might not be directed to a proper device.


iRule configured to create a sideband connection sourced specifically from a floating IP address.


- Instead of specifying a source address in an iRule, direct traffic to specially crafted virtual server: when CLIENT_ACCEPTED { set data "FOOBAR" #set conn_id [connect -protocol UDP -myaddr -myport 2137] set conn_id [connect -protocol UDP sideband_vs] <<<<<<----------- set send_bytes [send -timeout 1000 -status send_status $conn_id $data] log local0. "Sent $send_bytes with status $send_status" } } - On the virtual server, use SNAT pool with floating self-ip, note virtual-server is not enabled on any vlan: ltm virtual sideband_vs { destination ip-forward ip-protocol udp mask profiles { fastL4 { } } source source-address-translation { pool SPOOL type snat } vlans-enabled } ltm snatpool SPOOL{ members { } } - Make sure the virtual-address is configured for a desired floating traffic group: ltm virtual-address { address mask traffic-group traffic-group-1 } Traffic will use a MAC masquerade after getting SNATted: 00:4c:50:53:52:43 > 00:01:4c:4f:4f:50, > UDP, length 6 out slot1/tmm0 lis= 00:4c:50:53:52:43 > 00:01:4c:4f:4f:50, > UDP, length 6 in slot1/tmm0 lis=/Common/sideband_vs 02:23:e9:88:88:88 > 00:50:56:bd:6f:c2, > UDP, length 6 out slot1/tmm0 lis=/Common/sideband_vs

Fix Information


Behavior Change