Hello list.
My setup consists of two SER servers behind an F5 Big-IP for load balancing.
The servers are "pooled" behind a virtual server (i.e. they present a common
IP address to the rest of the world) created at the Big-IP and I'm using
call-id persistence.
My ser.cfgs are slightly modified mediaproxy examples from
onsip.org.
Each SER replicates to the other REGISTER messages, so that both servers are
the same.
So far so good.
Suppose that NATed UAC1 is registered at SER1 (SER1 is sending the 4 byte udp
packet every 60sec in order to keep its NAT binding open) and UAC2 sends him
an INVITE:
1) If the INVITE gets served by SER1 everything is OK.
2) If the INVITE gets served by SER2 then:
a) SER2 sends the message from port 5060,
b) but the packet arrives at UAC1 with source port 5061 (or 5062 or
whatever).
This means that for some reason the Big-IP changes the source port it receives
from SER2 to something other and, of course, the packet does not pass UAC1's
NAT binding.
So, the conclusion is that a UAC is only reachable through the SER that keeps
it's NAT binding open. In order to solve this problem (and until SER can
support path headers) I employed the method and the patch discussed at
http://lists.iptel.org/pipermail/serdev/2005-September/005814.html (thanx for
the patch Evan).
I have to admit that this system was my first experience with a Big-IP, so I'm
wondering:
Am I doing something wrong at the Big-IP?
Or is this Big-IP behavior (altering source ports received from internal
servers) typical to every (even commercial) load balancer?
Has anyone ever had success with any load balancer, multiple SERs and NATed
clients, especially F5s?
Regards,
George