iRule SNAT for multiple ISP

This is a very good news! I would like to thank you all for you advice and your involvement on my case.

Hi Guys,

We are approaching the goal !

Using the FastL4 still doesn't work because as Kai explain, I have to configure different route for some specific LAN.

I switch the default VS to a Forwarding IP + iRule. It works with the LAN which have the iRule with next-hop but with others LAN which have the irule with the pool gateway I still have some timeouts because in the capture I see that the BIGIP still route some traffic through the incorrect Link.

I though that it was because the default VS have a pool which include the specific Link used by the iRule next-hop. I disble this link on the defautl pool and IT WORKS! I just would like to confirm with you if i'm right and if this is the correct configuration. To summerize : - VS_default in Forwarding IP with iRule (which route traffic through a specific next-hop for LAN1 and on the other hand a SNAT-pool for all others LAN) - Default_pool (bound to default_vs) : with two links (except the specific link for LAN1) - A SNAT_pool : to SNAT all LAN except the LAN1 - A SNAT : to SNAT the LAN1 on a specific Public_IP on the Link1 network.

Okey thank you guys for those information.

I will test first the VS fastL4 with address translation and port translation disabled. I prefer this option to avoid iRules (that are more difficult to maintain). Then if it doesn't work I will try to use iRules. I give you a feedback ASAP.

Hi Nicolas,

the previously provided iRule would in combination with an "Forwarding (IP)" virtual perfrom some sort of load balancing, where each customer-segment would use a different nexthop address and snat address (aka. using a different WAN-Link).

Cheers, Kai

Hi,

you can create the VS with performance (Layer 4) mode and make sure the address translation and port translation are unchecked... (these options are unchecked if the destination is a network)

In this VS, you can define the pool default_gw_pool

Hi,

If I put the default-VS with Forwarding IP mode, I will not be able to load balance traffic through multiple links right? My final goal is to loadbalance traffic through multiple Links.

According to my problem I found something interesting. I understand why the iRule was not matching! There was a mistake on the VS_default configuration which had a Destination Adress 0.0.0.0 instead of 0.0.0.0/0 So now my default VS is matching. On the BIGIP I see a traffic from my LAN to internet but I don't have the return...

Hi Nicolas,

did you applied the changes I've suggested a few post earlier?

"The default-VS needs to be changed to "Forwarding (IP)" mode, with Destination Address/Mask 0.0.0.0/0, global SNATPOOL settings for ISP2 and point the default route to Y.Y.Y.1. Delete the conditional SNAT rules and also the default_gw_pool"

Cheers, Kai

Hi,

I applied the iRule. The problem is that the iRule is not matching with the traffic. I don't have the pattern "VS Reached" in my ltm log file.

Do you know how can I debug this problem?

When I look my tcpdump I still have a traffic passing from the LAN through the wrong ISP.

Hi Nicolas,

If you have to deal with multiple customes you may wanna take a look to the traffic-group feature. It will enable you to configure a virtual router for each customer. In this case each customer would have its own routing table and static SNAT settings. And no iRules needed then...

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip_redundant_systems_config_11_0_0/6.html

If multiple traffic groups are not an option for you, then the outline technique of my last responce would remain nearly the same. Designate one customer as default route and SNAT and then overwrite the nexthop and SNAT based on different source addresses. The iRules would then look like this...

when CLIENT_ACCEPTED { 
    log local0. "VS Reached"
    if { ( [IP::addr [IP::client_addr] 10.32.1.192/26] ) or 
         ( [IP::addr [IP::client_addr] equals 10.32.2.0/26] ) } then {
        snat X.X.X.203
        nexthop X.X.X.201 
        log local0. " -- SNAT CUSTOMER2 -- "
    } elseif { ( [IP::addr [IP::client_addr] 10.32.3.192/26] ) or 
         ( [IP::addr [IP::client_addr] equals 10.32.4.0/26] ) } then {
        snat X.X.X.103
        nexthop X.X.X.101
        log local0. " -- SNAT CUSTOMER3 -- "
    } elseif { ( [IP::addr [IP::client_addr] 10.32.5.192/26] ) or 
         ( [IP::addr [IP::client_addr] equals 10.32.6.0/26] ) } then {
        snat X.X.X.13
        nexthop X.X.X.11
        log local0. " -- SNAT CUSTOMER4 -- "
    } else {
        log local0. " -- SNAT DEFAULT -- " 
    } 
}

Cheers, Kai

Hi Kai,

I've simplified the configuration but in fact my final configuration is to have : ISP1 (X.X.X.X) for customer 1 (with 2 local networks) and ISP2 (Y.Y.Y.Y) & ISP3 (Z.Z.Z.Z) for other customers (with multiple networks)

So compared to your advice I think that this change the configuration right? If Yes can you help me to find the correct one?

Thank you a lot.