For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Marc_Kurath_138's avatar
Marc_Kurath_138
Historic F5 Account
Aug 26, 2015

Incrumenting SNAT pool

I would like to use the iRule below with a Data Group of SNAT addresses so that each outbound connection on an L4 VIP would be SNAT'ed from the "next" address in the data group. If this is not possible using data groups, it would be OK to hard code the SNAT address list..

 

All the connections would be outbound on an L4 forwarding VIP from the list of servers in the dg-VIP-NAME-Srcs data group

 

Any ideas how I can make this happen

 

when CLIENT_ACCEPTED { log local0. "irule-TU client accepted from [IP::client_addr] remote [IP::remote_addr] local [IP::local_addr]" if { [class match [IP::client_addr] equals dg-VIP-NAME-Srcs]} { snat 10.128.20.199 } else { discard } }

 

application delivery
devops
iRules
LTM

1 Reply

  • Marc_Kurath_138's avatar
    Marc_Kurath_138
    Historic F5 Account
    Aug 26, 2015
        when CLIENT_ACCEPTED {
        log local0. "irule-TU client accepted from [IP::client_addr]   remote  [IP::remote_addr]  local  [IP::local_addr]"
        if { [class match [IP::client_addr] equals dg-VIP-NAME-Srcs]}  {
                                    snat 10.128.20.199
                    } else {
            discard
                    }
    }
 inset code in need of mod to SNAT