Hi, I am trying to do SNAT while selecting a specific port for that but for some reason when the F5 receive the response it is sending a RST to the WS and not retranslating it to the original IP and port. I configured the below: when CLIENT_ACCEPTED { set PublicIP 10.107.200.200 snat $PublicIP 12345 } I can see that connection was created: VIRTUAL any <-> NODE 173.194.47.19:80 TYPE any 1/3 CLIENTSIDE 10.107.200.140:51251 <-> 173.194.47.19:80 (pkts,bits) in = (2, 120) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.19:80 (pkts,bits) in = (0, 0) out = (2, 120) PROTOCOL 6 UNIT 1 IDLE 2 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 This the tcpdump from the F5: 19:22:02.182260 IP 10.107.200.200.12345 > 173.194.47.19.80: S 1731136945:1731136945(0) win 5840 19:22:02.264415 IP 173.194.47.19.80 > 10.107.200.200.12345: S 718544173:718544173(0) ack 1731136946 win 1460 19:22:02.264439 IP 10.107.200.200.12345 > 173.194.47.19.80: R 1:1(0) ack 1 win 0 Do you have any idea why the F5 behave in that way? Thanks a lot.

was syn-ack coming to correct vlan? what version are you running? if it is 10.2.3+, you may try to log tcp rst packet. sol13223:Configuring the BIG-IP system to log TCP RST packets http://support.f5.com/kb/en-us/solutions/public/13000/200/sol13223.html this is mine. [root@ve10:Active] config b virtual bar list virtual bar { pool gw destination any:any mask 0.0.0.0 ip protocol 6 rules myrule } [root@ve10:Active] config b pool gw list pool gw { members 172.28.19.254:any {} } [root@ve10:Active] config b rule myrule list rule myrule { when CLIENT_ACCEPTED { snat 172.28.19.252 1234 } } [root@ve10:Active] config b snat translation list snat translation 172.28.19.252 {} tcpdump [root@ve10:Active] config tcpdump -nni 0.0 -s0 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes 09:20:11.103550 IP 200.200.200.101.60204 > 172.28.19.251.80: S 4212438457:4212438457(0) win 5840 in slot1/tmm0 lis= 09:20:11.103603 IP 172.28.19.251.80 > 200.200.200.101.60204: S 2784638521:2784638521(0) ack 4212438458 win 4380 out slot1/tmm0 lis=bar 09:20:11.104573 IP 200.200.200.101.60204 > 172.28.19.251.80: . ack 1 win 46 in slot1/tmm0 lis=bar 09:20:11.104634 IP 172.28.19.252.1234 > 172.28.19.251.80: S 3603285261:3603285261(0) win 4380 out slot1/tmm0 lis=bar 09:20:11.105731 IP 200.200.200.101.60204 > 172.28.19.251.80: P 1:3(2) ack 1 win 46 in slot1/tmm0 lis=bar 09:20:11.105742 IP 172.28.19.251.80 > 172.28.19.252.1234: S 863226244:863226244(0) ack 3603285262 win 5792 in slot1/tmm0 lis=bar 09:20:11.105750 IP 172.28.19.252.1234 > 172.28.19.251.80: . ack 1 win 4380 out slot1/tmm0 lis=bar 09:20:11.105762 IP 172.28.19.252.1234 > 172.28.19.251.80: P 1:3(2) ack 1 win 4380 out slot1/tmm0 lis=bar 09:20:11.106790 IP 172.28.19.251.80 > 172.28.19.252.1234: . ack 3 win 46 in slot1/tmm0 lis=bar 09:20:11.205525 IP 172.28.19.251.80 > 200.200.200.101.60204: . ack 3 win 4382 out slot1/tmm0 lis=bar connection table [root@ve10:Active] config b conn client 200.200.200.101 show all VIRTUAL any <-> NODE 172.28.19.251:80 TYPE any 1/0 CLIENTSIDE 200.200.200.101:60204 <-> 172.28.19.251:80 (pkts,bits) in = (3, 166) out = (2, 116) SERVERSIDE 172.28.19.252:1234 <-> 172.28.19.251:80 (pkts,bits) in = (2, 112) out = (3, 170) PROTOCOL 6 UNIT 1 IDLE 4 (300) LASTHOP internal 00:50:56:b3:01:0b

