Forum Discussion

Jose_Charpentie's avatar
Jose_Charpentie
Icon for Nimbostratus rankNimbostratus
Aug 24, 2015

Use VIP address as source

Hello everyone,

 

How can I allow the VIP IP as a source when the Pool Member iniciates the connection on a specific port? I tried with a NAT but it will NAT all the traffic I need only to NAT with when the pool member iniciates the traffic in a specific port. (Actually the NAT didn't work, I have a capture on a FW and the connection is using the self IP of the F5).

 

I tried with a SNAT and SNAT Pool but it doesn't worked either, I can see the self IP in the FW when the server iniciates the traffic.

 

I also tried with an iRULE, something like this:

 

when CLIENT_ACCEPTED { if {[TCP::local_port] == 2196} { snatpool SNAT_POOL_TEST

 

} pool airwatch-AWCM-2001 }

 

Thank in advance for your responses.

 

Regards,

 

Jose Charpentier F

 

application delivery
design
devops
iRules
LTM
snat
TMSH

5 Replies

Sort By
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Aug 24, 2015

    Can you please elaborate? A NAT is going to be a simple destination translation from one (origin) IP to another, while a SNAT changes the source. Why would you want to use the VIP address as the source to the server - when it is otherwise the destination on the client side?

     

  • Jose_Charpentie's avatar
    Jose_Charpentie
    Icon for Nimbostratus rankNimbostratus
    Aug 24, 2015

    Hello Kevin,

     

    When the connections are comming to the VIP from the customer (inbound) the traffic is being handle normally.

     

    User -- Firewall -- F5 VIP (192.168.101.40) -- Node (10.156.10.92)

     

    But when the NODE is the one that generates the traffic to Internet (outbound) I need the BigIP to use the VIP IP address as the source and not the self IP of the BigIP. The Firewall is allowing only the VIP IP address, and in the capture I am seeing the self IP (192.168.101.7) when using NAT or SNAT.

     

    Node (10.156.10.92) -- F5 -- Firewall -- User

     

    The NODE is also hosting other services, so I need to do this translation only when the NODE starts the traffic for example on port 2196.

     

    Thank you for your repply.

     

    Regards,

     

    Jose Charpentier F

     

    • Julio_Medina's avatar
      Julio_Medina
      Icon for Nimbostratus rankNimbostratus
      Apr 26, 2019

      Hi Jose Charpentier,

       

      Did you get this issue solved? i'm facing that same problem today and I need some help. I would appreciate so much.

       

      Thnks

       

  • Jana's avatar
    Jana
    Icon for Altostratus rankAltostratus
    Aug 24, 2015

    For outbound traffic, you can try creating an SNAT address same as the VIP address and add the node ip address(es) in the Origin list. However, I'm not sure if you could do that for traffic from a specific port.

     

  • Vinit_Ajgaonkar's avatar
    Vinit_Ajgaonkar
    Icon for Nimbostratus rankNimbostratus
    Apr 28, 2019

    I think one way of doing this would be to create a NAT pool and add the LB VIP onto the NAT pool. Then apply this pool in the NAT translation configuration. That should take care of all the application traffic. However if you haved any healthchecks they will always originatge from the LB backend self IP.