Forum Discussion

Chip_Tesch_1839's avatar
Chip_Tesch_1839
Icon for Nimbostratus rankNimbostratus
Mar 19, 2009

LC balancing inbound and outbound static NAT

I have a situation in which I need to link balance two ISP links for several “inside” firewalls. Servers behind the firewalls initiate traffic outbound to the Internet, through the Big-IP Link Controllers. Some of the Internet service providers expect one of the two specific IP addresses (one each ISP’s address space) in order to accept a service request. I can only define NAT for one of the two ISP addresses – trying to use ISP2’s address, after setting up NAT with ISP1’s address, I get the “duplicate index” error on the inside address (the firewall’s outside address).

 

The problem with using a static NAT in this scenario, obviously, is if the Link Controller balances the outbound connection through ISP2’s link, (1) the ISP2 router will not forward an “invalid” source address, and also (2) the return traffic will only ever use ISP1.

 

Is there a way, perhaps using an iRule, to specify an outbound, destination NAT address to use for a session, after the link balance decision is made, from an address in the selected ISP’s address space?
config
design

3 Replies

Sort By
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Mar 19, 2009
    LC should always use SNAT automap for outbound traffic, rather than a NAT. Automap will pick the self-ip to use from the correct ISP space corresponding to each link. It should be applied to your outbound wildcard (0.0.0.0) virtual server(s).

     

     

    Denny
  • Chip_Tesch_1839's avatar
    Chip_Tesch_1839
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2009
    Thanks for your reply. It will use SNAT Automap, but the issue there is that all users will use the same outbound IP address, rather than a specific one we'd like to assign to specific services. In other words, all inside users would appear to be the authorized address. Granted, there is more security than just IP address, but we'd like to be able to specify outbound IP addresses, as we can with inbound, for access to these services. We're wondering if anyone has been able to achieve that.

     

    Thanks again for your reply.