SNAT conflict with MoveIT software

I would assume the app is blocking by source IP when a client fails five attempts. IP-based logic doesn't work so well when some/all of your clients are connecting from behind a proxy. You could configure the BIG-IP to insert the original client IP address in a custom header. But you would need to instruct the app to parse that header instead of the source IP on the TCP packets. I'm guessing you don't have that ability.

 

 

The other option would be to set the default gateway of the app servers to the floating self IP address of the BIG-IP and then remove the SNAT. The BIG-IP would then use the original client IP address as the source for packets it sends to the web servers.

 

 

Aaron