Forum Discussion

jrmorris_151361's avatar
jrmorris_151361
Icon for Nimbostratus rankNimbostratus
Apr 29, 2015

Log server on in-line network

I am running an inline model in my f5 environment. One external network for VS, one internal for nodes. Everything is fine except when I have a node on the internal network that needs to communicate with another node on the internal network. I obviously get an asymmetric routing issue. I can overcome this by using an iRule that does selective SNAT. My issue is that some servers on this internal network (log servers, smtp servers, authentication servers) actually need the source address preserved for obvious reasons.

 

I have thought of a few ways to get around this but am looking for more help (other ideas, iRule help).

 

  1. Use iRule to SNAT traffic to the VS address. This would at least allow the log collector to know what pool the message came from.
  2. SNAT traffic to pre-determined SNAT pool. So if I have 10.10.1.0/24, I could create a one-to-one SNAT pool using 10.10.2.0/24. Users would then know to where to lok if they saw 10.10.2.100 in a log entry.
  3. Create an iRule that examines the actual source address, then increments the third octet (I'm using networks bigger than a /24) and SNATs traffic to the incremented address. Basically the same method as 2 just without multiple SNAT pools.

I am definitely open to other methods as well. Thanks.

 

2 Replies

  • Everything is fine except when I have a node on the internal network that needs to communicate with another node on the internal network. I obviously get an asymmetric routing issue.

     

    what ip does node talk to? isn't it another node ip? if yes, doesn't normal ip forwarding virtual server (no snat) work?

     

  • Both nodes are on the internal network, 10.200.48.0/21. Node1 talks to node2 through node2's VS. When node2 responds to node1, it does so via L2 directly to node1, not through the f5. So SNAT would work, but I can;t maintain source IP for my log server that way.