Forum Discussion

Enfield303's avatar
Enfield303
Icon for Nimbostratus rankNimbostratus
Dec 31, 2020

Persistence and NAT

Hello, we're using an F5 BIG IP active/passive cluster to loadbalance Always On VPN connections. To avoid asymmetric routing we're using NAT, so the VPN gateway servers will always see the same IP ad...
application delivery
BIG-IP
persistence
Amine_Kadimi's avatar
Amine_Kadimi
Icon for MVP rankMVP
Jan 09, 2021

Yes yes, sure. Picking the pool member (either from a persistence entry or as a result of the LB algorithm) will occur before the SNAT, so F5 will base its traffic forwarding on the actual IP it sees in the ingress packet.

And regarding the mask 255.255.255.255 this is just a mean to share persistence entries between multiple same subnet hosts, so by putting 255.255.255.255 you basically tell the F5 to create a persistence record for each unique host.

(Note: as I mentioned in my 1st answer, this assumes you don't have an upstream device -before F5- that hides the actual user IP, which is a rare but possible scenario)