sol6459:Order of precedence for virtual server matching (9.x - 11.2.1)
This article applies to BIG-IP 9.x through 11.2.1. For information about other versions, refer to the following article:
When determining the order of precedence applied to new inbound connections, the BIG-IP system uses an algorithm that places a higher precedence on the address netmask and a lesser emphasis on the port. BIG-IP LTM sets virtual server precedence according to the following criteria:
- The first precedent of the algorithm chooses the virtual server that has the longest subnet match for the incoming connection.
- If the number of bits in the subnet mask match, the algorithm chooses the virtual server that has a port match.
- If no port match is found, the algorithm uses the wildcard server (if a wildcard virtual server is defined).
-
A wildcard address has a netmask length of zero; thus, it has a lower precedence than any matching virtual server with a defined address.
This algorithm results in the following order of precedence:
:
:*
*:
*:*
Example of VIP precedence behavior
For example, for a BIG-IP system with the following VIPs configured on the inbound VLAN:
10.0.0.0/8:80
10.10.0.0/16:80
10.10.10.10/32:80
20.0.0.0/8:*
20.0.0.0/8:80
*:80 (alternatively noted as 0.0.0.0/0:80)
*:* (alternatively noted as any:any, 0.0.0.0/0:any)
The following table illustrates how inbound destination addresses map to the configured VIPs:
| Inbound destination address | VIP |
| 10.10.10.10:80 | 10.10.10.10/32:80 - address match and port match |
| 10.10.10.11:80 | 10.10.0.0/16:80 - most specific address match and port match |
| 10.1.10.10:80 | 10.0.0.0/8:80 - most specific address match and port match |
| 20.0.0.0:80 | 20.0.0.0/8:80 - most specific address match and port match |
| 20.0.0.0:443 | 20.0.0.0/8:* - most specific address match with wildcard port |
| 1.1.1.1:443 | *:* - wildcard address and wildcard port |
- Beginning with BIG-IP LTM 9.4.0, the bigpipe db TM.ContinueMatching variable is set to false, which negates the precedence order and causes BIG-IP LTM to reject the packet if the requested virtual server is unavailable. For more information, refer to SOL8009: Overview of the 'TM.ContinueMatching' db variable.
来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/10543606/viewspace-1066070/ ，如需转载，请注明出处，否则将追究法律责任。
