Forum Discussion

Aj_2538's avatar
Aj_2538
Icon for Nimbostratus rankNimbostratus
Mar 26, 2009

Virtual Server in LC

hello frenz.

 

i have two links,

 

ISP1: 202.54.X.73 ISP2: 202.54.Y.73

 

 

i configured two vs for each of link(202.54.X.185 and 202.54.Y.185), to load balance my webserver.

 

Firewall(ip:202.54.X.100) knows only traffic for 202.54.X.73, it will not recognise traffic for 202.54.Y.73

 

 

eirlier it was working properly with Radware.Now i am replacing Radware with F5-Link Controller. In Radware 202.54.Y.185 was Natted with the 202.54.X.185 which is not possible in F5.

 

If i made(in LC) vs for 202.54.Y.185 with SNAT Pool as a AUTOMAP then it will send the self ip as a source ip which is not acceptable.

 

 

thanks in advance,

 

AJ

 

config
design

2 Replies

Sort By
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Mar 26, 2009
    Hi AJ,

    Your inbound virtual servers should not SNAT, you only want SNAT automap on your outbound wildcard virtual servers (ie, don't use a global SNAT automap). So both 202.54.X.185 and 202.54.Y.185 should both point to a pool with the webserver's address on the outside of the firewall. However you are saying that is also on the 202.54.X network, which probably won't work, you need a 3rd network between LC and the outside of the firewall so that either link can be SNAT'ed outbound. 

     
     ISP 1               ISP2 
       |                   | 
       |                   | 
      202.54.X          202.54.Y 
    ------------------------------ 
    |           LC               | 
    ------------------------------ 
                 | 
              192.168.X 
                 | 
             ---------- 
             |  FW    | 
             ----------

    Denny
  • Pankaj_70055's avatar
    Pankaj_70055
    Icon for Nimbostratus rankNimbostratus
    Jan 16, 2010
    Hi Denny,

     

     

    this would require a whole lot changes in the firewall (interface,nat,ipsec config [on remote peer] etc)

     

     

    isnt there anyway out we can have ISP routable IP addreses on firewall which also does nat for one ISP and NAT for second ISP to be done by LC? Which will allow us to put LC in network with least changes?