NAT for whole internal subnet

You can't restrict the destination IP addresses with a SNAT itself. But you could use packet filters to limit which destination addresses/subnets/ports the SNAT translation IP can connect to. You can check the LTM config guide for your version for details on packet filters.

 

 

Or you could use a forwarding virtual server with a FastL4 profile. With a forwarding VIP you can use an iRule to restrict source and destination subnets/hosts/ports. There are a few examples of this in the Codeshare (Click here):

 

 

AccessControlBasedOnIP - This iRule forwards traffic based on "trusted" source addresses.

 

AccessControlBasedOnNetworkOrHost - This iRule allows administrators to allow or deny access to a virtual server based IP/networks and ports.

 

 

Aaron