LTM in one arm mode and snat

Question

i have deployed f5 ltm in single arm mode and for security reasons i have created snat pool.
where my virtual server and the real server are in same subnet, but my snat pool ip is in different subnet.
when i tried initiating traffic from outside traffic is not hitting my real server.
Note: if i give the snat ip in the same subnet of virtual server then the connection is succesfull.
since the snat ip is in different subnet i have put the route in the firewall say for snat subnet gateway is f5 self ip, which is default gateway of our f5 as well as real server&nbsp;
can anyone help me to sort this issue.&nbsp;

skfads_167852 · Answer

Hi kps,&nbsp;
Deviating a little why do you want to SNAT if the virtual &amp; pool are in same subnet?&nbsp;

kps_202810 · Answer

Hi Fahad,
For compliance reason we need to perform snat.
But i would like to know is there any possibility to make it work. &nbsp;

stanislas_piro2 · Answer

Hi,&nbsp;
Your issue is caused by the firewall which drop asymmetric connections. &nbsp;
add a route to the SNAT pool subnet with the F5 self IP as gateway on the real server.&nbsp;

kps_202810 · Answer

Hi stanislas,&nbsp;
Apart from adding route to the real server is there any other way to address this issue.&nbsp;

stanislas_piro2 · Answer

First, validate adding a route resolve the issue.&nbsp;
if the issue is resolved with new route, you need to change your configuration by adding firewall and F5 interfaces or something else...&nbsp;
this is not a F5 issue but an IP issue... &nbsp;

Forum Discussion

LTM in one arm mode and snat

6 Replies

Recent Discussions

F5 Rseries HA

Error when running bigip_command Playbook against LTM : Syntax Error: unexpected argument /bin/sh\n

Can iRule be used to perform exception of IPI category based on Geolocation

Can iRule mask the payload content on event logs of security

minimum tmos software version for connect CIS (openshift)

Related Content

F5 TCP Proxy mode

Explanation of F5 DDoS threshold modes

One-Arm Mode Migration

Understanding F5's Transparent Mode vs Blocking Mode with a Focus on Geo-Blocking

F5 Distributed Cloud (XC) API Security in Out-of-Band Mode using BIG-IP