F5 BIG-IPによる
Version 11.3
CGN リリース
11.2以前のIPv4アドレス枯渇及び
IPv6ソリューション
•
Translation
•
NAT44,
with simple iRule
•
NAT64 and DNS64
•
HSL engineによる高性能なログ出力
•
Tunneling
•
IP in IP
•
Dual Stack
•
HW, SWの制限なし
•
IPv4 and IPv6 VS
NAT44を実施するiRuleの例
~ユーザー単位のポートの利用制限~
iRule deterministic_snat_nat44 ltm rule /Common/deterministic_snat_nat44 { when RULE_INIT { set static::count 0 set static::ppu 2000 } when CLIENT_ACCEPTED {set port_min [expr ([getfield [IP::client_addr] "." 4]%32)*$static::ppu + 1000] set port_max [expr $port_min + $static::ppu ‐ 1 ]
set hint_ip 192.[getfield [IP::client_addr] "." 2].[expr ([getfield [IP::client_addr] "." 3]‐1)%4 +1].[expr ([getfield [IP::client_addr] "." 4]/32) +1]
# actual port used depends on hash of src_port and dst_port and tmm
set real_port [TCP::unused_port [IP::local_addr] [TCP::local_port] $hint_ip [TCP::client_port] $port_min $port_max] if { $real_port < $port_min || $real_port > $port_max } {
incr static::count
log local0.alert "[format %15s:%‐5u [IP::client_addr] [TCP::client_port]] :¥ [format %15s:%‐5u $hint_ip $real_port] :¥
[format %5u‐%5u‐%5u $port_min $real_port $port_max] : Not Ok $static::count" reject } # don't perform suspended operation here (otherwise, there might be a race condition that other connection for the same tmm may use same port?) snat $hint_ip $real_port forward }
NAT44を実施するiRuleの例
~ユーザー単位のポートの利用制限~
iRule deterministic_snat_nat44 ltm rule /Common/deterministic_snat_nat44 { when RULE_INIT { set static::count 0 set static::ppu 2000 } when CLIENT_ACCEPTED {set port_min [expr ([getfield [IP::client_addr] "." 4]%32)*$static::ppu + 1000] set port_max [expr $port_min + $static::ppu ‐ 1 ]
set hint_ip 192.[getfield [IP::client_addr] "." 2].[expr ([getfield [IP::client_addr] "." 3]‐1)%4 +1].[expr ([getfield [IP::client_addr] "." 4]/32) +1]
# actual port used depends on hash of src_port and dst_port and tmm
set real_port [TCP::unused_port [IP::local_addr] [TCP::local_port] $hint_ip [TCP::client_port] $port_min $port_max] if { $real_port < $port_min || $real_port > $port_max } {
incr static::count
log local0.alert "[format %15s:%‐5u [IP::client_addr] [TCP::client_port]] :¥ [format %15s:%‐5u $hint_ip $real_port] :¥
[format %5u‐%5u‐%5u $port_min $real_port $port_max] : Not Ok $static::count" reject } # don't perform suspended operation here (otherwise, there might be a race condition that other connection for the same tmm may use same port?) snat $hint_ip $real_port forward }
