Forum Discussion

ken_wolff_10732's avatar
ken_wolff_10732
Icon for Nimbostratus rankNimbostratus
Sep 20, 2006

Snatted address replacement

Is there a way to retain the actual client address and replace the snatted address with the actual client address when responding back to the client? I need the snat, but want to tell the client the actual address (for it's logging funtion), not the snatted one.

 

 

For example:

 

Client request>> to External BigIP VLAN

 

Change to snatted address>> send out to domain controller

 

<<

 

Thanks, Ken

 

 

 

when CLIENT_ACCEPTED {

 

if { [IP::addr [IP::client_addr] equals xxx.xxx.xxx.yyy] } {

 

replace snatted address and substitute actual client address on return to client

 

}}
application delivery
dev
devops
iRules

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Sep 22, 2006
    By default using SNAT forces the BIG-IP to replace the source IP address on requests it sends to the pool. The BIG-IP automatically undoes the translation when it responds back to the client to ensure the client accepts the response.

     

     

    Could you provide more detail on what exactly you are trying to accomplish?

     

     

    Why is the client going through the BIG-IP to talk with a domain controller? Why is the request then going to the internal VLAN when the original request came into the BIG-IP over the external VLAN? What traffic are you trying to load balance? What is the full path the traffic is taking and what objects on the BIG-IP do you want the traffic to go through (VIPs, SNAT's, etc)?

     

     

    Aaron
  • ken_wolff_10732's avatar
    ken_wolff_10732
    Icon for Nimbostratus rankNimbostratus
    Sep 22, 2006
    The client is doing an 802.1x (PEAP) authentication via radius servers to the domain controller. So the sequence is laptop request>Cisco Switch>BigIP>Radius>active directory. The problem comes in when the radius is not local (is not on the internal VLAN). The request has to be snatted to go to a remote radius. The radius log entry then shows a snatted address for the Cisco Switch i.e. a generic address instead of a specific address. This is a security issue.

     

    I would like to find a way to capture the Switch address, and send that to the radius instead of the snat address. If that could work, then we could use remote radius servers. Hope that is clearer. Thanks, Ken

     

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Sep 25, 2006
    You could recraft the packet, inserting an attribute-value pair using the type 4 NAS-IP-Address attribute, with the value being the *real* IP of the switch. Note that your client NAS as defined on your radius server will be the source IP address of the packet, or your SNAT address. Reference rfc 2865 for additional options with radius attributes.