Direct traffic to proper pool after being snat'd!

Question

Hello
&nbsp;I have written the following Irule (basic one) with the intention to direct traffic to a proper pool after it has been snat'd on the way out&nbsp;
&nbsp;I need to have host 10.44.17.30 get snat'ed to snatpool E_File (2 members: 190.216.X.Y &amp; 190.145.X.Y) and after it has been snat'd choose a proper pool&nbsp;&nbsp;
&nbsp;According to SnatPool , iRule and tcpdumps statistics I see traffic is actually been snat'd
&nbsp;but I dont see either Pool  Global or Pool Telmex being hit! And traffic is going out via   pool Default_Gateway_Pool_SMTP instead!&nbsp;&nbsp;&nbsp;
&nbsp;when CLIENT_ACCEPTED {&nbsp;
&nbsp;if { [IP::client_addr] equals "10.44.17.30" } {
&nbsp;            snatpool E_File
&nbsp;            rateclass Fac_Dig&nbsp;
&nbsp;           if {[IP::client_addr] equals "190.216.X.Y" }{
&nbsp;           
&nbsp;                  pool Pool_Global
&nbsp;                   pool of 1 member :201.234.X.Y:25&nbsp;
&nbsp;            } elseif {
&nbsp;                       [IP::client_addr] equals "190.145.X.Y" }{
&nbsp;                       
&nbsp;                     pool Pool_Telmex
&nbsp;                    pool of 1 member :190.145.X.Y:25
&nbsp;}&nbsp;
&nbsp;           log local0.  "Valid client IP: [IP::client_addr] - HostName"
&nbsp;else {&nbsp;
&nbsp;        pool Default_Gateway_Pool_SMTP
&nbsp;        
&nbsp;                log local0.  "Valid client IP: [IP::client_addr] - HostName"
&nbsp;}
&nbsp;}&nbsp;&nbsp;&nbsp;
&nbsp;Is there something wrong with this irule? &nbsp;
&nbsp;Thansk in advanced!&nbsp;
&nbsp;Glenn&nbsp;

chris_miller · Answer

Since you're using "client_accepted", the traffic hasn't been SNATed and therefore LTM will see the original client IP and not the SNAT IP...I'll have to think about options here. 
&nbsp;  
&nbsp; May I ask why you're using a SNAT address from different pools? If these are firewalls/gateways, you could maybe use automap?

glenn_32974 · Answer

Hi Chris, 
&nbsp;  
&nbsp; I have defined the following Pool: 
&nbsp;  
&nbsp;  SnatPool E_File with 2 members: 
&nbsp; 1. 190.216.X.Y 
&nbsp; 2. 201.234.X.Y 
&nbsp;  
&nbsp; The idea behind this is to Translate source address 10.44.17.30 to either 190.216.X.Y or 201.234.X.Y  SNAT addresses  
&nbsp; Because this is Bulk email traffic and sometimes it gets blacklisted so the customer needs to havethis specific  smtp traffic leave the network with the above addresses 
&nbsp;  
&nbsp; Did I explain clearly? 
&nbsp;  
&nbsp; Im working with Link Controller and I need to send traffic over one link  (Pool Global) is traffic gets SNAT'ed to 201.234.X.Y  or the other link  (Pool Telmex) if traffic gets SNAT'ed to 190.216.X.Y 
&nbsp;  
&nbsp;  
&nbsp; Thanks for your response! 
&nbsp;  
&nbsp;  
&nbsp;  
&nbsp;  &nbsp;

chris_miller · Answer

I see now...why not just make one pool that has the link for 201.234.x.y and 190.216.x.y. Then, SNAT from within the LB_SELECTED event so if the chosen pool member is the 201.234.x.y link, we use that address.

glenn_32974 · Answer

Sounds good! sorry for the delay in the response!  
&nbsp;  
&nbsp; Let me see how can I work this irule out... I'm nor really an expert 
&nbsp;  
&nbsp; Thx Chris

chris_miller · Answer

I'd do the following: 
  
 1. Define snat pool that contains address 201.234.x.y, let's call it "snatpool_201" 
 2. Define snat pool that contains address 190.216.x.y, let's call it "snatpool_190" 
 3. Create pool that contains gateway for "201.234.x.y and 190.216.x.y" 
 4. Create Virtual Server with the above as default pool. 
  
 Use a rule like this:

when LB_SELECTED {
if { [LB::server addr] eq 190.216.x.y } {
snatpool snatpool_190
} elseif { [LB::server addr] eq 201.234.x.y } {
snatpool snatpool_201 } }

That should compile...let me know if it doesn't.

Forum Discussion

Direct traffic to proper pool after being snat'd!

6 Replies

Recent Discussions

Chrome V 124+ on MacOS - Virtual Server Access Issue

F5 Rseries HA

Need advise to setup a policy on F5

F5 Rseries R2600 Tenant sizing

Can iRule mask the payload content on event logs of security

Related Content

Getting Started with iRules: Directing Traffic

fellow traffic

Direct connect 2 rSeries

DoubleFinger Crypto Stealer, CISA directive - June 10th - June 16th -This Week in Security

Block traffic