SNAT using specific IP based on the client IP range

Question

I'm needing to use an iRule to determine if a client connection comes from IP 10.1.0.0/25 then SNAT using a specific IP instead of the default AutoMap SNAT IP.  I found the iRule below and have tried several variations of it, to no avail.  I'm running 11.6.0 HF6 on a test LTM.  I can't even save the iRule below without getting errors, even though the iRule below, as I mentioned, is just a starting point.  Also, I'm not good at iRules so I'm not trying to get complicated.  
&nbsp;
This is the iRule I used as my starting point:&nbsp;
when CLIENT_ACCEPTED {
    if { [IP::addr [IP::client_addr] equals 10.0.0.1] {
        snat 172.18.1.1
    } elseif { [IP::addr [IP::client_addr] equals 10.0.0.2] } }{
        snat 172.18.1.2
    } elseif { [IP::addr [IP::client_addr] equals 10.0.0.3] } }{
        snat 172.18.1.3
    }
}&nbsp;
This is essentially what I would like to accomplish:
when CLIENT_ACCEPTED {
    if { [IP::addr [IP::client_addr] equals 10.1.0.0/25] {
        snat 10.1.5.5
    }
}&nbsp;
I'm assuming, in my example above, that if my client IP does NOT equal 10.1.0.0/25 then it would NOT SNAT using 10.1.5.5 and instead would default to the configured AutoMap IP.  This is basically what I'm trying to accomplish.  
&nbsp;
To put it another way, if my client comes from within my organization, I want to SNAT using IP A, if my client comes from outside my organization, I want to snat using IP B.  &nbsp;

niels_van_sluis · Answer

Here is an example:
if { [IP::addr [IP::client_addr] equals 10.1.0.0/25] } {
    snat 10.1.5.5
}
else {
    snat automap
}

amine_kadimi · Answer

If it is OK for you, you can use two VS with same destination IP, same port, but different source addresses, one with 10.1.0.0/25 and the other with 0.0.0.0/0. The most specific will match first if client comes from 10.1.0.0/25, the less specific will match other connections. You then can play with the SNAT setting without an irule.

jose_nelson_206 · Answer

Amine,
Thank you for this suggestion.  It may indeed be something I can use in the future.  I'll have to try it in my test environment.  For the time being I will need to stick to finding an iRule method.  &nbsp;

kevin_davies_40 · Answer

when CLIENT_ACCEPTED {      
   if { [IP::addr [IP::client_addr] equals 10.1.0.0/25]} {        
     snat 10.1.5.5          
   }       
 }

kevin_davies_40 · Answer

You were close just missing a close brace at the end of the if condition.&nbsp;

Forum Discussion

SNAT using specific IP based on the client IP range

7 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

Enhance your Application Security using Client-side signals

irule to Redirect client from specific Public IP to a specific node

SSL Orchestrator Advanced Use Cases: Client Certificate Constrained Delegation (C3D) Support

find specific SNMP OID

iRule based RADIUS Client Stack