Forum Discussion
CirrostratusAFM NAT vs LTM NAT
This feature seems to have creeped up somewhere in the 12.x release for AFM? Or maybe it's been there but I've never seen it...
Anyway are there any documents or articles that discuss what happens if there are conflicting AFM NAT rules vs the LTM NAT Rules? Or even with SNAT? If I was using my F5 as a gateway to the internet would I still be creating a wildcard VS with SNAT on it to translate private addresses to public or would I use an AFM NAT rule now? Does the order these are applied in reflect the order in which a packet hits each module on the BIG IP?
9 Replies
JWhitesPro_1928Also what makes more sense? Have a Virtual Server on the external interface with a public address or having a virtual server on a dmz/internal interface and using AFM (or something) to translate the address to a public address?
Vijay_ECirrus
I will answer the 2nd part of the question. Having worked with both Public IP VS and Private IP VS, there really isn't a big difference from a Network/ADC perspective. Some applications may not work well with NAT and hence, may require Public IP VS. Most applications are compatible with NAT and you shouldn't see any difference in performance or functionality in both cases.
AFM NAT rules are applied after AFM Firewall rules. The functionality of the CGNAT module has been ported to AFM (dynamic-pat) and extended using 1:1 mapping features like static-nat and static-pat because a rule construct is more flexible. An AFM NAT Policy cannot be configured in tandem with other forms of address translation, like SNAT, a LSN pool or Automap since the two workflows are mutually exclusive.
bassam_gohar_26Nimbostratus
hi peter,
so what is difference between the standalone CGNAT module and CGNAT module that integrated in the AFM NAT ?
Nothing actually. The same code is used for both. It is repackaging exercise since AFM users prefer to use ACLs. It also reduces the number of virtual servers required since you can setup a wildcard VIP and use ACL rules to filter the traffic. AFM is also gradually leap frogging the CGNAT module in other respects e.g. by adding support for proxy ARP (both source and destination) and adding other forms of 1:1 static NAT.
dynamic-pat == CGNAT
CGNAT ALGs are still provisioned as they are today by attaching a profile to the Virtual Server but they interoperate with AFM dynamic-pat.
CGNAT LSN pools and dynamic-pat are mutually exclusive.
- bassam_gohar_26
thanks a lot peter :), so in dynamic pat we should take care from the CMP hash on the inbound and outbound vlans like the CGNAT module ?