Hi nitass, Thanks for the response. I am running 10.2.4 HF5, What version you are running? I tried what you suggest and I get the following log: Feb 14 11:46:29 local/tmm2 err tmm2[5586]: 01230140:3: RST sent from 10.107.200.200:12345 to 173.194.47.80:80, [0x11d265d:1751] No local listener I am trying to figure out why the F5 claims that there is no local listener if there is connection on that: [root@LBA-F5-1A:Active] config b conn client 10.107.200.140 show all -n VIRTUAL any <-> NODE 10.115.243.30:53 TYPE any 1/2 CLIENTSIDE 10.107.200.140:41495 <-> 10.115.243.30:53 (pkts,bits) in = (102, 7236) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.30:53 (pkts,bits) in = (0, 0) out = (102, 7236) PROTOCOL 17 UNIT 1 IDLE 54 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 VIRTUAL any <-> NODE 10.115.243.243:53 TYPE any 1/2 CLIENTSIDE 10.107.200.140:41495 <-> 10.115.243.243:53 (pkts,bits) in = (105, 7467) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.243:53 (pkts,bits) in = (0, 0) out = (105, 7467) PROTOCOL 17 UNIT 1 IDLE 3 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 VIRTUAL any <-> NODE 10.115.243.243:53 TYPE any 1/1 CLIENTSIDE 10.107.200.140:54872 <-> 10.115.243.243:53 (pkts,bits) in = (1, 55) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.243:53 (pkts,bits) in = (0, 0) out = (1, 55) PROTOCOL 17 UNIT 1 IDLE 67 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 VIRTUAL any <-> NODE 173.194.47.80:80 TYPE any 1/0 CLIENTSIDE 10.107.200.140:56476 <-> 173.194.47.80:80 (pkts,bits) in = (3, 180) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.80:80 (pkts,bits) in = (0, 0) out = (3, 180) PROTOCOL 6 UNIT 1 IDLE 104 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 This is the virtual server: [root@LBA-F5-1A:Active] config b virtual Allow_Routes list virtual Allow_Routes { srcport change ip forward lasthop pool Last_HOP destination any:any mask 0.0.0.0 rules bbb vlans WDN_MIG_Internal enable } and this is the rule: rule bbb { when CLIENT_ACCEPTED { snat 10.107.200.200 12345 } } By the way in the first time that I tried to open connection it was successfully opened but after that all the attempts failed, including to another destination IP and also after cleaning all the connections on the F5. I can't see any logical reason why it is not working for me as expected :\

I am running 10.2.4 HF5, What version you are running?i am running 10.2.4 hf4. [root@ve10:Active] config b version|grep -iA 1 version BIG-IP Version 10.2.4 655.0 Hotfix HF4 Edition have you checked syn-ack's incoming vlan? was it correct? e.g. tcpdump -e -nni 0.0 -s0 host 173.194.47.80 and port 80

The tcpdump that I am doing is for specific VLAN so for sure that the traffic returns to the same VLAN that it left. Tell me the IP 172.28.19.252 is self IP in your F5?

Tell me the IP 172.28.19.252 is self IP in your F5?no, it is snat translation address. selfip is 172.28.19.253. [root@ve10:Active] config b self 172.28.19.253 list self 172.28.19.253 { netmask 255.255.255.0 vlan external allow default }

Forum Discussion

schmal_111133

Nimbostratus

Feb 13, 2013

specific source port translation

Hi,

I am trying to do SNAT while selecting a specific port for that but for some reason when the F5 receive the response it is sending a RST to the WS and not retranslating it to the original IP and port.

I configured the below:

when CLIENT_ACCEPTED {

set PublicIP 10.107.200.200

snat $PublicIP 12345

}

I can see that connection was created:

VIRTUAL any <-> NODE 173.194.47.19:80 TYPE any 1/3

CLIENTSIDE 10.107.200.140:51251 <-> 173.194.47.19:80

(pkts,bits) in = (2, 120) out = (0, 0)

SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.19:80

(pkts,bits) in = (0, 0) out = (2, 120)

PROTOCOL 6 UNIT 1 IDLE 2 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04

This the tcpdump from the F5:

19:22:02.182260 IP 10.107.200.200.12345 > 173.194.47.19.80: S 1731136945:1731136945(0) win 5840

19:22:02.264415 IP 173.194.47.19.80 > 10.107.200.200.12345: S 718544173:718544173(0) ack 1731136946 win 1460

19:22:02.264439 IP 10.107.200.200.12345 > 173.194.47.19.80: R 1:1(0) ack 1 win 0

Do you have any idea why the F5 behave in that way?

Thanks a lot.

34 Replies

nitass

Employee

Feb 13, 2013

was syn-ack coming to correct vlan?

what version are you running? if it is 10.2.3+, you may try to log tcp rst packet.

sol13223:Configuring the BIG-IP system to log TCP RST packets

http://support.f5.com/kb/en-us/solutions/public/13000/200/sol13223.html

this is mine.

