Applies To:Show Versions
- 14.1.0, 14.0.0
Deploying a Carrier Grade NAT
Overview: The carrier-grade NAT (CGNAT) module
Translation address persistence
Automatic external inbound connection handling
More efficient logging
Network address and port translation
Deterministic assignment of translation addresses
Port block allocation of translation addresses
translation address persistence and inbound connections
Translation addresses are not preserved for the subscriber. Each outbound connection might receive a different translation address. This setting provides the lowest overhead and highest performance.
CGNAT preserves the translation address for the subscriber. When a connection is established, CGNAT determines if this subscriber already has a translation address. If the subscriber already has a translation address, then CGNAT uses the translation address stored in the persistence record, and locates a port for that connection. If no port is available, then CGNAT selects a different address. This setting provides greater overhead on each connection and less performance.
DNAT reserves both addresses and ports for a subscriber; however, persistence might still be of value when a subscriber's deterministic mappings span two translation addresses. In this instance, persistence prefers the same address each time.
CGNAT preserves the translation address and port of the subscriber's connection, so that the endpoint can be reused on subsequent connections. This setting provides Endpoint Independent Mapping (EIM) behavior. Additionally, like the
Persistence Mode, this setting provides greater overhead on each connection and less performance.
About IPv4 prefixes
Creating an LSN pool
- On the Main tab, click.The LSN Pool List screen opens.
- In theNamefield, type a unique name.
- In the Configuration area, for thePersistence Modesetting, selectAddressorAddress Port.
- For theMember Listsetting, type an address and a prefix length in theAddress/Prefix Lengthfield, and clickAdd.If your pool uses deterministic mode, ensure that any address ranges you enter as a member do not overlap another member's prefix address ranges. For example, the address and prefix10.10.10.0/24overlaps10.10.10.0/23.
Configuring an ALG
- On the Main tab, click.
- In the ALG Profiles menu, click an ALG profile.
- ClickCreate.The New Profile screen opens.
- Type a name for the new profile.
- From theParent Profilelist, ensure that the correct parent profile is selected as the new profile.
- Select theCustomcheck box on the right.
- Configure the profile settings.
- ClickFinishedto save the new ALG profile.
Configuring a CGNAT
- On the Main tab, click.The iRule List screen opens.
- In theNamefield, type a 1 to 31 character name, such ascgn_https_redirect_iRule.
- In theDefinitionfield, type the syntax for the iRule using Tool Command Language (Tcl) syntax.For complete and detailed information about iRules syntax, see the F5 Networks DevCentral web site (http://devcentral.f5.com).
Creating a virtual server for an LSN pool
- On the Main tab, click.The Virtual Server List screen opens.
- Click theCreatebutton.The New Virtual Server screen opens.
- In theNamefield, type a unique name for the virtual server.
- From theTypelist, selectPerformance (Layer 4).
- For a network, in theDestination Address/Maskfield, type an IPv4 or IPv6 address in CIDR format to allow all traffic to be translated.The supported format is address/prefix, where the prefix length is in bits. For example, an IPv4 address/prefix is0.0.0.0/0, and an IPv6 address/prefix is::/0.
- In theService Portfield, type*or select* All Portsfrom the list.
- From theVLAN and Tunnel Trafficlist, selectEnabled on. Then, for theVLANs and Tunnelssetting, move the VLAN or VLANs on which you want to allow the virtual servers to share traffic from theAvailablelist to theSelectedlist.
- For theLSN Poolsetting, select the pool that this server will draw on for translation addresses.
- In the Resources area of the screen, for theiRulessetting, select the name of the iRule that you want to assign and using the Move button, move the name from theAvailablelist to theEnabledlist.
Creating a CGNAT
- On the Main tab, click.The Tunnels screen opens.
- ClickCreate.The New Tunnel screen opens.
- In theNamefield, type a unique name for the tunnel.
- In theLocal Addressfield, type the IP address of the BIG-IP system.
- From theRemote Addresslist, retain the default selection,Any.This entry means that you do not have to specify the IP address of the remote end of the tunnel, which allows multiple devices to use the same tunnel.