201 · Question #81
A BIGIP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set…
The correct answer is B. 150.150.10.11. The client's HTTPS request matches an explicit SNAT entry configured to translate source IPs from the 200.200.1.0/24 range to 150.150.10.11, overriding any virtual server specific SNAT automap settings for this particular flow.
Question
A BIGIP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set for a source address range of 200.200.1.0 / 255.255.255.0. All other settings are at their default states. If a client with the IP address 200.200.1.1 sends a request to https://150.150.10.10, what is the source IP address when the associated packet is sent to the pool member.
Options
- A200.200.1.1
- B150.150.10.11
- CFloating self IP address on VLAN where the packet leaves the system
- DFloating self IP address on VLAN where the packet arrives on the system
How the community answered
(13 responses)- A8% (1)
- B77% (10)
- C15% (2)
Why each option
The client's HTTPS request matches an explicit SNAT entry configured to translate source IPs from the 200.200.1.0/24 range to 150.150.10.11, overriding any virtual server specific SNAT automap settings for this particular flow.
The client's source IP 200.200.1.1 falls within the explicitly configured SNAT range, so it will be translated, not preserved.
An explicit SNAT with the translation address 150.150.10.11 is configured to apply to source IP addresses within the 200.200.1.0/24 range, which includes the client's IP 200.200.1.1. This explicit SNAT takes precedence and translates the source IP to 150.150.10.11 for packets sent to the pool member.
SNAT automap is not configured on the 443 virtual server, and an explicit SNAT matches the client's source IP, so the floating self IP on the egress VLAN is not used here.
SNAT automap is not configured on the 443 virtual server, and an explicit SNAT matches the client's source IP, so the floating self IP on the ingress VLAN is not used here.
Concept tested: BIG-IP SNAT precedence and configuration
Source: https://techdocs.f5.com/en-us/bigip-15-0-0/big-ip-traffic-management-concepts/source-network-address-translation-snat-concepts.html
Topics
Community Discussion
No community discussion yet for this question.