[root@ve10:Active] config  b virtual bar list
virtual bar {
   pool gw
   destination any:any
   mask 0.0.0.0
   ip protocol 6
   rules myrule
}
[root@ve10:Active] config  b pool gw list
pool gw {
   members 172.28.19.254:any {}
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when CLIENT_ACCEPTED {
        snat 172.28.19.252 1234
}
}
[root@ve10:Active] config  b snat translation list
snat translation 172.28.19.252 {}

 tcpdump

[root@ve10:Active] config  tcpdump -nni 0.0 -s0 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:20:11.103550 IP 200.200.200.101.60204 > 172.28.19.251.80: S 4212438457:4212438457(0) win 5840  in slot1/tmm0 lis=
09:20:11.103603 IP 172.28.19.251.80 > 200.200.200.101.60204: S 2784638521:2784638521(0) ack 4212438458 win 4380  out slot1/tmm0 lis=bar
09:20:11.104573 IP 200.200.200.101.60204 > 172.28.19.251.80: . ack 1 win 46  in slot1/tmm0 lis=bar
09:20:11.104634 IP 172.28.19.252.1234 > 172.28.19.251.80: S 3603285261:3603285261(0) win 4380  out slot1/tmm0 lis=bar
09:20:11.105731 IP 200.200.200.101.60204 > 172.28.19.251.80: P 1:3(2) ack 1 win 46  in slot1/tmm0 lis=bar
09:20:11.105742 IP 172.28.19.251.80 > 172.28.19.252.1234: S 863226244:863226244(0) ack 3603285262 win 5792  in slot1/tmm0 lis=bar
09:20:11.105750 IP 172.28.19.252.1234 > 172.28.19.251.80: . ack 1 win 4380  out slot1/tmm0 lis=bar
09:20:11.105762 IP 172.28.19.252.1234 > 172.28.19.251.80: P 1:3(2) ack 1 win 4380  out slot1/tmm0 lis=bar
09:20:11.106790 IP 172.28.19.251.80 > 172.28.19.252.1234: . ack 3 win 46  in slot1/tmm0 lis=bar
09:20:11.205525 IP 172.28.19.251.80 > 200.200.200.101.60204: . ack 3 win 4382  out slot1/tmm0 lis=bar

 connection table

[root@ve10:Active] config  b conn client 200.200.200.101 show all
VIRTUAL any <-> NODE 172.28.19.251:80   TYPE any   1/0
    CLIENTSIDE 200.200.200.101:60204 <-> 172.28.19.251:80
        (pkts,bits) in = (3, 166)   out = (2, 116)
    SERVERSIDE 172.28.19.252:1234 <-> 172.28.19.251:80
        (pkts,bits) in = (2, 112)   out = (3, 170)
    PROTOCOL 6   UNIT 1   IDLE 4 (300)   LASTHOP internal 00:50:56:b3:01:0b

schmal_111133
Nimbostratus
Feb 14, 2013
Hi nitass,

Thanks for the response.

I am running 10.2.4 HF5, What version you are running?

I tried what you suggest and I get the following log:

Feb 14 11:46:29 local/tmm2 err tmm2[5586]: 01230140:3: RST sent from 10.107.200.200:12345 to 173.194.47.80:80, [0x11d265d:1751] No local listener

I am trying to figure out why the F5 claims that there is no local listener if there is connection on that:

[root@LBA-F5-1A:Active] config b conn client 10.107.200.140 show all -n

VIRTUAL any <-> NODE 10.115.243.30:53 TYPE any 1/2

CLIENTSIDE 10.107.200.140:41495 <-> 10.115.243.30:53

(pkts,bits) in = (102, 7236) out = (0, 0)

SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.30:53

(pkts,bits) in = (0, 0) out = (102, 7236)

PROTOCOL 17 UNIT 1 IDLE 54 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04

VIRTUAL any <-> NODE 10.115.243.243:53 TYPE any 1/2

CLIENTSIDE 10.107.200.140:41495 <-> 10.115.243.243:53

(pkts,bits) in = (105, 7467) out = (0, 0)

SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.243:53

(pkts,bits) in = (0, 0) out = (105, 7467)

PROTOCOL 17 UNIT 1 IDLE 3 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04

VIRTUAL any <-> NODE 10.115.243.243:53 TYPE any 1/1

CLIENTSIDE 10.107.200.140:54872 <-> 10.115.243.243:53

(pkts,bits) in = (1, 55) out = (0, 0)

SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.243:53

(pkts,bits) in = (0, 0) out = (1, 55)

PROTOCOL 17 UNIT 1 IDLE 67 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04

VIRTUAL any <-> NODE 173.194.47.80:80 TYPE any 1/0

CLIENTSIDE 10.107.200.140:56476 <-> 173.194.47.80:80

(pkts,bits) in = (3, 180) out = (0, 0)

SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.80:80

(pkts,bits) in = (0, 0) out = (3, 180)

PROTOCOL 6 UNIT 1 IDLE 104 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04

This is the virtual server:

[root@LBA-F5-1A:Active] config b virtual Allow_Routes list

virtual Allow_Routes {

srcport change

ip forward

lasthop pool Last_HOP

destination any:any

mask 0.0.0.0

rules bbb

vlans WDN_MIG_Internal enable

}

and this is the rule:

rule bbb {

when CLIENT_ACCEPTED {

snat 10.107.200.200 12345

}

}

By the way in the first time that I tried to open connection it was successfully opened but after that all the attempts failed, including to another destination IP and also after cleaning all the connections on the F5.

