For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jmanya_44531's avatar
jmanya_44531
Icon for Nimbostratus rankNimbostratus
May 27, 2014

LTM-New net segments LB+SNAT

Hello guys, please I'll appreciate your help with this.

 

I have an LTM which is load balancing outbound traffic through three ISP links by using a 0.0.0.0:0 virtual server. Such virtual server has a pool whose members are the three ISP routers. Everything is fine, but we have acquired one new network segment for each ISP (there is a gateway for each new segment), so now there are two net segments for each ISP, total 6.

 

I need to load balance only the traffic leaving from one mail server through those 6 net segments while preserving the old load balancing environment (navigation, other services, etc leaving from the original 3 net segments). Moreover, I need to apply a SNAT which translates the mail server's private IP into one public IP from the 6 segments (3 old + 3 new).

 

I have created a new pool with the 3 new segments called pool_gateway_internet_2. I also created an iRule as follows:

 

  • when CLIENT_ACCEPTED {

     

    if {[IP::addr [IP::client_addr] equals Private_IP/32]}{

     

    pool pool_gateway_internet_2

     

    pool pool_gateway_internet_1

     

    snatpool snat_mail_server_to_6_providers

     

    } }

     

  • pool_gateway_internet_1 is the original/old pool.

     

  • snat_mail_server_to_6_providers contains public IPs from all the net segments (old+new).

It is possible such configuration? I do not want to add the 3 new routers in the original pool due to the whole traffic will be load balanced through the 6 segments, which is not what I want.

 

Thanks in advance.

 

Regards

 

Luis

 

1 Reply

  • Specifying two pools in the iRule won't work. I'd recommend you change your pool_gateway_internet_2 pool to use all six gateways. Then only specify that pool on your iRule for a match against your email server IP address:

    when CLIENT_ACCEPTED {
    if {[IP::addr [IP::client_addr] equals Private_IP/32]}{
     pool pool_gateway_internet_2
     snatpool snat_mail_server_to_6_providers
     } 
    }