For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

yammy1688_99834's avatar
yammy1688_99834
Icon for Nimbostratus rankNimbostratus
Feb 11, 2011

SNAT vs Auto-map

Any advantage to setting up SNATs versus just using the auto-map function in the virtual server?     Thanks,       -Ken  
config
design
Chris_Miller's avatar
Chris_Miller
Icon for Altostratus rankAltostratus
Feb 11, 2011
Posted By hoolio on 02/11/2011 02:11 PM

 

With 10.x tcpdump, you can also see the virtual server name in the packets. This line shows a SNAT to pool member SYN which was via the http_10.1.0.15_vs virtual server:

 

 

14:05:19.472966 IP 10.1.0.11.50954 > 10.1.0.100.http: S 3232923316:3232923316(0) win 4380 out slot1/tmm0 lis=http_10.1.0.15_v

 

 

A VS specific SNAT pool is still useful, but figured I'd throw this out there too.

 

 

Aaron

 

Was referring more to firewalls, Netflow, etc...boxes that only care about IP/Port. Still, very cool reminder. I noticed that once and didn't think anything of it. Didn't even consider the application at the time.