Dynamic 1:1 SNAT irule

set ::oct3 0
set ::oct4 1

reposting irule code on request - !note! code in two halves:

timing on for testing
timing on
when RULE_INIT {
    set ::oct3 0
    set ::oct4 1
    set static::oct3end 0
    set static::oct4end 255
    set static::timeout 600
    set static::debug 1

 }

when CLIENT_ACCEPTED {

    debugging
    if {$static::debug} {

        foreach key [table keys -subtable "ClientDynNat" -notouch] {
        log local0. "table ClientDynNat key: $key"
    }
    }

if { [set SnatTo [table lookup -subtable "ClientDynNat" [IP::client_addr]]] ne "" } {
     to reset idle timeout of dynamic NAT address so it's not re-allocated until client SNAT times out.
    table lookup -subtable "DynNatAddreses" $SnatTo

    log local0. "Found exisiting snat in ClientDynNat for [IP::client_addr]: [table lookup -notouch -subtable "ClientDynNat" [IP::client_addr]]"

    debugging
    if {$static::debug} {
    log local0. "table lookup in DynNatAddress for $SnatTo: [table lookup -notouch -subtable "DynNatAddreses" $SnatTo]"
    log local0. "table remaining ClientDynNat for [IP::client_addr]: [table timeout -subtable "ClientDynNat" -remaining [IP::client_addr]]"
    log local0. "table remaining DynNatAddress for $SnatTo: [table timeout -subtable "DynNatAddreses" -remaining $SnatTo]"
    }

    snat $SnatTo

    log local0. "deleting dynnats in tables"
    table delete -subtable "ClientDynNat" -all
    table delete -subtable "DynNatAddreses" -all   

} else {

    debugging
    if {$static::debug} {
        foreach key [table keys -subtable "DynNatAddreses" -notouch] {
            log local0. "table DynNatAddreses key: $key"
        }
            log local0. "DynNatAddress table count -- [table keys -subtable "DynNatAddreses" -count]"
            log local0. "no snat for [IP::client_addr]"
    }

cont...

loop through subnet until octet3 has reached it's maximum allocated value 
    while {$::oct3 <= $static::oct3end} {
        set ip 217.39.$::oct3.$::oct4

        if { [table lookup -notouch -subtable "DynNatAddreses" $ip] eq "" } {

            log local0. "Free IP: $ip found added to clientDynNat table"

            reserve the Free IP
            table add -subtable "DynNatAddreses" $ip [IP::client_addr] $static::timeout
            allocate the Free IP as client SNAT address
            table add -subtable "ClientDynNat" [IP::client_addr] $ip $static::timeout

        debugging
        if {$static::debug} {
            log local0. "table lookup in DynNatAddress for $ip: [table lookup -notouch -subtable "DynNatAddreses" $ip]"
            log local0. "table remaining ClientDynNat for [IP::client_addr]: [table timeout -subtable "ClientDynNat" -remaining [IP::client_addr]]"
            log local0. "table timeout DynNatAddreses for $ip: [table timeout -subtable "DynNatAddreses" -remaining $ip]"
        }   
            SNAT the client to the free IP
            snat $ip
             break the loop - found and allocated a address so no point in cycling through rest of Pool of IP's
            break           
        }
        increment the last octect of pool
        incr ::oct4
        if last octect has reached the end of the range increment next octet of IP and start looping through again
        if {$::oct4 > $static::oct4end} {
            incr ::oct3
            set ::oct4 0
        }
    }   
}



}

Be sure to use a non SP-DAG configured platform. With SP-DAG enabled VLAN, the IP address is linked to a TMM. If you try to SNAT with a different IP than the one linked to the landing TMM, you will have TMM to TMM packets forwarding, which can impact the overall performance.

I´ve a similar scenario, which I do today with a 1: 1 snat list, however, I´ve more than 500 IPs to use in POOL, only that while one NAT IP is in use it cannot be used by another. As I understand it, this iRule has this role, does anyone have it working in a stable production environment? If so, can you share?