Two Divisions, One Subnet: Route Domain Design
Acme merges with two divisions that both use 10.20.0.0/24. The BIG-IP runs a single route domain 0. An engineer creates VLAN bu1 with self IP 10.20.0.10/24 and VLAN bu2 with self IP 10.20.0.11/24, then adds a virtual server 10.20.0.100:443 for the first division. After the second self IP is added, ARP entries for 10.20.0.10 intermittently point out of bu2, and hosts in division 2 sometimes reach division 1's virtual server. The upstream router has one default route to 10.20.0.1 on bu1. Each division needs its own default gateway and its own pool members using the same 10.20.0.0/24 space. No NAT between divisions is allowed.
1. Why does adding the second self IP cause intermittent cross-division traffic, even though the VLANs are physically separate?
Read the worked answer
Why it breaks
Route domain 0 is a single IP routing and ARP domain. Two VLANs carrying the same 10.20.0.0/24 prefix do not create two independent networks. The BIG-IP has one connected route for that prefix and must choose an egress VLAN for every 10.20.0.x destination, so ARP resolution and return traffic can use either VLAN.
The second self IP did not separate the divisions; it added a second address in the same IP space. The BIG-IP can therefore answer ARP or forward traffic for division 1 out of bu2 and vice versa. The upstream router's single default route makes it worse: traffic for both divisions arrives on bu1, and replies may leave on bu2.
A static route will not fix this because the prefix is directly connected in the same route domain. The correct fix is to separate the IP spaces with route domains, not to add more routes in route domain 0.
2. Design the route domain solution. State what must be assigned to which object, including default routes, virtual servers, pools, and SNAT.
Read the worked answer
Target design
- Create route domain 1 for bu1 and route domain 2 for bu2, each with a unique ID. Leave route domain 0 for management and shared services only.
- Assign VLAN bu1 to route domain 1 and VLAN bu2 to route domain 2. The VLAN assignment determines the route domain for untagged traffic arriving on that VLAN.
- Create self IPs as 10.20.0.10%1 and 10.20.0.11%2. Each route domain gets its own default route: in RD 1, default via 10.20.0.1%1; in RD 2, default via the division 2 gateway, for example 10.20.0.2%2.
- Create the virtual server as 10.20.0.100%1:443. Pool members for division 2 are 10.20.0.x%2. A pool member's route domain controls how the BIG-IP reaches it and which monitor instance applies.
- If SNAT automap is used, it selects a self IP in the same route domain as the egress path. Verify that each route domain has a suitable self IP, or use an explicit SNAT pool in the correct route domain.
Do not put a default route for either division into route domain 0. That would reintroduce ambiguity.
3. What should be verified after the change, and what symptom would show that the design is still wrong?
Read the worked answer
Verification checklist
tmsh list net route domainshows both domains, andtmsh list net routeshows one default route per route domain with the correct %ID.tmsh list net vlanshows bu1 in RD 1 and bu2 in RD 2.- Self IPs, virtual servers, pool members, and SNAT addresses all carry the expected %ID. A missing %ID silently places the object in route domain 0.
- Monitors are inherited from the pool member's route domain. Confirm a member in RD 2 is monitored through RD 2, not through a route in RD 0.
- Test from each division: a client should reach only its own virtual server, and the source address seen by the server should match the designed SNAT behavior.
A remaining symptom is asymmetric or intermittent connectivity: division 2 users reach the correct VIP but replies leave through bu1, or ARP for a gateway resolves on the wrong VLAN. That means an object is still in RD 0 or a default route is still present in the shared domain. Also check that the upstream router has a return route for any SNAT address used in each route domain.