keep in mind the CSS needs to see both side of the traffic.
That is client to server but also server to client.
The client to server traffic will always come to the CSS since the client is talking to the vip that is on the CSS.
However, the server is not aware that there is a CSS and may send responses back to client directly which will break the process.
The solution is to
1. set the CSS as default gateway for the server
2. use policy routing to forward server traffic to css
3. use client nat on CSS
If you use the 3rd option, your server will not see the client ip address. All traffic will come from the CSS ip - so problem if you do statistics based on client ip.
In general it is not a good idea to use one-armed.
Too much trouble with the return traffic and most of time not so good performance compare to other solutions.
Gilles.
