Deterministic NAT¶

Overview¶

Deterministic Network Address Translation (DNAT) ensures that a source IP address and port consistently map to the same post-NAT IP address and port range, and reverse mapping always returns to the same internal IP address. DNAT mode provides address translation that eliminates logging of every address mapping. However, it still allows internal client address tracking using only an external address and port, and a destination address and port. Reverse mapping allows BIG-IP CGNAT operators to respond to legal requests revealing the identity of the originator of a specific communication. For example, revealing the identity of file sharers or P2P network users accused of copyright theft.

Deterministic mode allows unique identification of internal client addresses based on:

External address and port (the address and port visible to the destination server)
Subscriber IP Address

The following diagram illustrates the deployment architecture with F5-DAG serving as upstream router for DNAT CNF.

_images/cnf-dnat-networktopology.png

Limitations¶

Following are the limitations for Deterministic mode configurations applicable for the current release:

Deterministic mode is only supported in NAT44 configuration.
For Dynamic NAT, the VLAN CMP Hash settings must be configured as either the source or destination address, depending on the subscriber (client-side) and internet (server-side) interfaces (VLANs).
All internal client addresses that will communicate through the CGNAT must be specified during the configuration process.

Note: This means that all virtual servers referring to an LSN pool through deterministic NAT mode must specify the source attribute with a value other than 0.0.0.0/0 or ::/0 (any/0).
Members of two or more deterministic Large Scale Network (LSN) pools must not overlap. For example, every external/translation address used for deterministic mapping must occur in only one LSN pool.
While upgrading CNFs with DNAT application deployment traffic loss is expected for a short period (not greater than 120 seconds).

Simplified logging¶

As an alternative to per-connection logging, deterministic mode maps internal addresses to external addresses algorithmically to calculate the mapping without relying on per-connection logging. Deterministic mode significantly reduces the logging burden while mapping an inside IP address of the subscriber with an outside internet address and port.

To decipher mapping generated by LSN pools using deterministic mode, use the DNAT utility tool that can be run as out of box utility.

Configuring NAT mode as deterministic¶

patMode DNAT will enable deterministic mode for given LSN pool.

Sample configuration:

sourceTranslation:
  - name: "dnatsrctr"
   type: "dynamic-pat"
   patMode: "dnat"

External Deterministic Address Grouping (DAG) for Deterministic NAT¶

DNAT CNF expects upstream routers to DAG the TMM pods of the subscribers. DNAT will then algorithmically assign translation addresses, which are deterministic in nature. F5 DAG CNF can be used as external DAG. Following is an example configuration that allows admin to configure f5-dag parameters.

_images/spk_info.png Note: f5-dag uses carp hash for externally dagging subscribers to TMM.

deterministicNat:
  upstreamRouter: "f5-dag"
  f5Dag:
    f5DagAlgorithm: "carp-hash"
    subscriberVlan: "vlan-dag"

Example connection¶

Subscriber IP 10.10.10.1 has been assigned a deterministic translation IP and port range of 100.100.100.100:2000–2099. All outbound connections originating from 10.10.10.1 will have their source IP translated to 100.100.100.100, with the source port mapped to a value within the 2000–2099 range. This allows a maximum of 100 concurrent connections per subscriber. Once this limit is reached, any new connection attempts from the same subscriber will be dropped

For example, an IPV4 only client requires a connection to IPv4 only server www.44test.com. The DNS address of www.44test.com is 40.40.40.1, ingress source address is 10.10.10.1 and port is 34545. In this scenario, on the egress side, the DNAT translates the source address to 100.100.100.100 and port to 2000. The destination addresses and port in IP layer remains the same.

Required CNFs CRs¶

NAT44 requires CNFs Custom Resources (CRs) installed in this order:

F5BigDnsApp (Optional) - Specifies a DNS listener used to translate and convert DNS queries.
F5BigNatPolicy - Specifies the IPv4 and IPv6 translation addresses.
F5BigFwPolicy (Optional) - Filters subscriber connections by IP address.
F5BigLogProfile (Optional) - Sends connection events to remote logging servers.
F5BigContextSecure - Processes and load balances the subscriber connections.
F5BigNetVlan - The F5BigNetVlan CR defines the VLAN name used between the F5-DAG and DNAT-CNF.
F5PersistenceProfile - The F5PersistenceProfile CR is used to fetch the CARP algorithm input for DAG. The ipv4PrefixLength parameter should be set to 32 to be used along with DNAT.

Requirements¶

Following are the requirements before proceeding with DNAT you have:

Install the BIG-IP Controller.
Install all required CNFs CRs configurations.
A Linux based workstation.

Pre-requisites¶

Use only the most specific address prefixes that include all the subscriber addresses, while congifuring the NAT policy.
Deploy DAG CNFs before deploying the DNAT application.
Disable the bgp routers on the Client side router.

For the hairpin mode or inbound modes to work in DNAT, set the looseInitiation and looseClose parameters values to true in F5BigFastl4Setting. The F5BigFastl4Setting should be included in the SecureContext CR of the CNFs DAG application.

