Forum Discussion

Joe_Willis_4776's avatar
Joe_Willis_4776
Icon for Nimbostratus rankNimbostratus
Sep 22, 2008

Default Gateway at Server level versus SNAT-AutoMap at VIP level

Hi,

 

 

I have what I hope to be a simple (and maybe a "duh") question. How expensive is it, in terms of CPU cycles, to assign a SNAT Pool of Automap to every VIP to enforce traffic to egress back through the LTM? The thought is to take this approach as opposed to changing the default gateway of all pool members to be the floating self IP address of the LTM.

 

 

Why do you ask? We are in a switched environment and in almost all cases, the LTM is not acting as the gateway for any VLAN (rather, a switch is relegated this task). Going the default gateway route, we end up with a lot of asynchronous routing. Sure, we can address the routing issue by adding static routes to all pool member servers to use the VLAN's "normal" default gateway. This has started to become a headache to manage though, and is why I am here.

 

 

So, to boil it down, it would be easier for us to put the default gateways back to the VLAN's "normal" gateway for all pool member servers. In addition, we would assign a SNAT-Automap to all VIPs to make sure that any traffic initiated from the LTM would egress back through the LTM.

 

 

What are the consequences of doing this?
config
design

3 Replies

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Sep 23, 2008
    We have several hundred mb/s flowing through a 3400 on 400 different virtuals (development box), all of which have their own snat address. CPU and memory are barely registering...

     

     

    Snat automap is fine unless you are going to exceed 64k connections/second, at which point you'll need a snatpool. We match the 4th octet of the virtual IP address to the snat address so we can track connections through the F5 more easily.
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Sep 23, 2008
    The other consequence is that you will no longer see the client's source address in the server logs, all the traffic will appear to come from the SNAT address. If this is not a concern for you then you're OK. But it tends to mess up WebTrends and such. You can insert the original client address in an X-Forwarded-For header (in the http profile), and depending on what the server is, you would have to configure it to log that as the client IP (there is an ISAPI plugin for IIS here on DevCentral).

     

     

    Denny
  • Joe_Willis_4776's avatar
    Joe_Willis_4776
    Icon for Nimbostratus rankNimbostratus
    Sep 23, 2008
    Thank you both for your replies; great information on how SNAT taxes (or rather, how it does not at all) the LTM; we have no where near 64k connections/second, so I think we should be in good shape.

     

     

     

    On the client IP: Yep, already have thought of that and plan to do exactly what you are talking about. We actually have to do it further up stream as all traffic that flow to the application VIPS come from a pair of Web reverse proxy server (Apache). So, as it stands now, in the application server logs you only ever see the reverse proxy IPs. We'll configure and assign a proper HTTP profile to the front facing VIPs that tie to DNS and that feed the traffic to the reverse proxy servers (and configure Apache accordingly).

     

     

    In general, the flow is CLIENT -> VIP (ties to DNS) -> Reverse Proxy -> VIP (application) -> application server -> database server.

     

     

     

    Thanks again for your help.

     

    Joe