What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?

Short answer

With the Default (default) option, TR7 connects to the Backend Service with its own IP; the source address is the Interface IP, in the same subnet as the server (or as the gateway, if it is reached through a gateway), of the interface from which the traffic to the server exits in the Backend Service's Route Table. With Use Device IP, the source is a specific TR7 IP selected in the SNAT IP field. With Use Client IP, TR7 connects to the server with the client's IP; for this, the responses must return from TR7 (the server's default gateway is TR7, or Spoofing). The options apply on HTTP and L7 TCP vServices; on a Network vService, the LB Mode is decisive.

How Does It Work?

Option	Source seen by the server	Additional field	Requirement
Default	The Interface IP, in the same subnet as the server (or as the gateway, if it is reached through a gateway), of the interface from which the traffic to the server exits in the Route table; in a cluster, each device's own Interface IP	None	None
Use Device IP	The selected TR7 IP	SNAT IP (the list is limited to the IPs in the Backend Service's Route table; the first address is selected automatically)	The IP must be defined in the Route table
Use Client IP	The client's IP (no SNAT is performed)	Spoofing and the related fields (Spoofing IP VIP Condition, Spoofing Default Device, Spoofing IP)	The responses must return from TR7

Example: TR7, which has the Interface IP 192.0.2.5/24 in the Route table, connects to the server 192.0.2.20 with 192.0.2.5 in Default; if 192.0.2.6/24 is added to the same interface and selected in Use Device IP, it connects with 192.0.2.6, and in Use Client IP, with the client's address (e.g. 198.51.100.45). While there are multiple IPs in that subnet, which one is used in Default cannot be inferred from the order on the interface; if a specific address is needed, Use Device IP is selected.

When to Use Which?

• Default: Most installations; no change is required on the server or in the network. On HTTP, the client IP is carried with X-Forwarded-For (How do I see the real client IP on the backend?).
• Use Device IP: If the server firewall or application expects a specific source address, or if the source has to be fixed while there are multiple IPs in TR7's Route table.
• Use Client IP: If the client IP is needed at the connection level (non-HTTP protocols, IP-based access control) and the return traffic can be directed to TR7 (Is it possible to work without SNAT (transparent mode); what are the requirements?).

In TR7

• Location: Load Balancer → Backend Services (or Backend Groups) → Edit → Details → SNAT; on a Backend Group, the selection is applied to all the servers in the group.
• View: In the Details tab of the Backend Service preview, the SNAT row shows the selected option or IP; if it is not defined, Default is written, and in a cluster, if the values of the two devices differ, they are shown in two columns (Details rows).
• Verification on the server side: On the server, the source address of the incoming connections is checked with tcpdump -n 'tcp[tcpflags] & tcp-syn != 0'.
• Cluster: The change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Common Misconceptions

• "The SNAT option also determines the source of the health check." The source of the health check is selected separately with the Health Check Source IP field (Which source IP are health check packets sent from; can I change it?).
• "With Default, the IP of the first interface in the route table is used." The source is not the first interface IP in the route table; it is the Interface IP of the interface the traffic to the server leaves from, in the same subnet as the server (or as the gateway, if the server is reached through a gateway).
• "If the IP in Use Device IP is deleted, a warning is given." The source address starts to be determined according to the Default rule.
• "Spoofing is used with every option." Spoofing appears only while Use Client IP is selected.
• "It also applies on a Network vService." The Network vService does not use this field; the LB mode and the SNAT IP on the vService are decisive.

How it is done in the documentation

• Backend Services · SNAT
• Backend Services · Use Device IP
• Backend Services · Spoofing
• Backend Services · Health Check Source IP

Related questions

• What does "Default" in the SNAT field mean; can I choose a specific SNAT IP?
• What is SNAT, and why is it used by default?
• Is it possible to work without SNAT (transparent mode); what are the requirements?