nerdexam
F5

101 · Question #100

The partial configuration below includes an iRule, a virtual server, and pools. When traffic from the client at 160.10.10.10:2056 connects to the virtual server Test_VS and sends an HTTP request, what

The correct answer is E. 10.10.10.1. In F5 iRules, TCP::local_port in the CLIENT_ACCEPTED event returns the virtual server's listening port, not the client's source port, which determines SNAT pool selection.

Section 2: F5 Solutions and Technology

Question

The partial configuration below includes an iRule, a virtual server, and pools. When traffic from the client at 160.10.10.10:2056 connects to the virtual server Test_VS and sends an HTTP request, what will the client's source address be translated to as the traffic is sent to the chosen pool member? pool Test_Pool { member 10.10.10.10:80 member 10.10.10.11:80 } snatpool lower_range { member 10.10.10.1 } snatpool upper_range { member 10.10.10.2 } rule Test_iRule { when CLIENT_ACCEPTED.{ if { [TCP::local_port] < 2024 }{ snatpool lower_range } else { snatpool upper_range } virtual Test_VS { destination 200.10.10.1 :http pool Test_Pool rule Test_i Rule }

Options

  • A160.10.10.IOC.160.10.10.10
  • BIt could be either 10.10.10.10 or 10.10.10.11.E.It could be either 10.10.10.10 or 10.10.10.11.
  • C10.10.10.2
  • D200.10.10.1D.200.10.10.1
  • E10.10.10.1

How the community answered

(37 responses)
  • A
    16% (6)
  • B
    8% (3)
  • C
    3% (1)
  • D
    3% (1)
  • E
    70% (26)

Why each option

In F5 iRules, TCP::local_port in the CLIENT_ACCEPTED event returns the virtual server's listening port, not the client's source port, which determines SNAT pool selection.

A160.10.10.IOC.160.10.10.10

160.10.10.10 is the original client source IP - the iRule explicitly assigns a SNAT pool, so the source address will be translated away from the original client IP.

BIt could be either 10.10.10.10 or 10.10.10.11.E.It could be either 10.10.10.10 or 10.10.10.11.

10.10.10.10 and 10.10.10.11 are destination pool members in Test_Pool, not SNAT pool addresses used for source IP translation.

C10.10.10.2

10.10.10.2 is the upper_range SNAT pool member, which would be selected only if TCP::local_port were 2024 or greater; since the virtual server listens on port 80, the lower_range pool is chosen instead.

D200.10.10.1D.200.10.10.1

200.10.10.1 is the virtual server's destination VIP address used for inbound traffic matching, not a SNAT translation address for source IP replacement.

E10.10.10.1Correct

The iRule evaluates TCP::local_port, which in the CLIENT_ACCEPTED context returns the virtual server's local listening port (80/http as defined in the destination 200.10.10.1:http), not the client's source port of 2056. Because 80 is less than 2024, the condition is true and the lower_range SNAT pool is selected, translating the source address to its sole member 10.10.10.1.

Concept tested: F5 iRule TCP::local_port vs client source port in SNAT pool selection

Source: https://clouddocs.f5.com/api/irules/TCP__local_port.html

Topics

#iRules#SNAT pool#port-based selection#source NAT

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 101 Practice