Forum Discussion
Jose_Charpentie
Nimbostratus
NimbostratusUse VIP address as source
Hello everyone,
How can I allow the VIP IP as a source when the Pool Member iniciates the connection on a specific port? I tried with a NAT but it will NAT all the traffic I need only to NAT with when the pool member iniciates the traffic in a specific port. (Actually the NAT didn't work, I have a capture on a FW and the connection is using the self IP of the F5).
I tried with a SNAT and SNAT Pool but it doesn't worked either, I can see the self IP in the FW when the server iniciates the traffic.
I also tried with an iRULE, something like this:
when CLIENT_ACCEPTED { if {[TCP::local_port] == 2196} { snatpool SNAT_POOL_TEST
} pool airwatch-AWCM-2001 }
Thank in advance for your responses.
Regards,
Jose Charpentier F
- Kevin_Stewart
Employee
Can you please elaborate? A NAT is going to be a simple destination translation from one (origin) IP to another, while a SNAT changes the source. Why would you want to use the VIP address as the source to the server - when it is otherwise the destination on the client side?
Jose_CharpentieHello Kevin,
When the connections are comming to the VIP from the customer (inbound) the traffic is being handle normally.
User -- Firewall -- F5 VIP (192.168.101.40) -- Node (10.156.10.92)
But when the NODE is the one that generates the traffic to Internet (outbound) I need the BigIP to use the VIP IP address as the source and not the self IP of the BigIP. The Firewall is allowing only the VIP IP address, and in the capture I am seeing the self IP (192.168.101.7) when using NAT or SNAT.
Node (10.156.10.92) -- F5 -- Firewall -- User
The NODE is also hosting other services, so I need to do this translation only when the NODE starts the traffic for example on port 2196.
Thank you for your repply.
Regards,
Jose Charpentier F
Julio_MedinaHi Jose Charpentier,
Did you get this issue solved? i'm facing that same problem today and I need some help. I would appreciate so much.
Thnks
JanaAltostratus
For outbound traffic, you can try creating an SNAT address same as the VIP address and add the node ip address(es) in the Origin list. However, I'm not sure if you could do that for traffic from a specific port.
Vinit_AjgaonkarI think one way of doing this would be to create a NAT pool and add the LB VIP onto the NAT pool. Then apply this pool in the NAT translation configuration. That should take care of all the application traffic. However if you haved any healthchecks they will always originatge from the LB backend self IP.
