outbound traffic for specific url by using specific IP

Ok...I get it works but not exactly what I want. I still want to know whether I can get help from here.

Here is what I have done but only for https traffic. I have two VS. VS1 - all outbound traffic for all pool members by using IP1 on snat1. VS2 - all outbound https traffic for all pool members by using IP2 on snat2. All pool member are using F5 to be the default gateway.

VS1 setup as below.

1. VS type - performance layer4.
2. Source - 0.0.0.0/0.
3. Destination - network - 0.0.0.0/0.0.0.0 and all ports.
4. snat - using snat1.
5. no pool members.

VS2 set up as below.

1. VS type - performance layer4.
2. source - 10.100.8.0/22 - this is my DMZ where all pool members are.
3. Destination - network - 0.0.0.0/0.0.0.0 and port - 443 .
4. snat - using snat2.
5. no pool members.

Therefore, all https outbound traffic from pool members are using snat2 - IP2. Others outbound traffic from pool members are using snat1 - IP1.

I want to know how to set up ONLY specific URL like https://www.yahoo.com outbound traffic by using snat2 and the others are using snat1 (including others URL https).

Firstly, I assume you are using SSL offloading. If so, you cannot use a "Performance (L4)" VS for this; clientssl requires a Standard VS. However, if you are using SSL offloading, and going to public locations (like www.yahoo.com) then you must use Proxy SSL or an SSL Forward Proxy with a set of wildcard certificates signed by a local CA trusted by the clients.

Anyhow, here is a configuration that should get you at least close to what you want. I am assuming that 10.10.212.200 is the default gateway for the BIG-IP:

 These are the two SNAT addresses you want, each in its own pool
ltm snatpool snat-pool-01 { members { 10.10.212.105 } }
ltm snatpool snat-pool-02 { members { 10.10.212.125 } }

 This is the pool to be used in the port 80 case.  It points to the BIG-IP's
 default gateway (10.10.212.200, in my setup)
ltm pool pool-gateway-01 {
    members {
        10.10.212.200:any {
            address 10.10.212.200
            session monitor-enabled
            state up
        }
    }
    monitor gateway_icmp 
}

 This is the iRule applied to the port 80 VS that selects the second SNAT IP
 if the host destination is www.yahoo.com
ltm rule rul-select-snat {
    when HTTP_REQUEST {
    if { [HTTP::host] eq "www.yahoo.com" } { 
        snatpool snat-pool-02
    }
}

 This is the wildcard VS.  You might as well make it a forwarding VS.
ltm virtual vs-forwarding {
    destination 0.0.0.0:any
    ip-forward
    mask any
    profiles {
        fastL4 { }
    }
    source 0.0.0.0/0
    source-address-translation {
        pool snat-pool-01
        type snat
    }
    translate-address disabled
    translate-port disabled
    vlans {
        external
    }
    vlans-enabled
    vs-index 5
}

 This is the port 80 wildcard address VS that is only used by
 the subset of hosts as you wish.  Notice that the default
 SNAT address is the same as the other VS (snat-pool-01).  The
 iRule selects the other snat address (snat-pool-02) if the
 particular host matches.
ltm virtual vs-http-01 {
    destination 0.0.0.0:http
    ip-protocol tcp
    mask any
    pool pool-gateway-01
    profiles {
        clientssl {
            context clientside
        }
        http { }
        mptcp-mobile-optimized { }
    }
    rules {
        rul-select-snat
    }
    source 10.100.8.0/22
    source-address-translation {
        pool snat-pool-01
        type snat
    }
    vlans {
        external
    }
    vlans-enabled
    vs-index 6
}

Firstly, I assume you are using SSL offloading. If so, you cannot use a "Performance (L4)" VS for this; clientssl requires a Standard VS. However, if you are using SSL offloading, and going to public locations (like www.yahoo.com) then you must use Proxy SSL or an SSL Forward Proxy with a set of wildcard certificates signed by a local CA trusted by the clients.

Anyhow, here is a configuration that should get you at least close to what you want. I am assuming that 10.10.212.200 is the default gateway for the BIG-IP:

 These are the two SNAT addresses you want, each in its own pool
ltm snatpool snat-pool-01 { members { 10.10.212.105 } }
ltm snatpool snat-pool-02 { members { 10.10.212.125 } }

 This is the pool to be used in the port 80 case.  It points to the BIG-IP's
 default gateway (10.10.212.200, in my setup)
ltm pool pool-gateway-01 {
    members {
        10.10.212.200:any {
            address 10.10.212.200
            session monitor-enabled
            state up
        }
    }
    monitor gateway_icmp 
}

 This is the iRule applied to the port 80 VS that selects the second SNAT IP
 if the host destination is www.yahoo.com
ltm rule rul-select-snat {
    when HTTP_REQUEST {
    if { [HTTP::host] eq "www.yahoo.com" } { 
        snatpool snat-pool-02
    }
}

 This is the wildcard VS.  You might as well make it a forwarding VS.
ltm virtual vs-forwarding {
    destination 0.0.0.0:any
    ip-forward
    mask any
    profiles {
        fastL4 { }
    }
    source 0.0.0.0/0
    source-address-translation {
        pool snat-pool-01
        type snat
    }
    translate-address disabled
    translate-port disabled
    vlans {
        external
    }
    vlans-enabled
    vs-index 5
}

 This is the port 80 wildcard address VS that is only used by
 the subset of hosts as you wish.  Notice that the default
 SNAT address is the same as the other VS (snat-pool-01).  The
 iRule selects the other snat address (snat-pool-02) if the
 particular host matches.
ltm virtual vs-http-01 {
    destination 0.0.0.0:http
    ip-protocol tcp
    mask any
    pool pool-gateway-01
    profiles {
        clientssl {
            context clientside
        }
        http { }
        mptcp-mobile-optimized { }
    }
    rules {
        rul-select-snat
    }
    source 10.100.8.0/22
    source-address-translation {
        pool snat-pool-01
        type snat
    }
    vlans {
        external
    }
    vlans-enabled
    vs-index 6
}

Hi,

if you are not using SSL offloading, you can try to inspect client data and search SNI in SSL negotiation.

the following question / answer can help you.

https://devcentral.f5.com/questions/match-ssl-sni-and-redirect-ssl-traffic-without-ssl-termination

Can anyone review the info https://devcentral.f5.com/questions/i-rule-help-route-incoming-traffic-based-on-source-subnet-amp-url-contains-string-admin-or-intra & help me fix the issue ...thanks!