For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

wfaulk_98141's avatar
wfaulk_98141
Icon for Altostratus rankAltostratus
Mar 28, 2014

Get information about Self-IPs in iRule

I have a need for an iRule that enables SNAT if the client and server addresses are in the same subnet. In practice, this only happens if the client and server addresses are on directly connected su...
application delivery
devops
iRules
LTM
IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Mar 28, 2014

Hi I think this might work for you - I have assumed that you use a mix of 24/25/26 masks - you adjust as appropriate (following code not tested BTW);-

 

when LB_SELECTED {
    foreach mask [26 25 24] {
        if {[IP::addr [clientside {IP::remote_addr}]/$mask equals [IP::remote_addr]/$mask]}{
            snat automap
            break
        }
    }
}
IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Mar 30, 2014
Right. Good point. I'm afraid you are out of luck - you can't get the self-ip info from an iRule. You'll either need to snat everything or maintain a list of networks (which I agree is unwieldy).