For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Doran_Lum_13484's avatar
Doran_Lum_13484
Icon for Nimbostratus rankNimbostratus
Dec 02, 2015

Overall steps of how traffic packets flow

Hi all, I have a F5 LTM 8900 with SNAT IP list in our enviornment. Can I confirm a simple overview of how a traffic packets flow below would be correct ?

 

The user initiates a connection by entering a URL into a Web browser.

 

The browser resolves the URL to a virtual server address that have already been created on F5. This virtual server address is the Destination IP Address header in each packet.

 

F5 examines the virtual server configuration and determines the pool of servers to which to send the request.

 

F5 examines the pool configuration to determine the load balancing algorithm to use to select a node server.

 

In the Destination IP Address header of the packets, F5 changes the destination IP address to the SNAT IP. The source address in the packet header (that is, the address of the client that initiated the connection) remains unchanged.

 

The F5 system sends the incoming packets to the selected server via the SNAT IP.

 

When the server node sends its response back to the client, the response returns through the F5 SNAT IP and a reverse translation occurs. In the Source IP Address header of the response packets, the BIG-IP system changes the actual source IP address of the response (server address) to the SNAT IP address. This causes the source IP address in the response to match the original destination address in the request, a requirement necessary to ensure that the client accepts the response.