this is the typical problem.
When going from server to vip, the problem is that the receiving server, will see the request coming from a device on a locally attached network and it will send the response to the server/client directly without going through the CSS.
Therefore, the client receives a response from an unknown device since the CSS could not nat the response back to the vip address.
The only solution is to nat the server_client ip when it connects to the vip so it forces the server to respond back to the css.
If you don't want to have to nat all your traffic you need to use an acl to do this.
ie:
group natserver
vip x.x.x.x
active
acl 1
clause 10 permit any x.x.x.x destination content
clause 99 permit any any dest any
apply [vlan...]
Replace x.x.x.x with a server ip.
Create a similar clause for each server.
The vip in the group can be the same as the content rule vip or any other ip address that will belong to the CSS.
Gilles.
Thanks for rating this answer.
