Forum Discussion

aj1's avatar
aj1
Icon for Nimbostratus rankNimbostratus
Nov 23, 2014

Conditional SNAT using an iRule on a Wildcard Forwarding VS

Hello everyone,

I am new to iRules and have seen a lot of answers to the issue i am currently facing, but even after referring them and trying out all the possible combinations i just can't seem to get it to work.

I have two Viprions (v11.5.1 Hotfix 5) in Active/Standby and a host (with a private address) setup behind those in our lab. The customer would like to connect to a public server to fetch updates. I used a wildcard forwarding VS with a SNAT pool to set this up and it works just fine. Now, he would also like to see a log entry (containing his host's IP, the SNATed IP, and the IP of the public server he is connecting to) whenever an outbound connection is initiated. Additionally, if the public server is on-campus, there should be 'no SNAT log' and 'forwarding', but if the server is off-campus, there has to be 'SNAT log entry' and 'forwarding'.

I looked up conditional SNAT and sure enough there was a solution, but most of them were for CLIENT_ACCEPTED events, which is not the case here. It is more of a SERVER_CONNECTED event. I started by creating two data-groups - 'on-campus networks (public networks and the 172.16/12 prefix routed on campus)' and 'load balanced networks (3 private subnets)' and use these in my iRule. Mind you the 3 private load balanced subnets are taken out of the private /12 routed on campus.

My iRule:-

when SERVER_CONNECTED {

        if {[matchclass [clientside {IP::client_addr}] equals loadBalancer_networks] and [matchclass [serverside {IP::remote_addr}] equals onCampus_networks]} {

        snat none
        return
    }

    else {
        log local0. "Client [clientside {IP::client_addr}]:[clientside {TCP::client_port}] SNATed to [IP::local_addr]:[TCP::local_port] connecting to [serverside {IP::remote_addr}]:[serverside {TCP::remote_port}]"
        snatpool snat_pool
    }
}

I have tried all the possible IP combinations inside the if statement, but none of them have worked out so far. Can anyone here help me out with the same. Please. Thank you.

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
iRules
LTM
management
security

15 Replies

Sort By
Show More
  • aj1's avatar
    aj1
    Icon for Nimbostratus rankNimbostratus
    Mar 06, 2015

    Thank you, that worked ! I can see the logs for anything outbound initiated from one of the load balanced hosts. However, when i try to verify the same using "tmsh show /sys connection cs-client-addr ", i see nothing. We have a mail server connecting to google's mail servers, and i can see a log entry for that connection but nothing in bigip's connection table. Not sure if this has something to do with the fastl4 profile on the wildcard forwarding vserver.

    iRule:

    when CLIENT_ACCEPTED {
    if { [class match -- [IP::local_addr] equals onCampus_networks] } {
        set is_snat 0
        log local0. "IF. Client is [IP::client_addr]:[TCP::client_port]. Destination address is      [IP::local_addr]:[TCP::local_port]. No SNAT"
        snat none
    }
    elseif { [class match -- [IP::client_addr] equals /Systems/smtp_nodes] } {
        set is_snat 1
        log local0. "ELSE IF. Client is [IP::client_addr]:[TCP::client_port]. Destination address is [IP::local_addr]:[TCP::local_port]. SNAT"
        snat 198.82.215.225

    } else {
        set is_snat 1
        log local0. "ELSE. Client is [IP::client_addr]:[TCP::client_port]. Destination address is [IP::local_addr]:[TCP::local_port]. SNAT"
        snatpool snat_pool
    }
}
when SERVER_CONNECTED {
    if { $is_snat } {
        log local0. "Client [IP::client_addr]:[TCP::client_port] SNAT'ed to [IP::local_addr]:      [TCP::local_port] connecting to [IP::remote_addr]:[TCP::remote_port]"
    }
}

    Is there something fundamental i'm missing here?

    Thanks.