F5 LTM SNAT: only 1 outgoing connection, multiple internal clients
I have an F5 LTM SNAT configured: ltm snat /Common/outgoing_snat_v6 { description "IPv6 SNAT translation" mirror enabled origins { ::/0 { } } snatpool /Common/outgoing_snatpool_v6 vlans { /Common/internal } vlans-enabled } ... with a translation configured as: ltm snat-translation /Common/ext_SNAT_v6 { address 2607:f160:c:301d::63 inherited-traffic-group true traffic-group /Common/traffic-group-1 } ... with snatpool configured as: ltm snatpool /Common/outgoing_snatpool_v6 { members { /Common/ext_SNAT_v6 } } ... and finally, with the SNAT type set to automap: vs_pool__snat_type { value automap } The goal is to achieve a single Diameter connection (single source IP, port) between F5 and the external element, while internally multiple Diameter clients connect via F5 to the external element: However, what ends up happening with this SNAT configuration is that multiple outgoing Diameter connections to the external Diameter element are opened, with the only difference between them being the source port (source IP, destination IP and port remained the same). The external element cannot handle multiple connections per the same origin IP and the same Diameter entity (internal clients are all configured to use the same Origin-Host during the Capabilities Exchange phase). Is there a way to configure F5 to funnel all the internal connections into a single outgoing one?
diameter and ssl
Hi all, I have a question about diameter balancing with SSL client profile. I'm noticing that with diameter profile I'm not able to use SSL::disable and SSL::enable in irules. I tried this configuration for testing when CLIENT_ACCEPTED { SSL::disable } In http profile (I tried it just for test) it works well. In diameter profile it doesn't work. So my question is: Can I use SSL::enable/disable in diameter profile? I need this because my diameter client establish a no TLS connection with CER/CEA exchange and only after this exchange start the TLS handshake in the same session. So I'm looking if it's possible use irules to support this. Using a full TLS session or full no-TLS session everything is ok. Thanks, DavideDiameter iRules attachment?
I'm creating iRules for a Diameter message routing virtual server. I can't seem to get the events DIAMETER_INGRESS or DIAMETER_EGRESS to be executed by the irule. I have the following simple iRule but but I get no log messages in /var/log/ltm when requests are sent. when DIAMETER_INGRESS { log local0. "diameter ingress event detected" if {[DIAMETER::command] == 268} { log local0. "diameter eap request detected" } } when DIAMETER_EGRESS { log local0. "diameter egress event detected" if {[DIAMETER::command] == 268} { log local0. "diameter eap egress detected" } } } I've attached this iRule to the transport profile as well as the VS but no log messages. The message routing configuration is working fine I get a request from upstream which F5 sends downstream and a response is back upstream. What am I doing wrong?
