For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ADC18's avatar
ADC18
Icon for Nimbostratus rankNimbostratus
Aug 23, 2018

SNAT=None client source IP is self IP

I am trying to setup non-HTTP vServer. End server needs to see client source IP. After disabling SNAT ( SNAT=NONE), I am getting source IP as Self IP. End server GW is pointing to Self-IP. Why sour...
application delivery
BIG-IP
LTM
Martin_Šebek_58's avatar
Martin_Šebek_58
Icon for Nimbostratus rankNimbostratus
Aug 23, 2018

Where do you see a self ip as a source? If SNAT is not set the only traffic sourcing from self ip should be monitors testing availability of the nodes (backend servers).

 

  • ADC18's avatar
    ADC18
    Icon for Nimbostratus rankNimbostratus
    Aug 23, 2018

    This was my vserver config ( created http vserver to test) - (Active)(tmos) list ltm virtual mo_test_80-vs ltm virtual mo_test_80-vs { destination 10.4x.x.2:http ip-protocol tcp mask 255.255.255.255 persist { motTest { default yes } } pool mo_test-80 profiles { fasthttp { } } snatpool Default-SNAT }

     

    Changed to ltm virtual mo_test_80-vs { destination 10.x.x2:http ip-protocol tcp mask 255.255.255.255 persist { motTest { default yes } } pool mo_test-80 profiles { fasthttp { } } }

     

    I am getting source IP as per default-SNAT. I have changed monitor interval to 1000 second so it is not monitor traffic.

     

  • Martin_Šebek_58's avatar
    Martin_Šebek_58
    Icon for Nimbostratus rankNimbostratus
    Aug 23, 2018

    Ok. In this case I would use tcpdump to sniff through the traffic and see what is going on. Regarding the configuration you posted. It looks somewhat strange as I would expect snatpool definition within source-address-translation.

     

    What version are you running?