Forum Discussion

Gbps_31870's avatar
Gbps_31870
Icon for Nimbostratus rankNimbostratus
Aug 05, 2012

Application issue with SNAT pool

Hi,

 

 

We have one VS configured with a SNAT pool, but server team complain that there is an issue accessing the application.

 

 

Giving that everything is working fine when they are accessing the real server directly (GW for the server is the FW).

 

 

Looking to tcpdump captured in both sides (client & servers side), we found that client IP is translated to different IPs for each connection during the same session.

 

 

I'm going to apply the below iRule so that the testing client IP (10.1.0.2) wouldn't change for each connection. please advise if this iRule is ok to use and it will override the default SNAT pool.

 

 

when CLIENT_ACCEPTED {

 

if {[IP::addr [IP::client_addr] equals 10.1.0.2} {

 

snat 10.2.0.2

 

} else {

 

snat snat-pool

 

}

 

}

 

 

If it's ok and it works for the testing client IP, is there a way through iRule to translate client IP address to a single IP address from the snat-pool for all connections during the same session.

 

 

Thanks in advance and sorry for the long post.

 

 

BR,

 

Abdul

 

application delivery
dev
devops
iRules
  • Richard__Harlan's avatar
    Richard__Harlan
    Historic F5 Account
    Aug 06, 2012
    Yes the Above iRule should keep the Test client on the same IP address. The thing you also want to check is you have persistence enabled on the LTM to make sure each request goes to the correct server. The other thing is to make sure NTLM is not being used as it could cause problem with multiple session on multiple IP are using the same login.
  • Gbps_31870's avatar
    Gbps_31870
    Icon for Nimbostratus rankNimbostratus
    Aug 06, 2012
    Thanks Richard for your inputs.

     

     

    Cookie persistence is enable and NTLM is not being used as you mentioned.

     

     

    I do believe that this application is tracking the client communication via IP address, which F5 is changing for each connection.

     

     

    Hopefully the above iRule will isolate the issue during the next testing window.

     

     

    What about the other part "is there a way through iRule to translate Client IP address to a single IP from the snat-pool for all connections during the same session" ,,, Any ideas ??

     

     

    BR,

     

    Abdul

     

  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Aug 07, 2012
    Hi Gbps,

     

     

    Question: Is there a way through iRule to translate Client IP address to a single IP from the snat-pool for all connections during the same session?

     

    The simple answer is yes, by specifying the SNAT Address like you are doing above but there are limitations.

     

     

    If you use SNAT Automap the BIG-IP will use one of its Self IP Addresses as the SNAT Address, but each Self IP Address can only snat 65,536 connections before the next Self IP Address is used (any SNAT Address you specify will have the same limitation). Note that these are per connection and most browsers open up anywhere from 3 to 6 connections at a time to download a site faster. So depending upon the usage of the site you may need to have multiple SNAT IP Addresses (use a SNAT Pool).

     

     

    Do you know if the application is capable of using an X-Forwarded-For HTTP Header? This would deliver the True Client IP Address to the application and might help your situation as well.

     

     

    X Forwarded For Single Header Insert

     

    Using "X-Forwarded-For" in Apache or PHP

     

    X-Forwarded-For

     

     

    Hope this helps.
  • Gbps_31870's avatar
    Gbps_31870
    Icon for Nimbostratus rankNimbostratus
    Aug 08, 2012

     

    Hi Michael,

     

     

    Thanks for your reply.

     

     

    The iRule I made was just for testing and it's matching a single IP (10.1.0.2), what about if I have different clients with different IPs. It's ok for multiple client's sharing the same IP but they should stick to that IP during the session.

     

     

    Unfortunately, I'm not aware of the application capabilities, but the team will come back again for the DR testing and it's a good idea you are providing here which could be a solution if next test confirm that SNAT pool causing the issue.

     

     

    Thanks a lot all for the great support, I will get back and post the test result once done.

     

     

    BR,

     

    Abdul