07 Deployment Methods
Before configuring anything, an architect decides how BIG-IP is inserted in the network. The deployment method determines whether you need SNAT, what the servers use as gateway, and which features are available. The three classic designs are one-arm, two-arm and nPath (DSR).
One-arm
- The VS and the pool members are on the same VLAN/subnet; BIG-IP uses a single interface for clients and servers.
- SNAT is required: otherwise servers reply directly to the client (bypassing BIG-IP) and the client drops the reply.
- Pros: simple to insert in an existing network, no changes to server gateways.
- Cons: servers don’t see the client IP (use X-Forwarded-For for HTTP); all traffic uses one link.
Two-arm
- The VS is on the external VLAN and the members on the internal VLAN — different networks.
- Return path options:
- Servers use BIG-IP’s floating self IP as default gateway (no SNAT needed; servers see the client IP), or
- Use SNAT if the servers keep another router as gateway.
- The most common enterprise design; BIG-IP sits inline like a router between client and server networks.
nPath (Direct Server Return, DSR)
- Requests go through BIG-IP; responses go directly from the server to the client.
- Benefits: increases outbound throughput and reduces the load on BIG-IP (it only sees half the traffic). Good for UDP/DNS, streaming, large downloads.
- Drawbacks: no Layer 7 inspection (BIG-IP never sees responses), no SNAT, no SSL offload, no compression, more complex server setup.
nPath configuration checklist
- VS type Performance (Layer 4) with a FastL4 profile that has Loose Initiation and Loose Close enabled (BIG-IP only sees half the TCP conversation).
- Disable Address Translation and Port Translation on the VS — the packet reaches the server with the VIP as destination.
- No SNAT.
- On each server: configure the VIP on a loopback interface and don’t answer ARP for it (otherwise the server steals the VIP).
- Monitors check the real server IP (the VIP lives on the loopback).
- Servers’ default gateway is a router, not BIG-IP.
Comparison
| One-arm | Two-arm | nPath | |
|---|---|---|---|
| VLANs | One | Two (external/internal) | Usually two |
| SNAT | Required | Optional | Not used |
| Server sees client IP | No (unless XFF) | Yes, if BIG-IP is gateway | Yes |
| L7 features | Yes | Yes | No |
| BIG-IP load | Full | Full | Half (requests only) |
Auto Last Hop
- Enabled by default. BIG-IP remembers the source MAC address and VLAN each connection arrived from and sends the replies back to that same hop — even if it has no route to the client’s network.
- Useful with several upstream routers or when clients come from networks BIG-IP has no routes for.
- Can be disabled globally, per VLAN, per SNAT/NAT and per virtual server.
Choosing the protocol profile per deployment
| Scenario | Profiles |
|---|---|
| Web app with load balancing, encrypted to/from the client | TCP + Client SSL |
| Web app manipulating HTTP content with iRules | TCP + HTTP |
| Web app used by cellular devices | Client side f5-tcp-mobile, server side tcp |
| DNS application | UDP |
| Telecom signaling (Diameter) | SCTP |
Self-check
Q1 — In a two-arm deployment, are the VS and the pool members on the same VLAN?
Respuesta
No. That describes one-arm. Two-arm uses separate client and server VLANs.
Q2 — VS and members are all in the same VLAN. What deployment is it, and what's mandatory?
Respuesta
One-arm, and SNAT is required.
Q3 — What are two benefits of nPath?
Respuesta
It reduces the load on BIG-IP and increases outbound throughput.
Q4 — Can Auto Last Hop be disabled?
Respuesta
Yes — globally, per VLAN, per SNAT/NAT or per virtual server.
Q5 — Why must nPath servers not answer ARP for the VIP?
Respuesta
Because they host the VIP on a loopback; if they answered ARP, clients and routers would send traffic straight to a server, bypassing BIG-IP.