Forum Discussion
Jure_Simsic_106
Nimbostratus
Jan 08, 2007NAT-like Virtual Server
I have a problem I need to solve. We have our DMZ (net A) with some
nodes and a BigIP, with a private net (net B) behind, with load
balanced servers there - standard configuration.
Now I have a need to do load balancing (actually just fail-over) on
some systems in A that couldn't be moved to B. These systems have
their default gateway set to the firewall and that can't be
changed. What I'd need would be an IP on the LB, that would make
requests to nodeA1 or nodeA2 with source IP of the LB, so the boxes
would be able to route the traffic correctly - that is, back to LB and
from here on back to the client.
As in:
Client -> LB-VIP-A -> nodeA(1|2) -> LB-VIP-A -> Client
[request] [response]
This is needed for internal requests from clients within net A, so
unless I can rewrite SRC, the response (syn ack) would go directly to
client and the handshake would never be completed (as in client is
sending to some virtual IP on LB and getting a response back from
another IP)..
A basic version of this could be done as NAT, but i'd like to have a
monitor on for services for fail over and use just one server node at a time, not round-robin. Should I do a standard Virtual
Server and rewrite the srcIP with irules or is there another way to
handle such requests?
So in case of Irules, how would I manage to rewrite the response back to original client IP (dst IP), that information would get lost i guess..
- hoolio
Cirrostratus
Hello, - Jure_Simsic_106
Nimbostratus
I guess that sounds just like something I want. I didn't know about the SNAT automap feateure and will look into it at once.. Thanks - JRahm
Admin
We typically snat on the virtual itself by building a snatpool with the virtual server itself as the lone pool member. We do this for troubleshooting purposes and so that only monitor traffic occurs on the self ips.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects