Forum Discussion
Ed_Summers
Nimbostratus
NimbostratusListener order-of-precedence and SOL9038
I find myself confused on the wording of SOL9038 and appreciate any information that can clarify acutal LTM operation with respect to traffic that matches both a source and destination listener.
...
Ed_SummersNimbostratus
NimbostratusThank you nitass. I also confirmed separately with user 'What Lies Beneath'. I guess my original understanding was formed based on first reading the OOP for destination listeners, which would be mutually-exclusive; i.e. The system can only match and execute one destination listener.
Progressing from this I assumed the same for source vs. destination listeners, but after testing and multiple outside confirmations I now see where my understanding was incorrect. I would offer that the SOL language should state "When a connection matches both a source and a destination listener object, the BIG-IP LTM system places a higher precedence on the destination listener parameters" or something similar, rather than the term "object". To me that implies an all-or-nothing config.
Again - appreciate your support!
dragonflymr
Cirrostratus
CirrostratusI was thinking about this after writing above reply. Seems that it is more or less babble :-(.
I think SOL is right using term "source listener object".
SNAT is object. It can process packets on it's own. Mentioned sentence can be translated to such situation:
1. There is SNAT defined with some origin IP
2. There is VS defined with whatever broad VIP definition - like any network/any port
If there is packet with destination IP matching VIP and source IP matching SNAT origin it will be always processed by VS object not by SNAT object.
Separate issue is how it will be processed by VS object when VS has not SNAT enabled. In case of D_IP and S_IP match and no SNAT defined in VS object SNAT will work for VS no on its own. I mean packet will be processed by VS in regards to D_IP translation but SNAT object will perform S_IP translation for VS.
Other level of precedence here is SNAT definition in VS and SNAT object. When VS has no SNAT config SNAT object will provide SIP translation. If VS object has SNAT configured, VS setting will always override SNAT object. I mean that S_IP will be translated according to SNAT config in VS not according to SNAT object config.
Example:
VS defined without any SNAT, SNAT defined with IP A
When packet matching both VIP and IP A will be received S_IP will be change to translate IP defined in SNAT object.
However for the same packet with for example Auto Map set in VS, S_IP will be translated to selfIP of the network where pool members are located. So we have precedence related to SNAT object and SNAT config in VS here - quite other story than precedence for VS object and SNAT object.
Hope it makes sense, especially that I am not native English speaker and novice in are of LTM.
Piotr