Forum Discussion
SNAT persistency
i want to achieve the following:
1) I want the F5 to choose an IP in round-robin manner from a SNAT pool and to persist using the same IP from the SNAT pool in case an HTTP header called "Username" value is the same.
2) Every HTTP request which will come in less than 5 minutes with the same "username" header value should receive the same SNAT IP from the pool. additionally that SNAT IP must be marked as "used" so that no other "username" will get this SNAT IP (unless 5 minutes has passed with no HTTP request with the same username value. after the 5 minutes that SNAT IP can be available again in the pool).
3) I want the F5 to chop off the username header before forwarding the HTTP request using the SNAT IP.
4) I want the F5 to log every NAT action it does to some syslog server (like: = )
Example:
SNAT pool is 192.118.0.0/16 and the Username possible values can be any string.
HTTP request arrives from source IP 172.16.1.1 with header “Username: aaa”
F5 will replace the source IP 172.16.1.1 to be 192.118.0.1
After less than 5 minutes another HTTP request arrives from source IP 172.16.1.1 with header “Username: aaa”
F5 will replace the source IP 172.16.1.1 to be 192.118.0.1
After less than 5 minutes HTTP request arrives from source IP 172.16.1.1 with header “Username: bbb”
F5 must not replace the source IP to be 192.118.0.1 as it is taken by username aaa.
After more than 5 minutes another HTTP request arrives from source IP 172.16.1.1 with header “Username: aaa”
F5 can replace the source IP 172.16.1.1 to be other than 192.118.0.1 (for example: 192.118.0.2)
Hope it is clear enough, if not please comment.
Thanks in advance,
Yaniv
- Steve_Brown_882Historic F5 AccountThis is a fairly large list of requirements and unless I am missing something m,ay be fairly complex to implement. I will try to address as many of the pieces as I can here.
- Steve_Brown_882Historic F5 AccountAlright, I decided to give this a try. I am sure this irule probably needs some work yet, and it may not be the most efficient, but I think it comes close do doing what you are looking for.
when HTTP_REQUEST { Set var with username header set uname [HTTP::header "username"] set clname "snatpool_class" set searchID [class startsearch "snatpool_example" ] Check to see if the uname already has a snat if { [table lookup -subtable "snat_table" $uname] ne "" } { set snatpool_member [table lookup -subtable "snattable" $uname] } else { while { [class anymore $clname $searchID] } { look up an ip from the class set snatpool_member [class nextelement -value $clname $searchID] check to see if the IP has been assigned yet if { [table lookup -subtable "snat_table" -notouch $snatpool_meember] eq "" } { add snat assignement to tables table set -subtable "snat_table" $snatpool_member $uname 300 table set -subtable "snat_table" $uname $snatpool_member 300 local log entry this should be changed to a highspeed log off box. log local0.info "Snat assignment of $snatpool_member made to $uname" } } } snatpool mysnatpool member $snatpool_member HTTP::header remove "username" }
- Yaniv_99962NimbostratusThank you so much Steve!
- Steve_Brown_882Historic F5 AccountHi Yaniv,
- Yaniv_99962NimbostratusThanks Steve,
- Yaniv_99962Nimbostratusi added the 2nd line here for debugging:
So I changes "-value" to be "-name" and now the log looks better:
Mar 23 08:55:47 local/tmm2 info tmm2[5251]: Rule Snat_Persist : Snat assignment of 10.107.200.202/32 made to ccc
I'll keep looking into that...
Thanks
- Yaniv_99962Nimbostratusme again :)
- Steve_Brown_882Historic F5 AccountThe /32 is in your data group? If so I would suggest switching from an IP data group to a string and simply put a single IP without the mask on each line.
- Yaniv_99962NimbostratusAwesome!
- Steve_Brown_882Historic F5 AccountActually I just did some poking around and found this VERY COOL iRule that Joe wrote for manipulating the session table. It builds a page that allows you to view, edit, import, export the session table all inside of the iRule. He has a really good write up and a video demo.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com