nerdexam
F5

101 · Question #213

A BIG-IP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set

The correct answer is B. 150.150.10.11. When a client from the 200.200.1.0/24 range sends an HTTPS request, the standalone SNAT configured for that source address range applies, translating the source IP to 150.150.10.11 before forwarding to the pool member.

Section 2: F5 Solutions and Technology

Question

A BIG-IP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set for a source address range of 200.200.1.0 / 255.255.255.0. All other settings are at their default states. If a client with the IP address 200.200.1.1 sends a request to https://150.150.10.10, what is the source IP address when the associated packet is sent to the pool member.

Options

  • A200.200.1.1
  • B150.150.10.11
  • CFloating self IP address on VLAN where the packet leaves the system
  • DFloating self IP address on VLAN where the packet arrives on the system

How the community answered

(25 responses)
  • A
    20% (5)
  • B
    56% (14)
  • C
    16% (4)
  • D
    8% (2)

Why each option

When a client from the 200.200.1.0/24 range sends an HTTPS request, the standalone SNAT configured for that source address range applies, translating the source IP to 150.150.10.11 before forwarding to the pool member.

A200.200.1.1

The original client IP is only preserved when no applicable SNAT exists, but the standalone SNAT explicitly covers the 200.200.1.0/24 source range and overrides pass-through behavior.

B150.150.10.11Correct

The standalone SNAT object is configured to translate traffic from the 200.200.1.0/24 range to the address 150.150.10.11. Since the client IP 200.200.1.1 falls within that range, BIG-IP applies this SNAT when the packet is forwarded to the pool member. The port 443 virtual server has no SNAT of its own, so the matching standalone SNAT is applied independently of the virtual server configuration.

CFloating self IP address on VLAN where the packet leaves the system

The floating self-IP on the egress VLAN is the translation address used by SNAT automap, which is configured only on the port 80 virtual server, not on the port 443 virtual server handling this HTTPS request.

DFloating self IP address on VLAN where the packet arrives on the system

BIG-IP does not use the ingress VLAN's floating self-IP as a SNAT translation address under any standard configuration; SNAT automap always selects from self-IPs on the egress VLAN.

Concept tested: BIG-IP standalone SNAT precedence over virtual server SNAT

Source: https://support.f5.com/csp/article/K7820

Topics

#SNAT#SNAT automap#SNAT precedence#source IP translation

Community Discussion

No community discussion yet for this question.

Full 101 Practice