For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JohnQuintas_910's avatar
JohnQuintas_910
Icon for Nimbostratus rankNimbostratus
Oct 16, 2015

SNAT outbound connections from pool members to virtual server IP for a specific outbound port

I have a virtual server for inbound ftp connections Virtual server: 1.1.1.1:21, using the standard FTP profile and source_addr persistence, 30 min timeout Pool Members: 10.0.0.10:21 10.0.0.11:...
application delivery
LTM
JohnQuintas_910's avatar
JohnQuintas_910
Icon for Nimbostratus rankNimbostratus
Oct 21, 2015

Can I have multiple IP forwarding virtual servers if I have a wildcard source / wildcard destination / wildcard port in place already?

(1) IP forwarding virtual server 1 - source: 0.0.0.0, destination: 0.0.0.0, any port (already in place to allow full routing)

(2) IP forwarding virtual server 2 - source: 10.0.0.0/24, destination: 0.0.0.0, port 21 with the following irRule applied:

when CLIENT_ACCEPTED {
    if { [TCP::client_port] == 21] }{
    switch [IP::addr [IP::client_addr] mask 255.255.255.255]
            "10.0.0.10" { snat 172.18.1.1 } 
            "10.0.0.11" { snat 172.18.1.1 }
            "10.0.0.12" { snat 172.18.1.2 }
            "10.0.0.13" { snat 172.18.1.2 }
            "10.0.0.14" { snat 172.18.1.3 }
            "10.0.0.15" { snat 172.18.1.3 }
    }
}

(3) IP forwarding virtual server 3 - source: 10.0.0.0/24, destination: 0.0.0.0, port 22 with the following iRule applied:

when CLIENT_ACCEPTED {
    if { [TCP::client_port] == 22] }{
    switch [IP::addr [IP::client_addr] mask 255.255.255.255]
            "10.0.0.10" { snat 172.18.1.1 } 
            "10.0.0.11" { snat 172.18.1.1 }
            "10.0.0.12" { snat 172.18.1.2 }
            "10.0.0.13" { snat 172.18.1.2 }
            "10.0.0.14" { snat 172.18.1.3 }
            "10.0.0.15" { snat 172.18.1.3 }
    }
}