For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Piotr_Lewandows's avatar
Piotr_Lewandows
Icon for Altostratus rankAltostratus
May 30, 2017

Strange issue with SNAT stats, pinging self IP and Allow None

Hi,   I am running out of ideas why BIG-IP behaves as in cases described below, either it's my lack of knowledge, expected behavior or bug.   Tested on v11.2.0HF7 Active-Passive cluster.   Ca...
devops
LTM
ping self ip
port lockdown
security
snat stats
dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
May 31, 2017

Regarding SNAT issue, can anyone explain ehat this output means:

show ltm snat LAMP_subnet_to_ext detail

---------------------------------
Ltm::SNAT: LAMP_subnet_to_ext
---------------------------------
Traffic                ClientSide
  Bits In                   30.5K
  Bits Out                  29.7K
  Packets In                   82
  Packets Out                  82
  Current Connections           1
  Maximum Connections           5
  Total Connections            19

  -------------------------------------
  | Ltm::SNAT Pool: SNAT_to_Internet_pl
  -------------------------------------
  | Traffic                ServerSide
  |   Bits In                       0
  |   Bits Out                      0
  |   Packets In                    0
  |   Packets Out                   0
  |   Current Connections           0
  |   Maximum Connections           0
  |   Total Connections             0

SNAT object is using SNAT Pool, SNAT pool is not seeing any traffic (so no src IP translations) but SNAT object sees traffic and even has open connections.

But when doing 

tmsh show sys connections
there are only connections like that:

10.128.30.151:123 194.146.251.101:123 10.129.10.13:123 194.146.251.101:123 udp 169 (tmm: 0) 192.168.1.2:51914 192.168.1.1:1026 192.168.1.2:51914 192.168.1.1:1026 udp 0 (tmm: 0) 192.168.1.1:38978 192.168.1.2:1026 192.168.1.1:38978 192.168.1.2:1026 udp 0 (tmm: 0) 10.128.40.239:56372 10.128.40.110:8081 10.128.40.239:56372 10.128.40.110:8081 tcp 0 (tmm: 0)

So sure there are connections from subnet set in SNAT object (10.128.30.0/24) but those are handled by wildcard VS (server side src IP 10.129.10.13 - floating self ip - snat automap).

So what's going on here?

Stats stops to increase when I set Disable On in SNAT with internal VLAN selected. Is I have Enabled on with empty Selected then stats are still increasing.

Piotr