Forum Discussion

Lay_Hin_53714's avatar
Lay_Hin_53714
Icon for Nimbostratus rankNimbostratus
Dec 05, 2008

Internal Network access to External(Internet)

Our F5 Internal Network is connected to an Firewall. Behind the firewall, is another subnet of Public IP address.

 

 

Example : F5 Internal Network is 202.6.1.0/25, there is a firewall with IP 202.6.1.11/25.

 

Behind the firewall, is another Public IP range, eg 202.6.2.0/25. LB will route traffic to this network via 202.6.1.11.

 

 

Noticed that the server from 202.6.2.0/25 is not able to connect to host in Internet.

 

 

A SNAT for one-to-one mapping is configured for each individual IP in the Internal network.

 

For example, SNAT configured for 202.6.2.10 SNAT to 202.6.2.10.

 

 

Can I allow Internal host access to external network without SNAT? There are many internal hosts, creating SNAT for every IP doesn't seem to be very practical.

 

config
design

1 Reply

Sort By
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Dec 05, 2008
    Sure, just create a wildcard forwarding virtual server - 0.0.0.0:0, type Forwarding(IP), and enable it only on the internal VLAN. As long as the LTM's default gateway knows to route the outgoing connections back to the LTM (because it will now see the internal IP's as the source address instead of the SNAT) you should be fine.

     

     

    Denny