F5BigNatpolicy CR example

apiVersion: "k8s.f5net.com/v1"
kind: F5BigNatPolicy
metadata:
  name: "natpol-dnat"
spec:
  sourceTranslation:
    - name: "dnatsrctr1"
      type: "dynamic-pat"
      patMode: "dnat"
      addresses:
      - "44.1.1.1-44.1.1.8"
      port: "1000-2000"
      icmpEcho: True
      deterministicNat:
        upstreamRouter: "f5-dag"
        f5Dag:
          f5DagAlgorithm: "carp-hash"
          subscriberVlan: "dagtmm-net"
      mapping:
        mode: address-pooling-paired
        timeout: 60
      inbound:
        mode: endpoint-independent-filtering
        eifTimeout: 300
      routeAdvertisement: True
      hairpinMode: True
  rule:
    - name: dnatrule_1
      ipProtocol: tcp
      source:
        addresses:
          - "11.11.11.0/24"
      sourceTranslation: "dnatsrctr1"

F5BigFastl4Setting CR example

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFastl4Setting
metadata:
  name: fastl4-test
spec:
  #idleTimeout: 1
  looseInitiation: true
  looseClose: true

F5BigContextSecure CR example

apiVersion: "k8s.f5net.com/v1"
kind: F5BigContextSecure
metadata:
  name: virtual-carp-profile-v4
spec:
  destinationAddress: 0.0.0.0/0
  #ipv6destinationAddress: ::/0
  ipProtocol: "any"
  destinationPort: 0
  persistenceProfile: "srcaddr-carp-profile"
  profile: "fastL4"
  fastL4Settings:
    profileName: fastl4-test
  monitors:
    icmp:
       - interval: 5
  pool:
    members:
      - address: "20.1.1.150"
      - address: "20.1.1.151"
        #- address: "20.1.1.152"
        #- address: "20.1.1.153"

F5BigContextSecure CR example

apiVersion: "k8s.f5net.com/v1"
kind: F5BigNetVlan
metadata:
  name: "dagtmm-net"
spec:
  name: dagtmm-net
  interfaces:
  - "1.1"
  selfip_v4s:
  - "20.1.1.150"
  - "20.1.1.151"
  prefixlen_v4: 24
  selfip_v6s:
  - "2002::20:1:1:150"
  - "2002::20:1:1:151"
  prefixlen_v6: 112
  auto_lasthop: "AUTO_LASTHOP_DISABLED"
  cmp_hash: SRC_ADDR

F5BigNetVlan CR example

apiVersion: "k8s.f5net.com/v1"
kind: F5BigNetVlan
metadata:
  name: "dagtmm-net"
spec:
  name: dagtmm-net
  interfaces:
  - "1.1"
  selfip_v4s:
  - "20.1.1.150"
  - "20.1.1.151"
  prefixlen_v4: 24
  selfip_v6s:
  - "2002::20:1:1:150"
  - "2002::20:1:1:151"
  prefixlen_v6: 112
  auto_lasthop: "AUTO_LASTHOP_DISABLED"
  cmp_hash: SRC_ADDR

_images/spk_info.png Note: The interface between the client-router and the dnat-tmm side should use the SRC_ADDR as the value for CMP_HASH parameter, in the F5BigNetVlan CR.

Example CR¶

Following is an example DNAT NatPolicy CR:

apiVersion: "k8s.f5net.com/v1"
kind: F5BigNatPolicy
metadata:
  name: "dnat-policy-1"
spec:
  sourceTranslation:
    - name: "dnatsrctr"
      type: "dynamic-pat"
      patMode: "dnat"
      addresses:
        - "22.22.22.1-22.22.22.8"
      port: "1025-65535"
      deterministicNat:
        upstreamRouter: "f5-dag"
        f5Dag:
          f5DagAlgorithm: "carp-hash"
          subscriberVlan: "vlan1"
      routeAdvertisement: True
  rule:
    - name: dnatrule_1
      ipProtocol: tcp
      source:
        addresses:
          - "11.11.11.0/24"
      sourceTranslation: "dnatsrctr"

_images/spk_info.png Note: The subscriberVlan parameter value should be the same as spec.name parameter value given in the F5BigNetVlan CR as mentioned in the Pre-requisistes section.

Installation¶

Following is the procedure to install and configure the TMM Proxy Pod for NAT44 functionality.

_images/spk_info.png Tip: Open a second shell to view the CNFs Event Logs while installing.

(Optional) The example F5BigLogHslpub CR specifies a remote server with IP 10:30:2:220 and port 514, and the udp protocol.

Copy and paste the following example into a YAML file:

apiVersion: k8s.f5net.com/v1
kind: F5BigLogHslpub
metadata:
  name: "cnf-hsl-pub"
  namespace: "cnf-gateway"
spec:
  pool:
    - name: "hsl-pool"
    endpoint:
    - "[10:30:2:220]:514"
  syslog:
    - name: "cnf-syslog"
    format: "rfc5424"
    protocol: "udp"
    pool: "hsl-pool"

Run the following command to install the F5BigLogHslpub CR:

kubectl apply -f cnf-hsl-cr.yaml

Sample Output:

In the following example output, the BIG-IP Controller logs indicate the F5BigLogHslpub CR was added or updated.
```
I0202 12:00:00.12347   1 event.go:282 Event(v1.ObjectReference{Kind:"F5Hslpub", F5Hslpub cnf-gateway/cnf-hsl-pub was added/updated
```

(Optional) The example F5BigLogProfile CR captures NAT events such as connection start and end, and firewall events such as packet match and drop.

_images/spk_info.png Note: The F5BigLogProfile CR will be referenced by the F5BigContextSecure CR.