SNAT for Specific Subnet

This should help

 

 

when CLIENT_ACCEPTED {

 

if { [IP::addr [IP::remote_addr] equals 10.0.0.0/8] } {

 

snat automap

 

} else {

 

return

 

}

 

}

An SNAT is specified at the Virtual Server level, not the Pool or Member level. An iRule would be your best bet, something like this;

when CLIENT_ACCEPTED {
 if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } {
  Use SNAT Automap if client IP is in this range
  snat automap
  Alternatively, specify a SNAT Pool instead
  snatpool name
  Stop processing the iRule for this event
  return
  }
 else {
  Stop processing the iRule for this event if no match
  return
  }
}

Sorry Ajmaluddin, didn't spot your post till I'd saved mine.

Hi,

 

 

But we have only option to enable SNAT on pool level not on VIP level. let me correct if i am wrong

 

 

 

Thanks

 

A.N

You can only SNAT at the VIP level. However, if you specify a pool within an iRule you can SNAT differently per pool. Please clarify your requirements.

yes. i am looking for VIP level.

 

 

Thanks for your help

 

 

 

 

just last question . can we add two subnet as source in same IRULE . Like 10.0.0.0/8 and 192.168.2.0/24

 

 

 

 

 

 

Thanks & Regards

 

 

A.N

Great. You could add a second like this, there a few other ways you could do it too;

when CLIENT_ACCEPTED {
 if { (([IP::addr [IP::client_addr] equals 10.0.0.0/8]) or ([IP::addr [IP::client_addr] equals 192.168.2.0/24 ])) } {
  Use SNAT Automap if client IP is in this range
  snat automap
  Alternatively, specify a SNAT Pool instead
  snatpool name
  Stop processing the iRule for this event
  return
  }
 else {
  Stop processing the iRule for this event if no match
  return
  }
}

This is a longer method but allows for different actions based on the source subnet;

when CLIENT_ACCEPTED {
 if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } {
  Use SNAT Automap if client IP is in this range
  snat automap
  Stop processing the iRule for this event
  return
  }
 elseif { [IP::addr [IP::client_addr] equals 192.168.2.0/24] } {
  snatpool name
  Stop processing the iRule for this event
  return
  }
 else {
  Stop processing the iRule for this event if no match
  return
  }
}