Forum Discussion
Ed_Summers
Nimbostratus
NimbostratusListener order-of-precedence and SOL9038
I find myself confused on the wording of SOL9038 and appreciate any information that can clarify acutal LTM operation with respect to traffic that matches both a source and destination listener.
...
Ed_SummersNimbostratus
NimbostratusThank you nitass. I also confirmed separately with user 'What Lies Beneath'. I guess my original understanding was formed based on first reading the OOP for destination listeners, which would be mutually-exclusive; i.e. The system can only match and execute one destination listener.
Progressing from this I assumed the same for source vs. destination listeners, but after testing and multiple outside confirmations I now see where my understanding was incorrect. I would offer that the SOL language should state "When a connection matches both a source and a destination listener object, the BIG-IP LTM system places a higher precedence on the destination listener parameters" or something similar, rather than the term "object". To me that implies an all-or-nothing config.
Again - appreciate your support!
dragonflymr
Cirrostratus
CirrostratusHi,
To be honest I am still a bit confused what exactly is going on with precedence here. Let's take your example:
1. Destination listener 0.0.0.0/0:* created by PerformanceL4 VS with SNAT Pool set to None, pool member 10.10.20.1
2. Source listener created by SNAT object let's say origin 192.168.1.1, translation 10.10.20.10
Packets received (assuming Address Translation enabled in VS):
1. S: 192.168.1.2 D:10.10.10.1 - on egress S: 192.168.1.2 D:10.10.20.1
2. S: 192.168.1.1 D:10.10.10.1 - on egress S: 10.10.20.10 D:10.10.20.1 - SNAT source listener working
Can't see any precedence to be evaluated in above
Now let's have another scenario:
1. Destination listener 0.0.0.0/0:* created by PerformanceL4 VS with SNAT Pool set to Auto Map (selfIP 10.10.20.100), pool member 10.10.20.1
2. Source listener created by SNAT object let's say origin 192.168.1.1, translation 10.10.20.10
3. Source listener created for 0.0.0.0/0 by VS?
Packets received (assuming Address Translation enabled in VS):
1. S: 192.168.1.2 D:10.10.10.1 - on egress S: 10.10.20.100 D:10.10.20.1 - Auto Map enganged
2. S: 192.168.1.1 D:10.10.10.1 - on egress S: 10.10.20.100 D:10.10.20.1 - SNAT source listener for SNAT object ignored, used Auto Map listener from VS
Here I can see precedence - so even if source IP matches SNAT object origin still Auto Map is used.
Or Maybe I am completely lost here?
By the way, what is a point for disabling Address Translation for VS that is using pool? I assume that VS will only work if VIP and pool member IPs are in the same network. In other case when dest IP will not be translated packet will not reach pool member. What could be a real life scenario to use VS with disabled Address Translation?
Piotr