What does "Default" in the SNAT field mean; can I choose a specific SNAT IP?

Short answer

The default value of the SNAT field is Default: TR7 does not specify a separate source address for the connection, and the source IP is the Interface IP, in the same subnet as the server, of the interface from which the traffic to the server leaves in the Route Table selected in the Backend Service (if the server is reached through a gateway, the Interface IP in the same subnet as the gateway); in a cluster, each device uses its own Interface IP. For a fixed and specific source IP, Use Device IP is selected in the SNAT field in the Details section and the SNAT IP is set; if the client's own IP is to be used as the source, Use Client IP is selected. The source IP of the health checks is independent of SNAT and is set from the Health Check Source IP field. The SNAT field is applied on HTTP and L7 TCP vServices.

Problem: From Which IP Does the Server See TR7?

In networks where TR7 has more than one IP, the address from which it connects to the Backend Service matters: the firewall, access lists or logs of the server may be set according to a specific source IP. In Default, the source is the Interface IP of the interface leading to the server that is in the same subnet as the server (or the gateway). If more than one IP has been added to the interface in that subnet, which one will be used cannot be inferred from the order on the interface and may change when the IPs are edited; the source address also changes when the route table changes. When a fixed and known address is required, the source IP is selected explicitly. In a cluster with Default, each device connects from its own Interface IP; on the server side, the IPs of both devices are allowed.

Solution: Two Methods

Your situation	Suitable method
The server should see TR7 from a fixed, specific IP	Method 1: Use Device IP
The server should see the real IP of the client	Method 2: Use Client IP

Method 1: Use Device IP Recommended

• How it works When connecting to the Backend Service, TR7 uses the selected SNAT IP as the source address.
• Where it is opened Backend Service → Details → SNAT → Use Device IP → SNAT IP
• Requirement The SNAT IP being defined on an interface in the route table of the Backend Service
• vService type HTTP and L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the Backend Service

On the Load Balancer → Backend Services screen, the Backend Service is selected and Edit is clicked; the Details switch is turned on.

2

Adım 2 Add the SNAT IP (if needed)

If a separate address is to be used for SNAT and this address does not yet exist in TR7, it is first added to an interface in the route table of the Backend Service: Network → Interfaces → Actions → Add IP (how to add); since the form may open with the first interface selected, the correct interface is selected. In a cluster, the IP is defined on both devices.

3

Adım 3 Select Use Device IP

In the Backend Service form, Use Device IP is selected in the SNAT field. The SNAT IP list, which appears only with this selection, contains the IPs in the route table of the Backend Service; the first address in the list comes selected automatically, and the desired IP is selected.

4

Adım 4 Set the health check source (optional)

If the health checks are also to go from the same IP, Device IP is selected in the Health Check Source IP field and the IP is set. The default value of this field is Default, and it is independent of SNAT.

5

Adım 5 Save

The Edit button at the bottom of the form is clicked. The vServices that use the Backend Service are reloaded with the new setting; open connections are not cut, and new connections are opened from the selected SNAT IP. While Clustering is on and Manual Sync Mode is off (default), the setting is transferred to the peer device automatically.

Verification

1Source IPBackend Service side

Commandtcpdump -nn 'tcp dst port 80 and tcp[tcpflags] & tcp-syn != 0'

ExpectedIP 192.0.2.5.40123 > 192.0.2.21.80 (selected SNAT IP)

On the TR7 side, the SNAT and Health Check Source IP rows appear in the preview of the Backend Service.

Method 2: Use Client IP

• How it works TR7 connects to the Backend Service with the IP of the client; the server sees the connection as if it came directly from the client.
• Where it is opened Backend Service → Details → SNAT → Use Client IP
• Requirement The return traffic of the server passing through TR7: TR7 as the default gateway, or Spoofing
• vService type HTTP and L7 TCP

Step-by-Step Configuration

1

Adım 1 Select Use Client IP

In the Backend Service edit form, the Details switch is turned on and Use Client IP is selected in the SNAT field.

2

Adım 2 Provide the return path

The default gateway of the server is set to the IP of TR7 on that network, or Spoofing is turned on in the same form (it appears only while Use Client IP is selected). Details: What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?

3

Adım 3 Save

The Edit button at the bottom of the form is clicked.

Verification

1Access logBackend Service side

Expected198.51.100.45 - - "GET / HTTP/1.1" 200 (IP of the client)

Common Mistakes

• Assuming that Default is a fixed IP. In Default, the source is the Interface IP of the interface leading to the server that is in the same subnet as the server (or the gateway); if there is more than one IP in that subnet, or if the route table or the interface IPs change, the source IP may also change.
• Changing the route table without checking the SNAT IP. The SNAT IP list is filtered according to the route table of the Backend Service; when the table changes, the selection may become invalid.
• Assuming that SNAT is also applied to health checks. The source of the health check is set separately from the Health Check Source IP field; this IP is also allowed on the server firewall.
• Turning on Use Client IP without preparing the return path. The responses bypass TR7 and the connections are not completed.

How it is done in the documentation

• Backend Services · SNAT
• Backend Services · Use Device IP
• Backend Services · Health Check Source IP

Related questions

• What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?
• Which source IP are health check packets sent from; can I change it?
• What is SNAT, and why is it used by default?