For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brian_Gibson_30's avatar
Brian_Gibson_30
Icon for Nimbostratus rankNimbostratus
Feb 17, 2015

Creating a dynamic one-to-one SNAT pool

We have a problem with an SMB VIP that appears to be NAT related. What we are looking to do is create a SNAT pool in which each new IP address is assigned it's own SNAT address.   Is there any ...
application delivery
devops
iRules
LTM
Brian_Gibson_30's avatar
Brian_Gibson_30
Icon for Nimbostratus rankNimbostratus
Feb 19, 2015

Brad,

 

I am going to try this but if that doesn't work I'm thinking it might be easier for me to create a replace mask. So I have incoming request of 10.99.99.23 I could do a replacement mask of 172.23.. it would replace the source with 172.23.99.23.

 

While this won't guarantee unique source IP addresses, it should greatly reduce the problem.

 

How do I apply the pool to the SNAT? I'm a little confused about that. Wouldn't snat [IP::server_addr] assign the SNAT to be the destination server address?

 

  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Feb 20, 2015
    So what I suggested doesn't quite work the way I had hoped, but it can be "made" to work but it then gets to be more of a hacked together solution then its worth. You are probably better of doing a replacement mask like I first suggested and you suggest here. That's a far better and simple solution if you must SNAT the traffic to the SMB server. Alternatively if the LTM was the default gateway you would not need to SNAT that traffic at all.