Forum Discussion
Nimbostratusdefault route and multiple "external" subnets
Hi,
I am planning on moving two projects (project1 and project2) to a single route domain (common) on an LTM pair. I have currently configured one project on the LTM pair, so I'm hoping to simply lump the other project into the same route domain. At present the LTMs are using a default route via the VLAN assigned to proejct1's public IP range.
Both projects have been assigned their own dedicated public IP range (public VIPs and SNATs) and private IP range (pools).
Is it possible to drop the default route and replace it with source based SNATs along the lines of the following?
pool nexthop-1-gw {
members :any
}
snatpool public-1-snatpool {
members
}
virtual public-1-wcard {
snatpool public-1-snatpool
pool nexthop-1-gw
destination any:any
mask none
vlans private-range-1-VLAN enable
}
nexthop1 is the SVI on the up-stream router. LTM-public-SNAT-IP-1 is a unique public IP address assigned to a VIP on the LTM. This can be repeated for project2 using unique public IP addresses assigned to that project.
6 Replies
What_Lies_Bene1Cirrostratus
What's the real need to drop the default route here? It's not clear what the requirement or benefit is here. When you implement project2, how will you differentiate traffic and SNAT differently?- nitass
Employee
Is it possible to drop the default route and replace it with source based SNATs along the lines of the following?i understand you are talking about outbound traffic from pool. yes, i think it is possible and your configuration looks okay to me except mask "none". shouldn't it be "any"?
LTM: Per-VLAN Default Gateways by Deb
https://devcentral.f5.com/tech-tips/articles/ltm-per-vlan-default-gateways 
OttimoMassimo_1Hi Nitass,
Thanks for sending on that link. It's very helpful.
To answer your questions - yes, I am talking about outbound traffic from (server) pool members which require a SNAT. So, in this scenario an IP address that has been assigned to an existing VIP will act as that SNAT IP like so:
snatpool public-1-snatpool {
members LTM-public-SNAT-IP-1_ip_addrss
}
Looking at another one of Deb's documents, it seems that "mask none" is the preferred configuration option:
https://devcentral.f5.com/tech-tips/articles/ltm-configuring-ip-forwarding
virtual forward_vs {
ip forward
destination any:any
mask none
}
I guess I'll have to test it.
To answer WLB's question about the default route. it was put in place when a single project was assigned to the LTM pair before it went into production. We did not want to use a routing protocol, so we went with a default route. However, the introduction of separate router and server VLANs meant that the default route would only be relevant to it's broadcast domain and not the new ones if that makes sense.- nitassLooking at another one of Deb's documents, it seems that "mask none" is the preferred configuration option:
https://devcentral.f5.com/tech-tips/articles/ltm-configuring-ip-forwarding
virtual forward_vs {
ip forward
destination any:any
mask none
} this is mine.[root@ve10:Active] config b version|grep -iA 1 version BIG-IP Version 10.2.4 655.0 Hotfix HF4 Edition [root@ve10:Active] config b virtual fwd list virtual fwd { ip forward destination any:any mask 0.0.0.0 } - nitassand this is 11.3.0.
[root@ve11a:Active:Changes Pending] config tmsh show sys version|head Sys::Version Main Package Product BIG-IP Version 11.3.0 Build 3022.0 Edition Hotfix HF3 Date Fri Feb 22 00:00:34 PST 2013 [root@ve11a:Active:Changes Pending] config tmsh list ltm virtual fwd ltm virtual fwd { destination any:0 ip-forward mask any profiles { fastL4 { } } source 0.0.0.0/0 source-address-translation { type automap } translate-address disabled translate-port disabled vlans-disabled } - OttimoMassimo_1Cool. Thanks Nitass. I'll have a play with it on my kit so.
