Forum Discussion
Nimbostratusspecific source port translation
Hi,
I am trying to do SNAT while selecting a specific port for that but for some reason when the F5 receive the response it is sending a RST to the WS and not retranslating it to the original IP and port.
I configured the below:
when CLIENT_ACCEPTED {
set PublicIP 10.107.200.200
snat $PublicIP 12345
}
I can see that connection was created:
VIRTUAL any <-> NODE 173.194.47.19:80 TYPE any 1/3
CLIENTSIDE 10.107.200.140:51251 <-> 173.194.47.19:80
(pkts,bits) in = (2, 120) out = (0, 0)
SERVERSIDE 10.107.200.200:12345 <-> 173.194.47.19:80
(pkts,bits) in = (0, 0) out = (2, 120)
PROTOCOL 6 UNIT 1 IDLE 2 (300) LASTHOP WDN_MIG_Internal 00:14:5e:a8:0a:04
This the tcpdump from the F5:
19:22:02.182260 IP 10.107.200.200.12345 > 173.194.47.19.80: S 1731136945:1731136945(0) win 5840
19:22:02.264415 IP 173.194.47.19.80 > 10.107.200.200.12345: S 718544173:718544173(0) ack 1731136946 win 1460
19:22:02.264439 IP 10.107.200.200.12345 > 173.194.47.19.80: R 1:1(0) ack 1 win 0
Do you have any idea why the F5 behave in that way?
Thanks a lot.
34 Replies
- nitass
Employee
one more thing, would you mind disabling cmp and trying again?
sol7751: Overview of Clustered Multi-Processing (9.x - 10.x)
http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7751.html 
schmal_111133I tried to disable it and still same behavior :\ it worked for the first connection and then stopped working.- schmal_111133another thing that I notice it is if I wait a long period of time and then trying again to open the connection it opens successfully only for the first one.. something is weird here..
Kleython_Kell_5in 10.2.3 I use an similar irule
thats it:
rule SNAT_OUT {
when CLIENT_ACCEPTED {
snat x.x.x.x
pool x
}- nitassanother thing that I notice it is if I wait a long period of time and then trying again to open the connection it opens successfully only for the first one.. something is weird here..
on 2nd attempt, did you connect to the same or different server? if it is the same one, did you see syn packet going out from port 12345?
by the way, tcpdump file would be indeed useful. i think it would be great if you can capture both traffic sides (client-side and server-side). i always capture on interface 0.0 with noisy option (:nnn).
tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x
x.x.x.x is destination ip - schmal_111133Hi nitass, thanks again for the willing to help :)
I connect to the same server, but I can see that the F5 is sending a SYN packet what means that it doesn't using the port already.
do you know how I can upload a file here? I will be happy to show you the capture file. - nitassthanks again for the willing to help :) you are welcome. :-)
do you know how I can upload a file here? I will be happy to show you the capture file.sorry i do not know too. (=*=) anyway, i do not see capture file in C1290719. would you mind uploading to dropbox?
host: dropbox.f5.com
user: C1290719
password: customer contact email (f5...) - nitassbigip sent reset (pkt 6) because syn-ack (pkt 5) was handled by different tmm. you could see syn (pkt 4) was sent out by tmm0 but syn-ack (pkt 5) was received by tmm1. how did you disable cmp?
No. Time Delta Time Source Src port Destination Protocol Dst port Window BiF Vlan id Length Info 1 2013-02-15 18:34:21.759542 0.000000 10.159.121.107 1576 10.106.12.174 TCP 80 64512 85 88 IN s0/tmm0 : 1576 > 80 [SYN] Seq=389855322 Win=64512 Len=0 MSS=1237 SACK_PERM=1 2 2013-02-15 18:34:21.759574 0.000032 10.106.12.174 80 10.159.121.107 TCP 1576 3711 85 88 OUT s0/tmm0 : 80 > 1576 [SYN, ACK] Seq=1141266970 Ack=389855323 Win=3711 Len=0 MSS=1460 SACK_PERM=1 3 2013-02-15 18:34:21.903207 0.143633 10.159.121.107 1576 10.106.12.174 TCP 80 64512 85 86 IN s0/tmm0 : 1576 > 80 [ACK] Seq=389855323 Ack=1141266971 Win=64512 Len=0 4 2013-02-15 18:34:21.903264 0.000057 10.106.12.178 12345 10.106.12.40 TCP 8080 4380 85 92 OUT s0/tmm0 : 12345 > 8080 [SYN] Seq=2863642582 Win=4380 Len=0 MSS=1460 WS=1 SACK_PERM=1 5 2013-02-15 18:34:21.903472 0.000208 10.106.12.40 8080 10.106.12.178 TCP 12345 65535 85 92 IN s0/tmm1 : 8080 > 12345 [SYN, ACK] Seq=1064416826 Ack=2863642583 Win=65535 Len=0 MSS=1460 WS=1 SACK_PERM=1 6 2013-02-15 18:34:21.903494 0.000022 10.106.12.178 12345 10.106.12.40 TCP 8080 0 85 80 OUT s0/tmm1 : 12345 > 8080 [RST, ACK] Seq=2863642583 Ack=1064416827 Win=0 Len=0 - schmal_111133I uploaded the capture file to the dropbox, the capture name is output.pcap
Please let me know if you see something suspicious in the capture. - nitassthis is from output.pcap. syn-ack (pkt 3) was handled by tmm1 but syn (pkt 2) was sent by tmm0.
No. Time Delta Time Source Src port Destination Protocol Dst port Window BiF Vlan id Length Info 2 2013-02-15 19:35:14.506284 0.000738 10.107.200.200 11121 173.194.44.114 TCP 80 5840 16 163 OUT s0/tmm0 : 11121 > 80 [SYN] Seq=3317070260 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=2770093632 TSecr=0 WS=512 3 2013-02-15 19:35:14.587930 0.081646 173.194.44.114 80 10.107.200.200 TCP 11121 1460 16 163 IN s0/tmm1 : 80 > 11121 [SYN, ACK] Seq=2187993620 Ack=3317070261 Win=1460 Len=0 MSS=1460 SACK_PERM=1 TSval=686669023 TSecr=2770093632 WS=64 4 2013-02-15 19:35:14.587964 0.000034 10.107.200.200 11121 173.194.44.114 TCP 80 0 42 16 185 OUT s0/tmm1 : 11121 > 80 [RST, ACK] Seq=3317070261 Ack=2187993621 Win=0 Len=42
