Exclude servers from SNAT automap

Question

Hello, I have a question regarding excluding 2 servers from a snat automap. The BIG-IP has SNAT automap set, and a forwarding virtual server to make sure the servers behind the BIG-IP find their appropriate outbound route.&nbsp;
&nbsp;I need to find a way to exclude these two servers from being SNAT'd. All of the other servers (which there are many) still need to be SNAT'd.&nbsp;
&nbsp;I cant find a way to exclude these 2 servers from being SNAT'd. It seems that with a global SNAT automap, you cannot explicity exclude IPs from the SNAT. When you create the SNAT you can explicitly include IPs, but not exclude.&nbsp;
&nbsp;I wrote an iRule for the forwarding virtual server to try and exclude these servers from being SNAT'd, however that does not seem to have an effect, as the SNAT that is doing the SNATting is a global SNAT.&nbsp;
&nbsp;What are my options here?&nbsp;
&nbsp;TIA&nbsp;&nbsp;

chris_miller · Answer

Are the servers you're trying to exclude sending traffic outbound and that's where you'd like to prevent them from being SNATed? Or are they receiving inbound traffic and when they're selected, you'd like to keep the traffic from being SNATed on the way to them?  
&nbsp;  
&nbsp; This'll be a pretty easy rule...just curious as to your traffic direction.

george_watkins_ · Answer

Hi cerpika, 
  
 Here are two ways to do the same thing. If you need more than two addresses or so, I'd recommend consolidating them into a datagroup for ease of manageability.  
  
 Example 1: 
  
 when LB_SELECTED {
if { [[IP::server_addr] != 10.0.0.1] or [[IP::server_addr] != 10.0.0.2] } {
snat automap
}
} 
  
 Example 2: 
  
 when LB_SELECTED {
switch -glob [IP::server_addr] {
10.0.0.1 -
10.0.0.2 { }
default {
snat automap
}
}
} 
  
 Hope this helps, 
  
 George

jrahm · Answer

Interesting.  I would have gone with the snat none approach.  I wonder if there is a performance hit for snat automap called in an iRule versus applied as profile in the virtual?

colin_walker_12 · Answer

Good question Jason. I guess the opposite approach with the same functionality would be to turn on snat automap in the profile and then just say:

when LB_SELECTED {
  switch -glob [IP::server_addr] {
    10.0.0.1 -
    10.0.0.2 { 
      snat none
    }
  }
}

Same thing, really, but I wonder if there's a performance difference.  To the test-cave! 
  
 Colin

chris_miller · Answer

Each of these examples assumes he's SNATing inbound traffic üòõ 
  
 Since he mentioned both an IP_Forwarder and outbound routes, I'm assuming this is going to be an outbound SNAT...stealing Colin's example. 
  
 when CLIENT_ACCEPTED {
  switch -glob [IP::client_addr] {
    10.0.0.1 -
    10.0.0.2 { 
      snat none
    }
  }
}

Forum Discussion

Exclude servers from SNAT automap

6 Replies

Recent Discussions

Chrome V 124+ on MacOS - Virtual Server Access Issue

F5Access | MacOS Sonoma

Transaction looks successful but file not downloading

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

F5 Access Guard Deprecated: ZTA APM

Related Content

iRule exclude URI

Kill SNAT AutoMap!

How to ensure source address and source port are accepted and traversed properly via F5 SNAT automap

exclude an fqdn from resolving in f5apm

Server Profile SNI