It is best practice to enable the Subnet Originating Requests option globally.

In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet) Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup.

In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B, Subnet Originating Requests should be enabled.

Because this application can run at Layer 4, transparency is enforced. Transparency takes a higher priority than Subnet Originating Requests. Therefore, if transparency is enabled on the Virtual Service and Subnet Originating Requests is enabled globally, the Virtual Service still uses transparency. The Real Server sees traffic from this virtual service originating with the client’s source IP address (transparency).

The following table provides further details about what IP address the Real Server sees production traffic from based on the configuration:

Transparency Subnet Originating Requests SSL Offloading SSL Reencryption Is the Real Server local? Real Server sees production traffic from
Disabled Disabled Disabled Disabled Yes Virtual Service address
Disabled Enabled Disabled Disabled Yes Service-side interface
Enabled Disabled Disabled Disabled Yes Client's IP address
Enabled Enabled Disabled Disabled Yes Client's IP address

Refer to Appendix A of the Routing Feature Description for more details.

In the diagram above, you can see the following details:

  • Client: 10.0.0.100/24
  • Virtual Service on eth0: 10.0.0.15/24
  • Real Server on eth1: 10.20.20.25/24

With Subnet Originating Requests enabled, the Real Server sees traffic originating from 10.20.20.21 (Connection Manager eth1 address) and responds correctly.

With Subnet Originating Requests disabled, the Real Server sees traffic originating from 10.0.0.15 (Connection Manager Virtual Service address on eth0) and responds to eth0 causing asymmetric routing.

When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can choose whether or not to enable Subnet Originating Requests on a per-Virtual Service basis.

To enable Subnet Originating Requests globally, follow the steps below:

  1. In the main menu of the Connection Manager Web User Interface (WUI), go to System Configuration > Miscellaneous Options > Network Options.
  2. Select the Subnet Originating Requests check box.