Forum Discussion

Jure_Simsic_106's avatar
Jure_Simsic_106
Icon for Nimbostratus rankNimbostratus
Jan 08, 2007

NAT-like Virtual Server

I have a problem I need to solve. We have our DMZ (net A) with some

 

nodes and a BigIP, with a private net (net B) behind, with load

 

balanced servers there - standard configuration.

 

Now I have a need to do load balancing (actually just fail-over) on

 

some systems in A that couldn't be moved to B. These systems have

 

their default gateway set to the firewall and that can't be

 

changed. What I'd need would be an IP on the LB, that would make

 

requests to nodeA1 or nodeA2 with source IP of the LB, so the boxes

 

would be able to route the traffic correctly - that is, back to LB and

 

from here on back to the client.

 

As in:

 

 

Client -> LB-VIP-A -> nodeA(1|2) -> LB-VIP-A -> Client

 

[request] [response]

 

 

This is needed for internal requests from clients within net A, so

 

unless I can rewrite SRC, the response (syn ack) would go directly to

 

client and the handshake would never be completed (as in client is

 

sending to some virtual IP on LB and getting a response back from

 

another IP)..

 

 

A basic version of this could be done as NAT, but i'd like to have a

 

monitor on for services for fail over and use just one server node at a time, not round-robin. Should I do a standard Virtual

 

Server and rewrite the srcIP with irules or is there another way to

 

handle such requests?

 

So in case of Irules, how would I manage to rewrite the response back to original client IP (dst IP), that information would get lost i guess..

3 Replies

  • Hello,

     

     

    Maybe I don't understand your scenario completely, but couldn't you just create a virtual server that points to a pool of the two nodes and enable SNAT automap on the virtual server so BIG-IP will translate the source address to its own self IP address(es) when sending traffic to the nodes?

     

     

    Aaron
  • I guess that sounds just like something I want. I didn't know about the SNAT automap feateure and will look into it at once.. Thanks
  • We typically snat on the virtual itself by building a snatpool with the virtual server itself as the lone pool member. We do this for troubleshooting purposes and so that only monitor traffic occurs on the self ips.