iRule for Outbound Pool ISP based Load Balancing

don't have time to fully look through, but is there a reason to do this is LB_SELECTED and not earlier, for example CLIENT_ACCEPTED?

I have thought of that but the action I want to take happens after the pool member has been chosen.

So I don't know how to do that during the CLIENT_ACCEPTED event.

why, that only seems to make it more complex.

What version of BIGIP are you running?

I am running 12.1 latest hotfix

Hi Waleed,

to support dynamic outbound SNAT (aka. IP-Mascarading) for your internal Clients, nothing more than a "IP Forwarding" Virtual Server bound to 0.0.0.0/0 and an iRule with certain [snat] commands is required.

To support multiple ISPs at the same time, you have to mix the [snat] command with the [nexthop] command to forward the traffic either to one or the other ISP (aka. dynamically changing the default gateway).

In addition to that I would recommend to not chain multiple [class match] commands in a row (each of them will add CPU overhead). Try to use a single datagroup containing the a.) internal subnets, b.) the SNAT IP and c.) the Def-GW of the ISP and then perform a single [class lookup] command to extract and parse this data.

ltm data-group internal DG_MultiISP_SNAT {
    records {
        192.168.0.0/24 {
                data "1.1.1.11 1.1.1.1"
            }
        192.168.1.0/24 {
                data "1.1.1.12 1.1.1.1"
            }
        192.168.2.0/24 {
                data "1.1.1.13 1.1.1.1"
            }
        192.168.3.0/24 {
                data "1.1.1.14 1.1.1.1"
            }
        192.168.4.0/24 {
                data "2.2.2.11 2.2.2.1"
            }
        192.168.5.0/24  {
                data "2.2.2.12 2.2.2.1"
            }
        192.168.6.0/24  {
                data "2.2.2.13 2.2.2.1"
            }
        192.168.7.0/24  {
                data "2.2.2.14 2.2.2.1" 
            } 
    }
    type ip
}

Note: The data format of the above datagroup is "snat_ip(space)nexthop_ip"

Then use the rather simple iRule below, to dynamically set the [snat] and [nexthop] values based on the extracted data group settings.

when CLIENT_ACCEPTED {
    if { not [set DG_MultiISP_SNAT_DATA [class lookup [IP::client_addr] equals DG_MultiISP_SNAT]] eq "" } then {
        log local0. "Source IP \"[lindex $DG_MultiISP_SNAT_DATA 0]\" using Gateway IP \"[lindex $DG_MultiISP_SNAT_DATA 1]\" for Client IP \"[IP::client_addr]\""
        snat [lindex $DG_MultiISP_SNAT_DATA 0]
        netxhop [lindex $DG_MultiISP_SNAT_DATA 1]
    } else {
         Client subnet not found in the datagroup. Using virtual server and route domain default settings to forward the packet.
    }
}

Note: Didn't verified the provided example code. But the chances should be above average, that the code will work for you without any changes. If not, then feel free to correct the left over typos... 😉

Cheers, Kai

I would not use an iRule at all. It seems unnecessary. Try to take advantage of Source IP field in the Virtual Server configuration settings.

1. First, create a working configuration for one ISP, refrain from using any iRules and stick to Virtual Server settings (SNAT pool, Default Pool) . Observing that you have a large number of data groups to compare against (ISP2), it might be best to create that default configuration for ISP2 users. (IP Source setting: 0.0.0.0/0)
2. Create a second Virtual Server with the same Destination IP but different Source IP to cover for ISP1 users. Create more Virtual Servers as needed if you have more than one Source IP subnets to compare against. (IP Source setting: yourSubnet1, yourSubnet2...)

Incoming connections will be matched based on the closest-match logic. So if there's a better match to client's IP address than 0.0.0.0/0, a dedicated VS for ISP1 user will get the connection.