Richard_Schmit_
Nimbostratus
NimbostratusSnat automap and pool selection based on source and destination Ip
Trying to figure out an I-rule that will work for the follwing:
I have 3 ISP’s I’m load balancing to for outbound traffic. I have specific Virtual servers set up for specific outbound traffic.
For instance, a separate one for each outbound IPSEC lan-to-lan connection based on the remote IP peer address.
Each of these is further broken down as separate VS such as one for IPSEC (ALL Protocols) one for UDP 500, and one for UDP 4500...etc.
I also have an outbound catchall virtual server…basically if none of the other virtual servers are a more specific match, it will use this vs.
This particular vs has a pool with two addresses…One is the gateway router for the "ISP 'A' router” with a priority of 2, and the other with an IP of the "ISP 'B' router” with a priority of 1. So basically all 'other' traffic goes out ISP 'A' unless it is down, then it goes out ISP 'B'.
This VS also uses Snat Automap….which allows the return traffic to come back on the appropriate ISP link because the source IP is snat'd to whatever the next hop router is.
The problem I’m having, is that I have an internal router that needs to be able to ping 8 different remote servers (all with public ip’s). Those 8 external servers need to see the source address of the internal router so I cannot use SNAT AutoMap for these 8 remote IP's.
I could create 8 separate virtual servers each with it’s own destination IP and no SNAT and be done, but I’m trying to figure out if there is another way?
I started an I-Rule, but this is my first and I keep getting errors, so not sure what is wrong or even if it will work.
rule snat.rule
when CLIENT_ACCEPTED {
if {([IP::addr [IP::remote_addr] equals "11.12.20.10/32"] or ([IP::addr "[IP::remote_addr]" equals "63.24.13.1/32"] or
[IP::addr "[IP::remote_addr]" equals "63.21.24.23/32"] or [IP::addr "[IP::remote_addr]" equals "24.16.66.107/32"] or
[IP::addr "[IP::remote_addr]" equals "204.14.17.23/32"] or [IP::addr "[IP::remote_addr]" equals "20.14.172.23/32"] or
[IP::addr "[IP::remote_addr]" equals "4.14.21.12/32"] or [IP::addr "[IP::remote_addr]" equals "206.1.23.21/32"] and
[IP::addr "[IP::local_addr]" equals "6.10.1.26/32"]))}
{
snat none pool windstream_router_pool
else
{
snat automap pool Pool-Outbound_EverythingElse
}
}
}
Basically if the internal router (6.10.1.26) inside the Link Controller is trying to ping any of the 8 external addresses, then the source IP needs to stay as 6.10.1.26 and use existing pool called windstream_router_pool otherwise for all other traffic that doesn't match a more specific Virtual server, use snat automap and use an existing pool that loadbalances between the ISP routers.....I'm also getting confused on all the brackets, so not 100% sure these are all correct.
