Forum Discussion

quickref_74249's avatar
quickref_74249
Icon for Nimbostratus rankNimbostratus
Oct 05, 2010

SNAT with Data group list

Hi,

 

 

i searched the forum already and according to the posts i found i can't find the problem with my setup.

 

We use source NAT per default in our environment. therfore we have created a pool called 'ServerSNATpool'

 

As on some of our vs the traffic volume is very high i'd like to create an irule to nat certain ip addresses to a different NAT pool, mainly for troubleshooting F5 to server issues.

 

 

Here's my config

 

 

class BAC {

 

host 213.70.140.9%1

 

}

 

 

rule BAC_NAT {

 

when CLIENT_ACCEPTED {

 

if {[matchclass [IP::client_addr] equals $::BAC]}{

 

snatpool AC_TEST

 

} else {

 

snatpool ServerSNATpool

 

}

 

}

 

}

 

 

snatpool AC_TEST {

 

members 172.24.96.239%1

 

}

 

 

snatpool ServerSNATpool {

 

members {

 

172.24.96.240%1

 

172.24.96.241%1

 

172.24.96.242%1

 

172.24.96.243%1

 

172.24.96.244%1

 

172.24.96.245%1

 

172.24.96.246%1

 

172.24.96.247%1

 

172.24.96.248%1

 

172.24.96.249%1

 

172.24.96.250%1

 

172.24.96.251%1

 

172.24.96.252%1

 

172.24.96.253%1

 

172.24.96.254%1

 

}

 

 

i have applied the Irule but even traffic from ip's listed in the group BAC is natted to snatpool ServerSNATpool.

 

I have verified this on a test VS with a tcpdump.

 

Can i set some kind of logging to see what's going wrong?

 

 

Thank you

 

application delivery
dev
devops
iRules

3 Replies

Sort By
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Oct 05, 2010
    Is this a new iRule? The rule would only be processed for new connections so if you had a proxy/firewall behind this VS that always had traffic flowing through it, the rule might never take action.

    If you want to add a log statement, you could do so right underneath your "when CLIENT_ACCEPTED" event.

    Something like: 

    
log local0. "Client address was [IP::client_addr]"
  • quickref_74249's avatar
    quickref_74249
    Icon for Nimbostratus rankNimbostratus
    Oct 14, 2010
    Thanks for your reply. i was busy with other things that's why i reply that late. It is an existing Irule which i modified. It was already applied to the VS. I will test the logging to see what's going on.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Oct 14, 2010
    If you're on 9.4.4 or higher, you should change the matchclass line to remove the $:: prefix from the datagroup name: 

    
    if {[matchclass [IP::client_addr] equals BAC]}{

    You can also add another debug line inside the if statement to see which condition in the rule is being matched: 

    
rule BAC_NAT {
when CLIENT_ACCEPTED {
    log local0. "[IP::client_addr]:[TCP::client_port]: New connection to [IP::local_addr]:[TCP::local_port]"
    if {[matchclass [IP::client_addr] equals BAC]}{
       log local0. "[IP::client_addr]:[TCP::client_port]: Matched BAC datagroup, using AC_TEST snatpool"
      snatpool AC_TEST
     } else {
       log local0. "[IP::client_addr]:[TCP::client_port]: No BAC datagroup match, using ServerSNATpool snatpool"
      snatpool ServerSNATpool
    }
}
}

    Aaron