I can't see any logical reason why it is not working for me as expected :\
nitass
Employee
Feb 14, 2013
I am running 10.2.4 HF5, What version you are running?i am running 10.2.4 hf4.

[root@ve10:Active] config b version|grep -iA 1 version BIG-IP Version 10.2.4 655.0 Hotfix HF4 Edition

have you checked syn-ack's incoming vlan? was it correct?

e.g.

tcpdump -e -nni 0.0 -s0 host 173.194.47.80 and port 80
schmal_111133
Nimbostratus
Feb 14, 2013
The tcpdump that I am doing is for specific VLAN so for sure that the traffic returns to the same VLAN that it left.

Tell me the IP 172.28.19.252 is self IP in your F5?
nitass
Employee
Feb 14, 2013
Tell me the IP 172.28.19.252 is self IP in your F5?no, it is snat translation address. selfip is 172.28.19.253.

[root@ve10:Active] config b self 172.28.19.253 list self 172.28.19.253 { netmask 255.255.255.0 vlan external allow default }
schmal_111133
Nimbostratus
Feb 14, 2013
and if you are trying to open few connection in parallel to different sites does it still work?

nitass

Employee

Feb 14, 2013

and if you are trying to open few connection in parallel to different sites does it still work?if it is different site, it works.

[root@ve10:Active] config  tcpdump -nni 0.0 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 108 bytes
21:38:11.510461 IP 200.200.200.101.51936 > 173.194.38.151.80: S 1650621809:1650621809(0) win 5840 
21:38:11.510525 IP 172.28.19.252.1234 > 173.194.38.151.80: S 1650621809:1650621809(0) win 5840 
21:38:11.520674 IP 173.194.38.151.80 > 172.28.19.252.1234: S 1436891886:1436891886(0) ack 1650621810 win 62920 
21:38:11.520686 IP 173.194.38.151.80 > 200.200.200.101.51936: S 1436891886:1436891886(0) ack 1650621810 win 62920 
21:38:11.521651 IP 200.200.200.101.51936 > 173.194.38.151.80: . ack 1 win 46
21:38:11.521662 IP 172.28.19.252.1234 > 173.194.38.151.80: . ack 1 win 46
21:38:23.717489 IP 200.200.200.111.33977 > 206.190.36.45.80: S 669688273:669688273(0) win 5840 
21:38:23.717558 IP 172.28.19.252.1234 > 206.190.36.45.80: S 669688273:669688273(0) win 5840 
21:38:23.932585 IP 206.190.36.45.80 > 172.28.19.252.1234: S 3507817701:3507817701(0) ack 669688274 win 5792 
21:38:23.932599 IP 206.190.36.45.80 > 200.200.200.111.33977: S 3507817701:3507817701(0) ack 669688274 win 5792 
21:38:23.933713 IP 200.200.200.111.33977 > 206.190.36.45.80: . ack 1 win 46 
21:38:23.933721 IP 172.28.19.252.1234 > 206.190.36.45.80: . ack 1 win 46

schmal_111133
Nimbostratus
Feb 14, 2013
So why the hell in my F5 it is not working ?! :(

I tried in 2 different boxes and still experiencing the same thing.. what am I missing??
nitass
Employee
Feb 14, 2013
would you mind opening a support case and let us know the case number?

i think it might be helpful if you can provide support engineer the following data.

1. qkview

2. tcpdump

tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x

x.x.x.x is destination ip

just my 2 cents.
schmal_111133
Nimbostratus
Feb 14, 2013
I opened a case and the number is C1290719, hopefully they will help me.

Thanks a lot for all the help so far :)

DevCentral Quicklinks

* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com

Discover DevCentral Connects

* Podcasts
* Social Channels
* Video Streaming

GitHub Awesome-F5

Forum Discussion

specific source port translation

34 Replies

SSO Login Update Coming to DevCentral

Mohamed - July 2026 Featured F5er

Recent Discussions

F5 XC WAF Automation for Bulk IP Prefix Blocking

An Irule that Stops TLS (tcp) Fragmentation on Client Side

F5 LTM logs and application access logs

F5 insight Software Installation Job possible bug

F5OS rSeries Radius with Cisco ISE

Related Content

Radware config translation

Restsh is now available under an Open Source license!

GTM Translation

iRule to Force Source IP to Specific Backend Node

Phishing, Malware, Breach and Open-Source Security

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS