For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Pierrejn's avatar
Pierrejn
Icon for Nimbostratus rankNimbostratus
Apr 13, 2017

Using SNAT

Quick question for anyone out there. Is it possible to use SNAT to take an outside address and mask it when it comes inside?   outside <--> F5 <--> SNAT address talks to inside server  
application delivery
BIG-IP
LTM
dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Apr 13, 2017

Hi,

 

It is possible but rather unusual. Assuming that server behind BIG-IP is in 192.168.1.0/24 subnet you need to set SNAT:

 

Translation: IP from 192.168.1.0/24 or Automap (will use SelfIP in this subnet) Origin: Depends what IPs should have access to this internal subnet (can be All IP4/IP6 or some specific ranges)

 

Then on upstream device you need to define route to subnet 192.168.1.0/24 (or some smaller range) pointing to BIG-IP selfIP on ext VLAN.

 

Quite cumbersome and weak on security, but possible.

 

Piotr