topic Re: VSX - Virtual System NAT behind a Virtual Router IP? in Firewall and Security Management

VSX - Virtual System NAT behind a Virtual Router IP?

RKinsp — Sat, 06 Mar 2021 20:34:47 GMT

Good afternoon everyone!

We are working with a customer with a high number of Virtual Systems in a VSX Cluster. One request is that all DNS requests go out a single interface to a specific server.

The plan was to use a Virtual Router for all the VSs, however we ran into an addressing issue. Now, from what we have 'googled', a Virtual Rouger does not support NAT, although through testing we noticed we can actually replace a VR policy for your own (tested to respond to ping).

Is it possible to have a Virtual Router do Hide NAT to an external IP? If not, any recommendations on how we could pull this off (other than just creating 100+ addresses and routing to the VR)?

Thanks!

Re: VSX - Virtual System NAT behind a Virtual Router IP?

PhoneBoy — Sat, 06 Mar 2021 21:37:43 GMT

As far as I know, virtual routers don’t do NAT.
Why not just create a VS that does this?

Re: VSX - Virtual System NAT behind a Virtual Router IP?

RKinsp — Sat, 06 Mar 2021 21:53:50 GMT

This system is already up to 150 VSs, so I am just trying to optimize on the processing wherever possible, but it might be the only way...

Re: VSX - Virtual System NAT behind a Virtual Router IP?

PhoneBoy — Sun, 07 Mar 2021 00:01:44 GMT

Dunno that a virtual router is any less processing than a VS, particularly one that would be firewall only.