Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Oct 28, 2009

SNAT to designated Pool Members without iRule

I know this is asking a lot...

 

 

Consider a pool with two pool members. One member is in a LTM VLAN, and another is not. If I envision this correctly in my head, forwarding will fail to the member which is not in the LTM VLAN. I am wondering if it's possible to enable a SNAT to only a pool member which needs it (i.e. not in a LTM VLAN). But here's the trick - I want to find out if it's possible to do this without an iRule.

 

 

To give you some color, we are considering how the LTM might allow us to load-balance pool members who are in different physical data centers. Those two data centers do not share the same IP network or VLAN. One of those data center networks is routed by the LTM, and the other is not. I am trying to figure out if its possible to route to both pool members when one is in a BigIP VLAN and the other not. I assume I would need SNAT to the member which is not in the BigIP VLAN. But we have so much traffic routed through the LTM that we will bring the it down if we force every session to be processed by an iRule.
config
design
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 28, 2009
    Hi Scott,

     

     

    I think you'll need an iRule as the SNAT configuration you can add to a virtual server doesn't allow you to enable SNAT based on destination IP addresses/subnets.

     

     

    A selective SNAT iRule should be relatively low overhead and provide the functionality you're needing without having to explicitly define which pool members need SNAT and which ones don't:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/SelectiveSNAT.html

     

     

    You could try adapting this to check if the LB::server addr is not in the same subnet as the self IP address that will be used to SNAT the request. You'd probably need to hardcode this subnet in the iRule.

     

     

    Aaron