In the 21st video of the F5 video series in CBT Nuggets, Keith Barker explains that the way to make the F5 "route" is by creating an IP Forwarding Virtual Server. This server would have the following settings:

Dst IP:
Service port: * (all)
Type: Forwarding (IP)
Protocol Profile: fastL4

My question is: Why does Keith Barker recommend doing this instead of simply creating a static default route on the F5 appliance pointing to the next hop? I have attempted to google this as well as look in devcentral and I can't seem to find the answer.


You're not alone, there is often confusion about the Forwarding Virtual Server, and what role it serves in an F5 LTM. Not having watched the video in question, I can only speculate on exactly what Keith Barker said/why he said it. However, knowing the high quality of his other training videos, I can assume that the following is what he was driving at.

Essentially, think of it this way:

  • All forwarding and policy decisions are made by the LTM services (Virtual Servers, SNAT, and NAT). These configurations act on the traffic at ingress.
  • Final routing decisions are made by the routing table of the device, once the LTM services are done with a particular piece of traffic. The routing table acts on the traffic at egress.

See this very helpful diagram of the traffic flow through an F5 LTM. You will notice that new traffic is matched against Virtual Servers, SNAT, and NAT for all actions.

Remember what the F5 LTM is for, it is a Load Balancer and is designed to explicitly proxy connections through it's Virtual Server constructs.

In order to have it simply pass traffic, you can configure a "Default" Forwarding Virtual Server that listens on all addresses and on all ports. This allows you to somewhat cheat the system, and have it transfer traffic through the device, but not to a pool of servers.

This is commonly used to allow traffic to flow from the servers behind the LTM, outbound to the world for patching, etc. In addition, if you wanted to do more than simply route that traffic (for example to apply any of the dozens of wonderful "knobs" that the LTM provides such as TCP fixup or an iRule), you could do that on a Forwarding Virtual Server.

You can certainly configure a standard static IP route with the following command in TMSH:

create net route <route destination/mask> gw <IP addres>

However, without LTM configuration of some sort (Virtual Server, Forwarding Virtual Server, SNAT, or NAT), the traffic would simply be dropped and never even reach the point of doing a route-lookup against the routing table. The F5 LTM is a Default Deny device, it will not forward traffic that you have not explicitly permitted/configured.

Finally, for more information on Forwarding Virtual Servers, read SOL7595 and for more information on Static Routing on the LTM, read SOL13833.

  • I have an F5 in prod right now that does not have any IP Forwarding virtual servers at all and it is passing traffic from internal subnets to its configured default gateway. It does, however, have SNAT configured on the device and the backend subnet is using a self-IP assigned on the F5 as the default gateway. Any idea why this is works without IP forwarding? – Michael May Aug 5 '15 at 13:55
  • I'll make it more clear in my answer, but I do reference several times that if there is a SNAT or NAT configured that it will forward that traffic. Did you ever wonder why those settings are under the LTM configuration and not the Network configuration? Same story as in my answer, they are part of the whole paradigm of how F5 handles traffic primarily via the LTM component, not the underlying OS routing table. – Brett Lykins Aug 5 '15 at 14:09
  • @ChristiandelaPeña See if that clarifies my answer any more for you. – Brett Lykins Aug 6 '15 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.