F5 - Source IP

[Dominique Petitpierre]

On 01/22/2017 02:44 AM, Lionel Samuel wrote:

> Has anyone implement F5 where there is load balancing to multiple nodes of SPs?
>
> Were there any challenges in ensuring that the client source IP was transmitted to the SP?

For the IdP we use a F5 BIG-IP LTM Virtual Server of type "Performance (Layer 4)". The F5 BIG-IP works at the level of TCP and preserves the source address (no SSL termination, no need for X-Forwarded-For header).
An exception is for clients on the same subnet as the server side servers, where a different source address has to be mapped with an iRule to avoid asymmetric routing.
We use also a stateless source address persistence profile based on the CARP hash algorithm.
It seems to me that such a setting would also be applicable for a SP.

Regards,

Mr Dominique Petitpierre, user=Dominique.Petitpierre domain=unige.ch
IT Division, University of Geneva, Switzerland