Forum Discussion

A__N_5261's avatar
A__N_5261
Icon for Nimbostratus rankNimbostratus
Jan 10, 2013

How to Verify SNAT is working ?

HI,

 

 

I have confiugure SNAT. is there any way to veriy . its working or not? . does it maintain any table ?.

 

 

 

 

Thanks & Regards

 

A.N

 

2 Replies

  • i understand you have to check connection table or tcpdump.

    e.g.

    [root@ve10:Active] config  b virtual bar80 list
    virtual bar80 {
       snatpool mysnatpool
       pool foo
       destination 172.28.19.252:80
       ip protocol 6
    }
    [root@ve10:Active] config  b pool foo list
    pool foo {
       members 200.200.200.101:80 {}
    }
    [root@ve10:Active] config  b snatpool mysnatpool list
    snatpool mysnatpool {
       members {
          200.200.200.201
          200.200.200.202
       }
    }
    
     connection table
    
    [root@ve10:Active] config  b conn server 172.28.19.252 show all
    VIRTUAL 172.28.19.252:80 <-> NODE 200.200.200.101:80   TYPE any   1/0
        CLIENTSIDE 192.168.206.33:59234 <-> 172.28.19.252:80
            (pkts,bits) in = (7, 1216)   out = (7, 4962)
        SERVERSIDE 200.200.200.201:59234 <-> 200.200.200.101:80
            (pkts,bits) in = (6, 4922)   out = (6, 1176)
        PROTOCOL 6   UNIT 1   IDLE 2 (300)   LASTHOP external 00:01:e8:d5:d4:47
    
     tcpdump
    
    [root@ve10:Active] config  tcpdump -nni 0.0 port 80
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on 0.0, link-type EN10MB (Ethernet), capture size 108 bytes
    16:22:20.666129 IP 192.168.206.33.59236 > 172.28.19.252.80: S 198530642:198530642(0) win 8192 
    16:22:20.666175 IP 172.28.19.252.80 > 192.168.206.33.59236: S 3936556914:3936556914(0) ack 198530643 win 3780 
    16:22:20.668126 IP 192.168.206.33.59236 > 172.28.19.252.80: . ack 1 win 16695
    16:22:20.668167 IP 200.200.200.201.59236 > 200.200.200.101.80: S 634129559:634129559(0) win 4380 
    16:22:20.669160 IP 192.168.206.33.59236 > 172.28.19.252.80: P 1:625(624) ack 1 win 16695
    16:22:20.669170 IP 200.200.200.101.80 > 200.200.200.201.59236: S 1644104907:1644104907(0) ack 634129560 win 5840 
    16:22:20.669178 IP 200.200.200.201.59236 > 200.200.200.101.80: . ack 1 win 4380
    
  • another option would be to look on one of the nodes, you should any traffic from the F5 originating from the SNAT address. Microsoft have TCPView which is excellent for a visual netstat.