sol6459:Order of precedence for virtual server matching (9.x - 11.2.1)

This article applies to BIG-IP 9.x through 11.2.1. For information about other versions, refer to the following article:

When determining the order of precedence applied to new inbound connections, the BIG-IP system uses an algorithm that places a higher precedence on the address netmask and a lesser emphasis on the port. BIG-IP LTM sets virtual server precedence according to the following criteria:

• The first precedent of the algorithm chooses the virtual server that has the longest subnet match for the incoming connection.
• If the number of bits in the subnet mask match, the algorithm chooses the virtual server that has a port match.
• If no port match is found, the algorithm uses the wildcard server (if a wildcard virtual server is defined).
• A wildcard address has a netmask length of zero; thus, it has a lower precedence than any matching virtual server with a defined address.
  

This algorithm results in the following order of precedence:

:

:*
:
:*
*:
*:*

Example of VIP precedence behavior

For example, for a BIG-IP system with the following VIPs configured on the inbound VLAN:

10.0.0.0/8:80
10.10.0.0/16:80
10.10.10.10/32:80
20.0.0.0/8:*
20.0.0.0/8:80
*:80 (alternatively noted as 0.0.0.0/0:80)
*:* (alternatively noted as any:any, 0.0.0.0/0:any)

The following table illustrates how inbound destination addresses map to the configured VIPs:

Inbound destination address	VIP
10.10.10.10:80	10.10.10.10/32:80 - address match and port match
10.10.10.11:80	10.10.0.0/16:80 - most specific address match and port match
10.1.10.10:80	10.0.0.0/8:80 - most specific address match and port match
20.0.0.0:80	20.0.0.0/8:80 - most specific address match and port match
20.0.0.0:443	20.0.0.0/8:* - most specific address match with wildcard port
1.1.1.1:443	*:* - wildcard address and wildcard port

Supplemental Information

• Beginning with BIG-IP LTM 9.4.0, the bigpipe db TM.ContinueMatching variable is set to false, which negates the precedence order and causes BIG-IP LTM to reject the packet if the requested virtual server is unavailable. For more information, refer to .