I am doing load balancing for users accessing an application servers.
In basic configuration the application servers see the source IP of the users as the VIP of thier group and not the original client source IP.
Is there a way to disable the NAT and what implications can this have on the load balancing?
Thanks in advance,
Source NAT is usually disabled by default...
What device are you using (CSS,CSM...)?
How does the config look like?
Possible situations when you need source NAT:
1. if you need server-to-server load-balancing, or
2. when you have one-arm load-balancer topology and you want returning traffic to hit load-balancer first and not to go directly to the client...
The configuration is really big.
I am using CSS11501, here is a sample of a service and content configurations.
The address being shown in the servers is the 192.168.30.150.
ip address 192.168.30.152
add service ?????????
vip address 192.168.30.150
add service ?????????
On CSS by default source nat is disabled.CSS changes the destination ip (from VIP to real server ip) and preserves the source IP when a content rule is hit.
If you are not seeing source IP of traffic hitting real server as Client IP then source NAt (source group) is configured on your CSS.
The source group config is to nat traffic initiated by the server or to nat the client ip when traffic hits a content rule.
source group config looks like the following
vip address 192.168.30.152
add service destination server1
add service destination server2
If you are running CSS in one arm mode then source natting is necessary to ensure that the return traffic from real servers doesnt bypass CSS.
I have css11501 in one armed mode, balancing 3servers. Now the client requirement is that servers should get client's ip as the source address. How can i make this possible..
Can I achieve this, if source natting is removed and server's gateway address changed to Vip.
If the clients do not belong to the same subnet where real servers are then yes changing the default gateway on reals to CSS circuit ip will do.
If clients belong to the same subnet then the return traffic will bypass CSS and hence will cause problems. This can be controlled by using source nat just for traffic originating from this subnet.
Syed Iftekhar Ahmed