Forum Discussion
A__N_5261
Nimbostratus
Jan 09, 2013How to Verify SNAT is working ?
HI,
I have confiugure SNAT. is there any way to veriy . its working or not? . does it maintain any table ?.
Thanks & Regards
A.N
2 Replies
- nitass
Employee
i understand you have to check connection table or tcpdump.
e.g.[root@ve10:Active] config b virtual bar80 list virtual bar80 { snatpool mysnatpool pool foo destination 172.28.19.252:80 ip protocol 6 } [root@ve10:Active] config b pool foo list pool foo { members 200.200.200.101:80 {} } [root@ve10:Active] config b snatpool mysnatpool list snatpool mysnatpool { members { 200.200.200.201 200.200.200.202 } } connection table [root@ve10:Active] config b conn server 172.28.19.252 show all VIRTUAL 172.28.19.252:80 <-> NODE 200.200.200.101:80 TYPE any 1/0 CLIENTSIDE 192.168.206.33:59234 <-> 172.28.19.252:80 (pkts,bits) in = (7, 1216) out = (7, 4962) SERVERSIDE 200.200.200.201:59234 <-> 200.200.200.101:80 (pkts,bits) in = (6, 4922) out = (6, 1176) PROTOCOL 6 UNIT 1 IDLE 2 (300) LASTHOP external 00:01:e8:d5:d4:47 tcpdump [root@ve10:Active] config tcpdump -nni 0.0 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 108 bytes 16:22:20.666129 IP 192.168.206.33.59236 > 172.28.19.252.80: S 198530642:198530642(0) win 8192 16:22:20.666175 IP 172.28.19.252.80 > 192.168.206.33.59236: S 3936556914:3936556914(0) ack 198530643 win 3780 16:22:20.668126 IP 192.168.206.33.59236 > 172.28.19.252.80: . ack 1 win 16695 16:22:20.668167 IP 200.200.200.201.59236 > 200.200.200.101.80: S 634129559:634129559(0) win 4380 16:22:20.669160 IP 192.168.206.33.59236 > 172.28.19.252.80: P 1:625(624) ack 1 win 16695 16:22:20.669170 IP 200.200.200.101.80 > 200.200.200.201.59236: S 1644104907:1644104907(0) ack 634129560 win 5840 16:22:20.669178 IP 200.200.200.201.59236 > 200.200.200.101.80: . ack 1 win 4380 - Stewart_76633
Nimbostratus
another option would be to look on one of the nodes, you should any traffic from the F5 originating from the SNAT address. Microsoft have TCPView which is excellent for a visual netstat.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects