Hi, I am trying to do SNAT while selecting a specific port for that but for some reason when the F5 receive the response it is sending a RST to the WS and not retranslating it to the original IP and port. I configured the below: when CLIENT_ACCEPTED { set PublicIP 10.107.200.200 snat $PublicIP 12345 } I can see that connection was created: VIRTUAL any <-> NODE 173.194.47.19:80 TYPE any 1/3 CLIENTSIDE 10.107.200.140:51251 <-> 173.194.47.19:80 (pkts,bits) in = (2, 120) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.19:80 (pkts,bits) in = (0, 0) out = (2, 120) PROTOCOL 6 UNIT 1 IDLE 2 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 This the tcpdump from the F5: 19:22:02.182260 IP 10.107.200.200.12345 > 173.194.47.19.80: S 1731136945:1731136945(0) win 5840 19:22:02.264415 IP 173.194.47.19.80 > 10.107.200.200.12345: S 718544173:718544173(0) ack 1731136946 win 1460 19:22:02.264439 IP 10.107.200.200.12345 > 173.194.47.19.80: R 1:1(0) ack 1 win 0 Do you have any idea why the F5 behave in that way? Thanks a lot.

was syn-ack coming to correct vlan? what version are you running? if it is 10.2.3+, you may try to log tcp rst packet. sol13223:Configuring the BIG-IP system to log TCP RST packets http://support.f5.com/kb/en-us/solutions/public/13000/200/sol13223.html this is mine. [root@ve10:Active] config b virtual bar list virtual bar { pool gw destination any:any mask 0.0.0.0 ip protocol 6 rules myrule } [root@ve10:Active] config b pool gw list pool gw { members 172.28.19.254:any {} } [root@ve10:Active] config b rule myrule list rule myrule { when CLIENT_ACCEPTED { snat 172.28.19.252 1234 } } [root@ve10:Active] config b snat translation list snat translation 172.28.19.252 {} tcpdump [root@ve10:Active] config tcpdump -nni 0.0 -s0 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes 09:20:11.103550 IP 200.200.200.101.60204 > 172.28.19.251.80: S 4212438457:4212438457(0) win 5840 in slot1/tmm0 lis= 09:20:11.103603 IP 172.28.19.251.80 > 200.200.200.101.60204: S 2784638521:2784638521(0) ack 4212438458 win 4380 out slot1/tmm0 lis=bar 09:20:11.104573 IP 200.200.200.101.60204 > 172.28.19.251.80: . ack 1 win 46 in slot1/tmm0 lis=bar 09:20:11.104634 IP 172.28.19.252.1234 > 172.28.19.251.80: S 3603285261:3603285261(0) win 4380 out slot1/tmm0 lis=bar 09:20:11.105731 IP 200.200.200.101.60204 > 172.28.19.251.80: P 1:3(2) ack 1 win 46 in slot1/tmm0 lis=bar 09:20:11.105742 IP 172.28.19.251.80 > 172.28.19.252.1234: S 863226244:863226244(0) ack 3603285262 win 5792 in slot1/tmm0 lis=bar 09:20:11.105750 IP 172.28.19.252.1234 > 172.28.19.251.80: . ack 1 win 4380 out slot1/tmm0 lis=bar 09:20:11.105762 IP 172.28.19.252.1234 > 172.28.19.251.80: P 1:3(2) ack 1 win 4380 out slot1/tmm0 lis=bar 09:20:11.106790 IP 172.28.19.251.80 > 172.28.19.252.1234: . ack 3 win 46 in slot1/tmm0 lis=bar 09:20:11.205525 IP 172.28.19.251.80 > 200.200.200.101.60204: . ack 3 win 4382 out slot1/tmm0 lis=bar connection table [root@ve10:Active] config b conn client 200.200.200.101 show all VIRTUAL any <-> NODE 172.28.19.251:80 TYPE any 1/0 CLIENTSIDE 200.200.200.101:60204 <-> 172.28.19.251:80 (pkts,bits) in = (3, 166) out = (2, 116) SERVERSIDE 172.28.19.252:1234 <-> 172.28.19.251:80 (pkts,bits) in = (2, 112) out = (3, 170) PROTOCOL 6 UNIT 1 IDLE 4 (300) LASTHOP internal 00:50:56:b3:01:0b

Hi nitass, Thanks for the response. I am running 10.2.4 HF5, What version you are running? I tried what you suggest and I get the following log: Feb 14 11:46:29 local/tmm2 err tmm2[5586]: 01230140:3: RST sent from 10.107.200.200:12345 to 173.194.47.80:80, [0x11d265d:1751] No local listener I am trying to figure out why the F5 claims that there is no local listener if there is connection on that: [root@LBA-F5-1A:Active] config b conn client 10.107.200.140 show all -n VIRTUAL any <-> NODE 10.115.243.30:53 TYPE any 1/2 CLIENTSIDE 10.107.200.140:41495 <-> 10.115.243.30:53 (pkts,bits) in = (102, 7236) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.30:53 (pkts,bits) in = (0, 0) out = (102, 7236) PROTOCOL 17 UNIT 1 IDLE 54 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 VIRTUAL any <-> NODE 10.115.243.243:53 TYPE any 1/2 CLIENTSIDE 10.107.200.140:41495 <-> 10.115.243.243:53 (pkts,bits) in = (105, 7467) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.243:53 (pkts,bits) in = (0, 0) out = (105, 7467) PROTOCOL 17 UNIT 1 IDLE 3 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 VIRTUAL any <-> NODE 10.115.243.243:53 TYPE any 1/1 CLIENTSIDE 10.107.200.140:54872 <-> 10.115.243.243:53 (pkts,bits) in = (1, 55) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 10.115.243.243:53 (pkts,bits) in = (0, 0) out = (1, 55) PROTOCOL 17 UNIT 1 IDLE 67 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 VIRTUAL any <-> NODE 173.194.47.80:80 TYPE any 1/0 CLIENTSIDE 10.107.200.140:56476 <-> 173.194.47.80:80 (pkts,bits) in = (3, 180) out = (0, 0) SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.80:80 (pkts,bits) in = (0, 0) out = (3, 180) PROTOCOL 6 UNIT 1 IDLE 104 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04 This is the virtual server: [root@LBA-F5-1A:Active] config b virtual Allow_Routes list virtual Allow_Routes { srcport change ip forward lasthop pool Last_HOP destination any:any mask 0.0.0.0 rules bbb vlans WDN_MIG_Internal enable } and this is the rule: rule bbb { when CLIENT_ACCEPTED { snat 10.107.200.200 12345 } } By the way in the first time that I tried to open connection it was successfully opened but after that all the attempts failed, including to another destination IP and also after cleaning all the connections on the F5. I can't see any logical reason why it is not working for me as expected :\

I am running 10.2.4 HF5, What version you are running?i am running 10.2.4 hf4. [root@ve10:Active] config b version|grep -iA 1 version BIG-IP Version 10.2.4 655.0 Hotfix HF4 Edition have you checked syn-ack's incoming vlan? was it correct? e.g. tcpdump -e -nni 0.0 -s0 host 173.194.47.80 and port 80

The tcpdump that I am doing is for specific VLAN so for sure that the traffic returns to the same VLAN that it left. Tell me the IP 172.28.19.252 is self IP in your F5?

Tell me the IP 172.28.19.252 is self IP in your F5?no, it is snat translation address. selfip is 172.28.19.253. [root@ve10:Active] config b self 172.28.19.253 list self 172.28.19.253 { netmask 255.255.255.0 vlan external allow default }

Forum Discussion

schmal_111133

Nimbostratus

Feb 13, 2013

specific source port translation

Hi,

I am trying to do SNAT while selecting a specific port for that but for some reason when the F5 receive the response it is sending a RST to the WS and not retranslating it to the original IP and port.

I configured the below:

when CLIENT_ACCEPTED {

set PublicIP 10.107.200.200

snat $PublicIP 12345

}

I can see that connection was created:

VIRTUAL any <-> NODE 173.194.47.19:80 TYPE any 1/3

CLIENTSIDE 10.107.200.140:51251 <-> 173.194.47.19:80

(pkts,bits) in = (2, 120) out = (0, 0)

SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.19:80

(pkts,bits) in = (0, 0) out = (2, 120)

PROTOCOL 6 UNIT 1 IDLE 2 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04

This the tcpdump from the F5:

19:22:02.182260 IP 10.107.200.200.12345 > 173.194.47.19.80: S 1731136945:1731136945(0) win 5840

19:22:02.264415 IP 173.194.47.19.80 > 10.107.200.200.12345: S 718544173:718544173(0) ack 1731136946 win 1460

19:22:02.264439 IP 10.107.200.200.12345 > 173.194.47.19.80: R 1:1(0) ack 1 win 0

Do you have any idea why the F5 behave in that way?

Thanks a lot.

34 Replies

schmal_111133
Nimbostratus
Feb 26, 2013
right now my biggest issue with the above is the TMM issue, when I disable the CMP everything works perfect but of course I cannot disable the CMP on production system.

I will be happy if you will take a look on the irule and write any comments if you have some..
nitass
Employee
Feb 26, 2013
I didn't exactly understood how you can determine which TMM will handle the traffic when the traffic return to the F5 and not leaving it.. it is source port XOR destination port MOD total number of tmm instances.

for the irule, i think TCP::unused_port may be useful (because you have to select correct snat port and it must be available to use).

TCP::unused_port wiki

https://devcentral.f5.com/wiki/iRules.TCP__unused_port.ashx
schmal_111133
Nimbostratus
Feb 26, 2013
Thanks for the reply :)

for the irule, i think TCP::unused_port may be useful (because you have to select correct snat port and it must be available to use).

TCP::unused_port wiki

https://devcentral.f5.com/wiki/iRules.TCP__unused_port.ashx

The thing is that the virtual server that I am doing the SNAT using for UDP and TCP and all other protocols do to SNAT, the VS type is IP (Forwarding) with all protocols.
nitass
Employee
Feb 26, 2013
there is UDP::unused_port as well.

UDP::unused_port wiki

https://devcentral.f5.com/wiki/iRules.UDP__unused_port.ashx