Hello list. My setup consists of two SER servers behind an F5 Big-IP for load balancing. The servers are "pooled" behind a virtual server (i.e. they present a common IP address to the rest of the world) created at the Big-IP and I'm using call-id persistence. My ser.cfgs are slightly modified mediaproxy examples from onsip.org. Each SER replicates to the other REGISTER messages, so that both servers are the same. So far so good.
Suppose that NATed UAC1 is registered at SER1 (SER1 is sending the 4 byte udp packet every 60sec in order to keep its NAT binding open) and UAC2 sends him an INVITE:
1) If the INVITE gets served by SER1 everything is OK. 2) If the INVITE gets served by SER2 then: a) SER2 sends the message from port 5060, b) but the packet arrives at UAC1 with source port 5061 (or 5062 or whatever).
This means that for some reason the Big-IP changes the source port it receives from SER2 to something other and, of course, the packet does not pass UAC1's NAT binding.
So, the conclusion is that a UAC is only reachable through the SER that keeps it's NAT binding open. In order to solve this problem (and until SER can support path headers) I employed the method and the patch discussed at http://lists.iptel.org/pipermail/serdev/2005-September/005814.html (thanx for the patch Evan).
I have to admit that this system was my first experience with a Big-IP, so I'm wondering: Am I doing something wrong at the Big-IP? Or is this Big-IP behavior (altering source ports received from internal servers) typical to every (even commercial) load balancer? Has anyone ever had success with any load balancer, multiple SERs and NATed clients, especially F5s?
Regards, George