Excellent article that details how to Extend/Resize your F5 LTM VM Partitions: http://pastebin.com/S2ZzyvtB
Interesting infographic Website that explains some stats of the Conflict: www.countthekids.org
F5 LTM is quiate a complicated product with regard to how it can effect the traffic as it passes through.
This is a simple explanation of how the Source IP address of a request may change based on the chosen configuration options for a Virtual server or NAT destination.
The Source IP may change or remain the same. The change may be becuse of either:
- SNAT List entry
- SNAT Pool entry
- NAT entry
Also bear in mind that if there is a Virtual Server and NAT destination object that both reference the same IP and port the Virtual Server is preferred – but the NAT setting may still take place if no specific configuration in the Virtual server config.
Reading the Documentation on SNAT and comparing it to what you see in the GUI is not easy.
Firstly it’s important to know the purpose of SNAT with regard to direction.
Inbound Connections (typically from Internet to the F5) will use the referenced SNAT address to become the new source IP (outbound from the F5) as seen talking to Your Server (or servers). The Source IP address may be affected by the NAT configuration as well or be set to use Automap (use of a Self IP).
Outbound Connections (typically to Internet) will use the referenced SNAT address to become the new source IP (outbound from the F5) as seen talking to an Internet Server. The Source IP address may be affected by the NAT configuration as well.
The key to both of the above is we are talking about egress from the F5 and a change to the source IP only.
Outbound Connections to an Internet Server already have a destination – this remains unchanged – i.e. there is no configuration in the F5 LTM for this – the packets just pass through. However the Source IP may change to a different Source IP because of the SNAT or NAT entry.
So the key however you describe it is SNAT affects the Source IP only.
Now where do you go to create the SNAT….
The GUI has 3 tabs that reference the word SNAT:
- SNAT List
- SNAT Pool
- SNAT Translation List
This is the easiest to create and understand. Its typically a list of Load balanced IP Addresses – that once created is referred by some Virtual Server object – for Inbound purposes.
If you create a SNAT Pool object – it appears listed below on the SNAT Pool Page – but the IP addresses also appear on the SNAT Translation List page (confusing but useful!). The SNAT Translation page can adjust timers and connection limits for the SNAT Pool entries.
A SNAT Pool Object doesn’t reference anything other than the IP Addresses.
A SNAT Pool cant do anything on its own (unlike a SNAT list) – it needs referencing by either a Virtual Server or a SNAT List.
A SNAT List Object has some configuration that isn’t seen anywhere on the SNAT Pool or SNAT Translation Address Page:
- IP Addresses
A SNAT List Object can reference an IP address or SNAT Pool or Automap – effectively it restricts the usage of those objects to specific servers referenced (Origin), VLANs & IP addresses of Client connections. However – the BIGGEST DIFFERENCE is that a SNAT List doesnt needed to be referenced by a Virtual Server to perform a translation. Its kind of like a default SNAT (see here: DevCentral)
SNAT Translation List
First – you don’t need to create or edit a Translation Address List Object unless you want to:
- Name the entries that appear on the Translation Address List Page
- Adjust any of the following for a particular SNAT Pool Address or SNAT List Address:
- Connection Limit
- TCP Idle Timeout
- UDP Idle Timeout
- IP Idle Timeout
Secondly – if you create a SNAT List IP address object or SNAT Pool object – they both appear on the SNAT Translation List page (confusing but useful!). If you create a SNAT List Automap object – it doesn’t appear on the SNAT Translation List page
Disabling a SNAT translation object doesn’t appear to have any impact on an associated overlapping SNAT List entry.
Also creating a SNAT Translation List object has no impact unless there is a corresponding SNAT list object or SNAT Pool entry with the same IP Address.