Forum Discussion

Khun_Sophavatta's avatar
Khun_Sophavatta
Icon for Nimbostratus rankNimbostratus
Jul 19, 2026

Can BIG-IP perform DNAT before Virtual Server lookup?

Hi everyone

I have a question about BIG-IP packet processing.

As I understand it, the destination IP received by BIG-IP must match a configured Virtual Server. This can happen either because:

- The Virtual Server uses the public IP directly, or

- An upstream firewall performs DNAT before the traffic reaches BIG-IP.

Is there any scenario where traffic arrives at BIG-IP with a public destination IP, but the Virtual Server is configured with a private IP, and BIG-IP performs DNAT before selecting the Virtual Server?

Or is Virtual Server lookup always performed first, meaning the incoming destination IP must already match the Virtual Server?

application delivery

1 Reply

  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Jul 19, 2026

    Hi Khun_Sophavatta​,

    The BIG-IP uses the destination address, source address, and service port to match incoming traffic to a virtual server.
    But also the BIG-IP is a default deny device. This means, when no traffic processing objects are configured (for example a matching virtual server), the BIG-IP system does not process any network traffic. 
    For your question this means - the destination IP must match the Virtual Servers IP address, otherwise the BIG-IP won't do much with it.

    Can you explain what you plan to do? Maybe we can suggest a solution.

    Cheers
    Daniel