Network Configuration: VLANs, Self IPs, Routes, and SNAT
Domain 6 - Network Configuration: VLANs, Self IPs, Routes, and SNAT
This domain tests the L2 and L3 underlay and address translation that make virtual servers reachable and pool-member responses returnable.
VLANs and self IPs
A VLAN binds interfaces, tagged or untagged, to a layer-2 broadcast domain. A self IP is an address on a VLAN; it is used for management of that VLAN, for termination of traffic, and as a source for SNAT automap. A floating self IP is active on one device in an HA pair. Port lockdown restricts which services the self IP accepts, such as allow default, allow none, or specific protocols. A self IP is not a virtual server; it does not load balance.
Routes and SNAT
Routes direct traffic off-subnet; the default route is the gateway of last resort. Route domains separate overlapping address spaces. SNAT changes the source address of server-side connections. SNAT automap uses a self IP; a SNAT pool uses a list of translation addresses; a SNAT translation object supports persistence and address ranges. Without SNAT, pool members need a route back to the BIG-IP's source address, otherwise return traffic breaks.
Worked example
Client 192.0.2.50 connects to VS 203.0.113.10:80. Pool member 10.0.0.21 has a default route to 10.0.0.1, not to the BIG-IP. If BIG-IP forwards the client source unchanged, the member replies to 192.0.2.50 via its default gateway, and the path may fail. A SNAT automap or SNAT pool changes the source to a BIG-IP-owned address on 10.0.0.0/24, so the member replies to BIG-IP, which can forward the response.
Traps
- Using a self IP as a virtual server address without creating a virtual server.
- Forgetting return routing for pool members.
- Assuming SNAT automap always chooses the egress VLAN self IP; floating and HA behavior matter.
- Confusing a SNAT pool with a load-balancing pool.
- Overlapping subnets without route domains.
- Ignoring port lockdown when a self IP does not answer an expected service.