BIG-IP : virtual-server configuration for snat

On vip-external-01 , is it also necessary to enable vlan-internal-01 ?

 

No. Only the ingress VLAN needs to be enabled.

 

And on vip-internal-01 , is it also necessary to enable vlan-external-01 ?

 

No. Same reason.

 

More generally speaking, how to configure a simple network to support browser-client request sent to vip and the routed to destination web-server with response following the reverse path back ?

 

The simplest answer is a VIP pointing to a pool and an applied SNAT. You can optionally enable/disable specific VLANs to limit ingress traffic, but it's not absolutely required. The SNAT guarantees return routing.

 

When I create my SNAT Pool, should it consist of one or more Self IPs ? Is a SNAT Pool just a collection of Self IPs that BIG-IP dynamically selects and assigns as the request's origin IP ?

 

A SNAT pool should NOT consist of self-IPs. It should rather contain a list of IP addresses (not self-IPs) in the desired subnet. Further, the IPs in the SNAT pool are not actually dynamically selected. Generally, one IP is used until it reaches port exhaustion.

 

the concept is bigip is default deny device. to allow traffic passing through bigip, object listener is required. there are 3 object listners (i.e. virtual server, snat and nat). the object listener is listening on ingress vlan. snat is also available under virtual server configuration (i.e. snat automap, snatpool).

 

sol9038: The order of precedence for local traffic object listeners

 

http://support.f5.com/kb/en-us/solutions/public/9000/000/sol9038.html

 

for snat automap, selfip on egress vlan will be selected.

 

sol7336: The SNAT Automap and self IP address selection

 

http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7336.html

 

Hi all,

 

I need to configure SNAT pool instead of automap.

 

With "One Arm" configuration and two different Subnet for VIPs and Servers, which SNAT pool IP/Subnet is better to configure?

 

Related to VIP Subnet, related to Servers Subnet or whatever?

 

Thanks in advance

 

Brgds