101 · Question #213
A BIG-IP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set
The correct answer is B. 150.150.10.11. When a client from the 200.200.1.0/24 range sends an HTTPS request, the standalone SNAT configured for that source address range applies, translating the source IP to 150.150.10.11 before forwarding to the pool member.
Question
A BIG-IP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set for a source address range of 200.200.1.0 / 255.255.255.0. All other settings are at their default states. If a client with the IP address 200.200.1.1 sends a request to https://150.150.10.10, what is the source IP address when the associated packet is sent to the pool member.
Options
- A200.200.1.1
- B150.150.10.11
- CFloating self IP address on VLAN where the packet leaves the system
- DFloating self IP address on VLAN where the packet arrives on the system
How the community answered
(25 responses)- A20% (5)
- B56% (14)
- C16% (4)
- D8% (2)
Why each option
When a client from the 200.200.1.0/24 range sends an HTTPS request, the standalone SNAT configured for that source address range applies, translating the source IP to 150.150.10.11 before forwarding to the pool member.
The original client IP is only preserved when no applicable SNAT exists, but the standalone SNAT explicitly covers the 200.200.1.0/24 source range and overrides pass-through behavior.
The standalone SNAT object is configured to translate traffic from the 200.200.1.0/24 range to the address 150.150.10.11. Since the client IP 200.200.1.1 falls within that range, BIG-IP applies this SNAT when the packet is forwarded to the pool member. The port 443 virtual server has no SNAT of its own, so the matching standalone SNAT is applied independently of the virtual server configuration.
The floating self-IP on the egress VLAN is the translation address used by SNAT automap, which is configured only on the port 80 virtual server, not on the port 443 virtual server handling this HTTPS request.
BIG-IP does not use the ingress VLAN's floating self-IP as a SNAT translation address under any standard configuration; SNAT automap always selects from self-IPs on the egress VLAN.
Concept tested: BIG-IP standalone SNAT precedence over virtual server SNAT
Source: https://support.f5.com/csp/article/K7820
Topics
Community Discussion
No community discussion yet for this question.