# Apply conditional SNATPOOL

**URL:** <https://community.f5.com/t/apply-conditional-snatpool/16483>\
**Category:** Technical Forums\
**Tags:** irules, deployment, big-ip-access-policy-manager-apm, devops, security, ltm, application-delivery\
**Created:** [August 24, 2015, 10:33pm UTC](https://community.f5.com/t/apply-conditional-snatpool/16483 "2015-08-24T22:33:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cae\_140395](https://avatars.discourse-cdn.com/v4/letter/c/a5b964/32.png) [@Cae\_140395](https://community.f5.com/u/Cae_140395)\
**Post date:** [August 24, 2015, 10:33pm UTC](https://community.f5.com/t/apply-conditional-snatpool/16483/1 "2015-08-24T22:33:20Z")

</div>

Hello all!

I am with a issue of SNAT.

My pool have pool-members from differents subnets. I need apply SNAT 10.100.2.253 when the choosen pool-members are from network 10.100.2.0/24 and the SNAT 172.26.160.71 to pool-members from network 10.100.6.64/27.

Are there a native configuration on BIG-IP 11.6. to solve this issue or do i need to apply an irule for this ?

I wrote two option of irules, but idon’t know if is correct.

_ **Data group with ip address from network 10.100.6.64/27:** _

```tcl
ltm data-group internal DGROUP-THS {
    records {
        10.100.6.64/27 { }
    }
    type ip

```

_ **SNATPOOL when poolmember 10.100.6.x are chosen:** _

```tcl
ltm snatpool SNAT_THS {
    members {
        172.26.160.71
    }
}

```

_ **SNATPOOL when poolmember 10.100.2.x are chosen:** _

```tcl
ltm snatpool SNAT_DEFAULT {
    members {
        10.100.2.253
    }
}

```

_ **1° Option irule:** _

```tcl
when CLIENT_ACCEPTED {
if { [class match [IP::client_addr] equals DGROUP-THS]} {
snatpool SNAT_THS
} else {
forward
}
}
}

```

_ **2° Option irule:** _

```tcl
when LB_SELECTED {
if { [class match [LB::server addr] equals DGROUP-THS]} {
snatpool SNAT_THS
} else {
forward
}
}

```

And for two irule the snatpool SNAT\_DEFAULT is set on virtual server.

---

<div class="post-metadata">

**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\
**Post date:** [August 25, 2015, 2:14pm UTC](https://community.f5.com/t/apply-conditional-snatpool/16483/2 "2015-08-25T14:14:37Z")

</div>

I don’t really think you need two separate iRules:

```tcl
when CLIENT_ACCEPTED {
    if { [class match [IP::client_addr] equals DGROUP_THS] } {
        snatpool [class match -value [IP::client_addr] equals DGROUP_THS]
    } 
}

```

where your datagroup includes two different entries:

```tcl
ltm data-group internal DGROUP-THS {
    records {
        10.100.6.64/27 { 
            data SNAT_THS
        }
        172.26.160.0.24 {
            data SNAT_DEFAULT
        }
    }
    type ip
}

```

Or if you just have a default SNAT for anything that’s not in the 10.100.6.64/27 subnet:

```tcl
when CLIENT_ACCEPTED {
    if { [IP::addr [IP:client_addr] equals 10.100.6.64/27] } {
        snatpool SNAT_THS
    } else {
        snatpool SNAT_DEFAULT
    }
}

```