For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alex_McCollom_8's avatar
Alex_McCollom_8
Icon for Nimbostratus rankNimbostratus
Jun 29, 2005

Sending outbound traffic via particular IP (what should be a simple NAT isn't)

I hope this is the last stop in what has been a frustrating experience. I have two very simple requirements from my BIGIP/Link Controller 4.5.11 system:

 

 

1) To be able to send Internet-bound traffic from a particular internal host out via a particular external IP, as opposed to being sent from one of the default SNAT addresses. Basically, I just need to NAT an inside host to an external IP. Sounds easy, but the LC ignores the NAT the BIGIP performs and will load balance the traffic down the wrong ISP line.

 

 

2) To be able to send traffic from a particular internal host via a particular ISP (as opposed to having the traffic load balanced out one of the multiple ISP lines connected).

 

 

This should be easy to do (other balancers have no problem doing this) but the BIGIP/LC combination seems unable to do so. Tech support has come up with a few suggestions, but non of them are workable. Their last suggestion was to come here and find out of this can be done via an iRule. I understand how to work with iRules, but since they're bound to a virtual server, they seem only to be useful in inbound as opposed to outbound traffic scenarios.

 

 

I'd be happy to provide whatever other information is necessary. Thanks to anyone who can shed some light on this problem.

 

 

Note: why is something like this even necessary? Well, for example, there are government run sites which provide weather data that only allow a single IP from each company to access the service. So, I need to make sure requests coming from the servers responsible for fetching the data come out from a single IP address (NAT) as opposed to coming out from a potential of three addresses (one from each ISP) as happens with regular SNAT/load balancing.

 

1 Reply

  • bknotwell_12713's avatar
    bknotwell_12713
    Historic F5 Account
    Hi Alex--

     

     

    While I'm not exactly sure I understand your question, I think you'd benefit from something like this (untested):

     

     

    o create a single member snatpool

     

    o create a multi-purpose snatpool

     

    o create a pool with a forwarding attribute

     

    o create a rule that checks the appropriate http variable (http_host or http_uri). NB: matches will use the single member snatpool while non-matches will use the normal snatpool. Furthermore, it will *also* reference the forwarding pool

     

    o associate this rule with an appropriate wildcard vip on the internal side