Remove subnet from NAT pools without any impact

[zztop123]

What is the easist way to Remove subnet from NAT pools without any impact

[Mohamed_Ahmed_Kansoh · Accepted solution]

Hi @zztop123 , 

Look , 
you should first see how this pool of NAT IPs used , see if it's used by huge amount of traffic , or by little or isn't used. 

if this subnet not used , you can remove it , it will not cause any impact. 

but if this subnet is used much in NATing you should remove it , as you maybe impacted by port exhausion so at this case you shouldn't remove it. 

So the impact only is with port exhausion not anything else. 

[zztop123]

Thats right , thats what i was concerned with.If we monitor the use and if its use, and we  disable the pool to see the impact ?You think that would be a better idea

[Mohamed_Ahmed_Kansoh]

Hi @zztop123 ,

Take a packet capture in the server side and see how this pool of NAT ips utilized. 

If you saw much traffic converted to source ips from the subnet that you want to remove it here you should be careful fron port exhaustion issue. 

If you don't much traffic use ips from the subnet you need to remove it you can delete it. 

Look at this article , it explains port exhaustion : https://my.f5.com/manage/s/article/K33355231

So the recommendation is to keep monitor in /var/log/ltm periodically to see if there is port exhaustion or not. 

If you found this log even one time , you should rollback and return the removed subnet again in the pool. 

[zztop123]

Thanks  Mohamed

Can you please also see if you can find the procedure for removing the subnet from the Pool List and be able to add back.

[Mohamed_Ahmed_Kansoh]

Hi @zztop123 , 

Well , 
Go to ( Local Traffic >> Address translation >> SNAT pool list >> open the SNAT list you need , then select all IPs that you need to remove  ) , you can record these ips in external txt files . 

Click update and monitor the behavior , if there is an impact you can put these Ips from the txt file again and click update. 
by this you did the rollback. 

I want to ask you , maybe I miss understand you , you're speaking about SNAT pools which attached to virtual servers ? or you meant another pools 

Please clarify 

[zztop123]

Hi Mohammed,

Its not SNAT pool , just a NAT pool. is the procedure the same for it ? Please find the screen shot

[Mohamed_Ahmed_Kansoh]

Hi @zztop123 , 
ohh , this AFM NATing. 

first you need to see if this subnet is used in transulations or not 
> look at logging profile.

> use this command on bash ( #tmsh show sys connection > /var/tmp/AFM_NAT.txt ) 
This is the Article to view the connections : https://my.f5.com/manage/s/article/K53851362 
you can use filters 

I recommended to move these the connections to a text file , because it may impact your device performance if you viewed these connections in bigip cli. 

then remove this subnet. 

but I can't measure the impact if there is impact from removing this subnet , it depends on your number of subscribers. 

Seeing if this subnet is used much or not may help you to detect if this will case a shortage in available ips or not. 

If this a deterministic NAT you can calculate the estimated number of reserved ips for each subscriber , look at this article : https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/cgn-implementations-11-5-0/13.h...

[zztop123]

Hi Mohammad, We have a maintenanace window, and currentlyy seeing 2.4 mil onnections. The plan is move forward with one subnet deletion from the GUIand then monitor if the connections rebuild themselves?

Does that sound an ok plan ?

[Mohamed_Ahmed_Kansoh]

Hi @zztop123 , 

Well sounds good. 

Keep this subnet with you. 
After deleting it : 

monitor system performance and dropping rate. 
Also look perodically in the log files for weired logs. 

follow up with your subscribers if you found complains you should roll-back. 

you can also filter in all connections that use this subnet in NATing like I recommended in the last replay.