Forum Discussion

aj1's avatar
aj1
Icon for Nimbostratus rankNimbostratus
May 02, 2015

IP Forwarding Virtual Server v/s SNAT

Trying to understand the difference between the two. Can either one of them be used for forwarding traffic from load balanced nodes (private addresses) to the internet?

 

We have LTMs in an HA pair that are configured with both a wildcard IP forwarding vserver and a SNAT pool (containing standard virtual server addresses). An irule is being used on the forwarding vserver that SNATs a node to its public standard vserver address for anything originating from the node and destined to a host on the internet. From what i understand, LTM can forward traffic (from nodes to the internet) only using a IP forwarding vserver. That is the closest way to emulate the same behavior as a stateless router, which works just fine for now.

 

I'd like to know if SNAT is another way to do the same (forwarding). If it is, can we delete the forwarding vserver and only configure a SNAT object, and still make the internal nodes connect to the internet through the LTM?

 

Would also like to get an opinion on keeping standard vserver addresses inside a SNAT pool, so that individual SNAT addresses can be referenced in an irule for selectively SNAT'ing a set of nodes to their vserver address. We recently did this, and traffic from the internal nodes (mail servers specifically) to certain destinations just didn't work. We have done a lot of packet captures and are still clueless.

 

Any explanation or config pointers would be great. Thank you!

 

application delivery
devops
ip forwading
iRules
LTM
performance
selective snat
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 06, 2015

    unless the vserver used for SNAT'ing (snat 190.191.192.193) is not defined in a SNAT pool (apart from being a vserver object), the rule did not work.

     

    if you run tcpdump on bigip, do you see 190.191.192.193 on egress vlan? if yes but you do not see response packet, upstream device may not know how to send response packet back to bigip. adding 190.191.192.193 as snatpool member will enable arp for 190.191.192.193. there is arp setting on virtual server address too.

     

    At this point, does the traffic get forwarded to the node 10.10.10.1:8821 or does it get load balanced to the pool instead (as is the case with a standard vserver).

     

    the response packet will not hit virtual server 190.191.192.193:25 because destination address is 190.191.192.193:8821. it will hit existing connection which is created when bigip sends request (via wildcard forwarding virtual server).

     

    does an IP forwarding vserver maintain the connection's state in LTM's connection table (tmsh show /sys connection)?

     

    yes unless you modify profile setting which is assigned to virtual server.