Forum Discussion
zhu_shaofeng_14
Nimbostratus
Dec 25, 2013NAT and VS Forwarding Issue
Hi:
I have one server need to access WAN and Internet, I create one VS Forwarding for WAN and One NAT for Internet,
The LTM has three interface, one for internal, one for WAN, and one for Intern...
- Dec 25, 2013
e.g.
nat root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm nat nat1 ltm nat nat1 { inherited-traffic-group true originating-address 200.200.200.101 traffic-group traffic-group-1 translation-address 172.28.20.15 vlans { internal } vlans-enabled } virtual server root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual wildcard ltm virtual wildcard { destination any:0 mask any profiles { fastL4 { } } rules { myrule } source 0.0.0.0/0 translate-address disabled translate-port disabled vlans { internal } vlans-enabled vs-index 26 } irule to send wan and internet to corresponding gateway root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm rule myrule ltm rule myrule { when CLIENT_ACCEPTED { if { [IP::addr [IP::local_addr] equals 172.28.26.0/24] } { pool wangw } else { pool netgw } } } wan gateway root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool wangw ltm pool wangw { allow-nat no members { 172.28.20.16:0 { address 172.28.20.16 } } } internet gateway root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool netgw ltm pool netgw { members { 172.28.20.254:0 { address 172.28.20.254 } } } internet traffic (source ip is nated to 172.28.20.15) [root@ve11a:Active:In Sync] config tcpdump -nni 0.0 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 08:39:20.714137 IP 200.200.200.101.46442 > 192.168.206.171.80: S 1529194290:1529194290(0) win 5840 08:39:20.714270 IP 172.28.20.15.46442 > 192.168.206.171.80: S 1529194290:1529194290(0) win 5840 wan traffic (source ip is not nated) [root@ve11a:Active:In Sync] config tcpdump -nni 0.0 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 08:40:15.302032 IP 200.200.200.101.59834 > 172.28.26.70.80: S 3450625808:3450625808(0) win 5840 08:40:15.304022 IP 200.200.200.101.59834 > 172.28.26.70.80: S 3450625808:3450625808(0) win 5840
nitass
Employee
Dec 25, 2013But Must I create two VS?
One VS for Forwarding (WAN), One NAT (Internet) will not work?
nat creates both source and destination listener objects. so, it will be applied to wan traffic.
sol9038: The order of precedence for local traffic object listeners
http://support.f5.com/kb/en-us/solutions/public/9000/000/sol9038.html
to disable nat for wan traffic, you can disable allow-nat under wan gateway pool configuration.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
