For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AP_129594's avatar
AP_129594
Icon for Nimbostratus rankNimbostratus
Mar 03, 2014

SNAT pass Destination IP back to Client

I have a web services running on port 443. The incoming traffic from "Client server -> F5 -> Back-end Servers" is working fine, but the outbound response to the Client Server is not working. So we have learned that the Client Server required the same IP address from whichever F5 route to the Back-end server must response back to the Client Server instead of the VIP. We sort of circumvent it by creating a host file on each back-end server that map to the VIP DNS.

 

Has anybody done an iRule that could solve this problem?

 

application delivery
devops
iRules

1 Reply

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Mar 03, 2014

    The text format of the comments is just painful to watch, so I'll put this in an answer.

     

    Sorry, but I don't know if I got your scenario. Is it like this?

     

    1. Client server contacts the VIP,
    2. The F5 chooses a pool member (does it have to use any SNAT when connecting to the member?).
    3. The pool member receives the response and then sends it back to the client server via the F5.
    4. You now want the F5 to replace the source address of the return packet with that of the selected member?

    /Patrik