Ok:
Your client address: 1.1.1.1 srcpt:123 dest: 123
Server address: 2.2.2.2 srcprt: 123 destport: 123
The css has to maintain a table:
Src Address SPort Dst Address DPort NAT Dst Address Prt InPort OutPort
--------------- ----- --------------- ----- --------------- --- --------- ---------
1.1.1.1 123 2.2.2.2 123 3.3.3.3 TCP e1 e2
The CSS does NAT and not PAT by default. Thus the translation is swapping the dest address for the service address on the back end.
The server on the back end replies back to the host which passes back through the CSS, who un-nats the address to the VIP address. Thus the client always sees the request coming from the VIP and not the server.
You need to nat the device on the back end. How can the CSS send the packet to the server address with out translating the client's request to the VIP. If you did not translate the client would send the request to the server(s) directly (voiding the need for the CSS). Or the CSS would forward the request unaltered to who, the destination address is the VIP still.
You have people send request to the VIP so you can hide the services from the user. This allows seemless maintanence of devices by using NAT and service intelligence.
The vip getting the request from the client then must pass the packet to the server. As a result the address (destination) MUST change from the VIP address (client request) to the Nat address of the server behind the CSS (css transmitted client request).
How can you load balance a request if the destination address is not changed?
