NAT and SNAT
Concepts
SNAT rewrites the client source address on outbound traffic. Three options exist on a virtual server: None (source preserved, so the server must route back through the BIG-IP), Automap (source rewritten to the self IP of the VLAN the traffic egresses), and a SNAT pool (one of a defined set of translation addresses). SNAT translation addresses are created as ltm snat-translation objects and grouped into a SNAT pool; a virtual server references either the pool or a SNAT list for finer control of source ranges.
Standard NAT is the inbound 1:1 case: an original address and translation address pair, optionally with port translation, letting external clients reach an internal server. NAT is evaluated before virtual server matching, so overlapping addresses cause confusing results.
Traps
- Automap with several self IPs on the egress VLAN picks one, and the choice may surprise you; a SNAT pool is deterministic.
- A SNAT pool address must be free - it cannot be a virtual server address or otherwise already in use.
- Traffic between client and server on the same subnet may bypass the BIG-IP unless SNAT forces the return path through TMM.
- Hairpin cases, where the server must reply through the BIG-IP, require SNAT, not just a pool.
- Source-address persistence and SNAT are different features that are often confused.
Worked example
tmsh create ltm snat-translation 203.0.113.20
tmsh create ltm snatpool outbound members add { 203.0.113.20 }
Then set the virtual server's source-address-translation to snat outbound. Verify with tmsh show ltm snatpool and a capture on the server side - the source should be 203.0.113.20.
Rule of thumb: Automap means whatever self IP leaves that VLAN; a SNAT pool means always this address. If the server's default gateway is not the BIG-IP, you need SNAT.