# Create functional wildcard port VIP? **URL:** \ **Category:** System\ **Created:** [May 23, 2012, 8:39pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157 "2012-05-23T20:39:51Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![fsweetser](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fsweetser](https://community.a10networks.com/u/fsweetser)\ **Post date:** [May 23, 2012, 8:39pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/1 "2012-05-23T20:39:51Z")
I’m trying to set up a virtual server such that, when it receives traffic for a port on the VIP that does not match any other VIP, it a) processes the traffic, and b) preserves the original client destination port when relaying the request to the backend servers. It looks like I want a wildcard VIP, but I couldn’t get anything working from the very minimal docs. Does anyone have an example of what I’m trying to do they’d be willing to share? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\ **Post date:** [May 24, 2012, 4:53am UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/2 "2012-05-24T04:53:51Z")
hello here is an example configuration below, A Wildcard VIP is used to load balance proxy servers. You can use an ACL to block any unwanted traffic from the wildcard VIP. ! ```auto access-list 101 deny ip any 170.235.0.0 0.0.255.255 access-list 101 deny ip any 10.0.0.0 0.0.0.127 access-list 101 deny ip 10.32.35.240 0.0.0.7 any ``` access-list 101 permit icmp any any access-list 101 permit tcp any any eq 80 access-list 101 permit tcp any any eq 443 ! ! slb server Proxy-0 10.0.0.100    port 80 tcp    port 443 tcp ! slb server Proxy-1 10.0.0.101    port 80 tcp    port 443 tcp ! ! slb service-group Proxy80 tcp     method least-connection     member Proxy-0:80     member Proxy-1:80 ! slb service-group Proxy443 tcp     method least-connection     member Proxy-0:443     member Proxy-7:443 ! ! slb template tcp TCP\_Idle    idle-timeout 300    reset-fwd    reset-rev ! slb template persist source-ip SIP-Persist1    match-type server ! ! slb virtual-server VIP-Proxy 0.0.0.0 acl 101    ha-group 1    port 80 tcp       name \_wildcard\_v4\_101\_TCP\_80       service-group Proxy80 ```auto       use-rcv-hop-for-resp       use-default-if-no-server ``` template tcp TCP\_Idle       template persist source-ip SIP-Persist1    port 443 tcp       name \_wildcard\_v4\_101\_TCP\_443       service-group Proxy443 ```auto       use-rcv-hop-for-resp       use-default-if-no-server ``` template tcp TCP\_Idle       template persist source-ip SIP-Persist1 ! ! ---
**Author:** ![fsweetser](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fsweetser](https://community.a10networks.com/u/fsweetser)\ **Post date:** [May 24, 2012, 1:25pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/3 "2012-05-24T13:25:56Z")
Thanks, but that doesn’t quite look like what I’m going for. That looks like it’s handling specific ports on a wildcard IP, while what I want is the inverse - I want a specific IP address to handle any tcp port, and pass it to the selected backend server unmodified. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\ **Post date:** [May 24, 2012, 1:31pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/4 "2012-05-24T13:31:11Z")
Hello on that case you can use the following example Port 0 or others can be defined. slb virtual-server VIP-Proxy 10.10.10.1 ha-group 1 port 0 tcp ---
**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\ **Post date:** [May 24, 2012, 1:57pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/5 "2012-05-24T13:57:09Z")
Something like this would work. This will do destination NAT to the server, but will not change the destination tcp or udp port. If you require only tcp you can remove the udp and others configuration. Others will load balance all protocols other than tcp and udp. If you have ICMP health checks disabled you may have to add a health check to each server. ! slb server s1 10.2.1.10    port 0 tcp        no health-check    port 0 udp        no health-check ! slb server s2 10.2.1.11.11    port 0 tcp        no health-check    port 0 udp        no health-check ! slb service-group \_tcp\_0\_sg tcp     member s1:0     member s2:0 ! slb service-group \_udp\_0\_sg udp     member s1:0     member s2:0 ! slb virtual-server All\_Ports\_vs 10.1.1.10    port 0 tcp ```auto       name \_10.1.1.10\_TCP\_0       service-group tcp\_0\_sg ``` port 0 others ```auto       name \_10.1.1.10\_Others\_0       service-group tcp\_0\_sg ``` port 0 udp ```auto       name \_10.1.1.10\_UDP\_0       service-group udp\_0\_sg ``` ! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\ **Post date:** [May 24, 2012, 2:08pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/6 "2012-05-24T14:08:44Z")
Fsweetser, Try searching for Outbound Link Load Balancing in the documentation. 🙂 There is a pretty good example. I have to build this up for a customer today and will post an example later. Best regards, ToddH ---
**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\ **Post date:** [May 24, 2012, 2:12pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/7 "2012-05-24T14:12:17Z")
The example config above is perfect, but you need to add the “no-dest-nat” to the VIP ports. -ToddH- ---
**Author:** ![fsweetser](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fsweetser](https://community.a10networks.com/u/fsweetser)\ **Post date:** [May 24, 2012, 5:09pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/8 "2012-05-24T17:09:47Z")
Thanks, that gets me 98% of the way there! The last missing bit now, though, is that port 0 only seems to work when configured as TCP, but I need mine as HTTPS, since I have to do cookie persistence and an aFlex URL rewrite. Is there some other trick required to get it working as an HTTPS port? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\ **Post date:** [May 24, 2012, 5:41pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/9 "2012-05-24T17:41:11Z")
Fsweetser, SSL termination is not possible with a wildcard VIP using no-dest-nat. You may be able to use a VIP with a subnet range and IP-Header insert (x-forwarded-for). I would recommend contacting your SE and working out a solution that meets your needs. There are plenty of options available. 🙂 Best regards, -ToddH- ---
**Author:** ![fsweetser](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fsweetser](https://community.a10networks.com/u/fsweetser)\ **Post date:** [May 24, 2012, 5:45pm UTC](https://community.a10networks.com/t/create-functional-wildcard-port-vip/157/10 "2012-05-24T17:45:56Z")
I don’t think it’s the no-dest-nat, as I actually had a mostly working config with port 0 and without no-dest-nat. I’m in a one-armed config, so I do actually need NAT enabled. It looks like it’s the port 0 that’s conflicting for me. I’ll follow up with my SE now that I have a better idea of what I’m looking for. Thanks!