Disabling NAT

Unanswered Question
Apr 25th, 2007
User Badges:

Hi All,

I am doing load balancing for users accessing an application servers.

In basic configuration the application servers see the source IP of the users as the VIP of thier group and not the original client source IP.

Is there a way to disable the NAT and what implications can this have on the load balancing?

Thanks in advance,


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
jasmina27s Wed, 04/25/2007 - 12:47
User Badges:


Source NAT is usually disabled by default...

What device are you using (CSS,CSM...)?

How does the config look like?

Possible situations when you need source NAT:

1. if you need server-to-server load-balancing, or

2. when you have one-arm load-balancer topology and you want returning traffic to hit load-balancer first and not to go directly to the client...



merc-int Wed, 04/25/2007 - 12:54
User Badges:

The configuration is really big.

I am using CSS11501, here is a sample of a service and content configurations.

The address being shown in the servers is the

service ?????????????????

protocol tcp

ip address


owner ??????????

content ???????????

protocol tcp

add service ?????????

vip address

add service ?????????



Syed Iftekhar Ahmed Fri, 04/27/2007 - 01:11
User Badges:
  • Blue, 1500 points or more

On CSS by default source nat is disabled.CSS changes the destination ip (from VIP to real server ip) and preserves the source IP when a content rule is hit.

If you are not seeing source IP of traffic hitting real server as Client IP then source NAt (source group) is configured on your CSS.

The source group config is to nat traffic initiated by the server or to nat the client ip when traffic hits a content rule.

source group config looks like the following

group groupx

vip address

add service destination server1

add service destination server2


If you are running CSS in one arm mode then source natting is necessary to ensure that the return traffic from real servers doesnt bypass CSS.


mathews.baby Wed, 07/11/2007 - 23:29
User Badges:

Hi syed,

Thanks for earlier inputs.

Could you explain css running in one arm mode



mathews.baby Thu, 07/12/2007 - 02:17
User Badges:

Hi Syed,

I have css11501 in one armed mode, balancing 3servers. Now the client requirement is that servers should get client's ip as the source address. How can i make this possible..

Can I achieve this, if source natting is removed and server's gateway address changed to Vip.



Syed Iftekhar Ahmed Thu, 07/12/2007 - 09:46
User Badges:
  • Blue, 1500 points or more

If the clients do not belong to the same subnet where real servers are then yes changing the default gateway on reals to CSS circuit ip will do.

If clients belong to the same subnet then the return traffic will bypass CSS and hence will cause problems. This can be controlled by using source nat just for traffic originating from this subnet.

Syed Iftekhar Ahmed


This Discussion