Forum Discussion

Herman_Choi_360's avatar
Herman_Choi_360
Icon for Nimbostratus rankNimbostratus
Sep 27, 2007

SNAT for specific Virtual Servers

Hi,

 

 

I have multiple virtual servers on my Big-IP LTM. I also have a standard SNAT object which has a member list. I don't SNAT for all source IP addresses.

 

 

The standard SNAT object SNATs all source IP addresses in its member list, regardless of the virtual servers.

 

 

Is there a way to implement SNAT for some virtual servers and not for others? Do I get rid of the SNAT object?

 

 

I noticed that for each virtual server, you can assign a SNAT pool. What is the point of the SNAT pool? I don't have any SNAT pool assigned to any of my virtual servers.

 

 

Any help on this topic would be appreciated!

 

 

Thank you.

 

 

Herman Choi

 

Art Center College of Design
application delivery
dev
devops
iRules

4 Replies

Sort By
  • johns's avatar
    johns
    Icon for Employee rankEmployee
    Sep 27, 2007
    SNAT Pool allows using more than 1 IP address for SNAT purpose. Since SNAT is Port-Address-Translation, ephemeral ports on single IP will run out (despite having some 65000 ports, it can run out much faster with certain App/protocols) with increased amount traffic, so SNAT pool allows virtually limitless scalability.

     

     

    By assigning SNAT pool or Automap to individual virtual server, you can be selective about which virtual server gets SNAT applied, vs. all. However, if you want to do this for select source IP/client, then you may need to use iRule attached to the virtual server.
  • Herman_Choi_360's avatar
    Herman_Choi_360
    Icon for Nimbostratus rankNimbostratus
    Sep 27, 2007
    Does anyone have an iRule example where you can associate SNAT to selective source IP addresses?
  • Eugene_56688's avatar
    Eugene_56688
    Icon for Nimbostratus rankNimbostratus
    Oct 14, 2008
    How is the performance of the SNAT working out? Are SNATs done at the ASIC?
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Oct 15, 2008
    hermanaccd,

     

     

    You can use the snat (Click here) or snatpool (Click here) commands to apply snat for a specific connection. There are a few examples in the codeshare:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/DestinationSnatUsingDNS.html

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/SelectiveSNAT.html

     

     

    macroscape,

     

     

    I think you still get partial PVA acceleration with a SNAT:

     

     

     

    https://support.f5.com/etc/medialib/kb/pdfs.Par.17692.File.dat/sol4832_9.4-9.4.4.pdf

     

     

    In Virtual Server UI acceleration values are displayed based on the configuration of the virtual server. For example, if you have a virtual server configured with Round Robin and a general SNAT, the b virtual show command displays the acceleration for the virtual as Full. However, in the In Packet Path column, the general SNAT has reduced the virtual server to Assist.

     

     

     

     

    You can get more detail in SOL4832:

     

     

    SOL4832: Overview of Packet Velocity ASIC (PVA) Acceleration features and sub features

     

    (Click here)

     

     

    Aaron