This message was deleted.

When you ping it will come from the management ip address. You need communication from the SNIP to the Delivery Controllers.

I was just about to ask what @Leee Jeffries is suggesting. Change the source IP to the SNIP either in the CLI or do it in the Diag section under system.

Merry Christmas Ray 🎅

Thank you, Same to you my friend.

ok, looks like thats coming from an ip in the public subnet rather than the back-end subnet

If you want to restrict the flow of traffic to a particular subnet ip you either need to create vlans in the NS itself and bind vlans to adapter, snips to vlans or use policy based routing.

even with VPC on AWS?

Yes, because unless you tell it how it should get to a particular ip it could use any of the subnet ips, this is where you are seeing your issue. The vlans are just for structure in your instance. Or.. look to add policy based routes. For this ip range, use this snip...

ok, i actually had to create a route entry

A static route entry can also do the job. It will only know about the default route and that's on the management network by default.

the default route SHOULD have done the trick, its why i'd ignored it before

You solved it, nice work 👏 👍