This message was deleted.

Why not just use 1.1.1.1 / 2 / 3 / 4. Just make sure you dont have a route that encompasses that range somehow and it should be fine. You are correct though, it should not matter. I do this on all my implementations. Which firmware version are you using?

Hi Leee. Thanks for the response. Have tried both 12.1 and 13.0 with the same result. I did use 1.1.1.x originally but then changed the range just in case of any issues with that. I will keep testing but definitely do not have any routes covering that range. Very odd. Will keep you posted.

Please do.

Strongly advise against using non-RFC1918 address space that you don't own. That's a recipe for chasing down weird corner cases, one example of which being AAA refusing to SSO without an explicit traffic policy directing it to do so.

Using these for internal services the netscaler will address is something ive always done. Usually storefront is public but radius, ldap and dns is the norm for me.

I understand it's been done before but it's definitely not recommended by any networking vendor including us. Just designating a small dead segment that isn't actually connected/routeable in your infrastructure is the way to go if it's purely internal to ADC.

Fair enough, makes sense.

1.1.1.1 is a real, routable IP (the CloudFlare public DNS server) so I steer clear of that. I either use a 192.168.x.x that's not in use elsewhere on my network, or I've also used 169.254.x.x addresses too.

I wasn't aware of that, cheers Daniel.