For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Joe_Willis_4776's avatar
Joe_Willis_4776
Icon for Nimbostratus rankNimbostratus
Sep 22, 2008

Default Gateway at Server level versus SNAT-AutoMap at VIP level

Hi,     I have what I hope to be a simple (and maybe a "duh") question. How expensive is it, in terms of CPU cycles, to assign a SNAT Pool of Automap to every VIP to enforce traffic to egr...
config
design
Joe_Willis_4776's avatar
Joe_Willis_4776
Icon for Nimbostratus rankNimbostratus
Sep 23, 2008
Thank you both for your replies; great information on how SNAT taxes (or rather, how it does not at all) the LTM; we have no where near 64k connections/second, so I think we should be in good shape.

 

 

 

On the client IP: Yep, already have thought of that and plan to do exactly what you are talking about. We actually have to do it further up stream as all traffic that flow to the application VIPS come from a pair of Web reverse proxy server (Apache). So, as it stands now, in the application server logs you only ever see the reverse proxy IPs. We'll configure and assign a proper HTTP profile to the front facing VIPs that tie to DNS and that feed the traffic to the reverse proxy servers (and configure Apache accordingly).

 

 

In general, the flow is CLIENT -> VIP (ties to DNS) -> Reverse Proxy -> VIP (application) -> application server -> database server.

 

 

 

Thanks again for your help.

 

Joe