topic Re: Cluster with Single Public IP in Firewall and Security Management

Cluster with Single Public IP

Kevin_Orrison — Wed, 28 Feb 2018 16:33:13 GMT

I have a cluster I am setting up behind a Cradlepoint running Verizon as the only ISP. I have a single static IP from Verizon. I'm curious how other folks have solved this. Would you trick the external interface with private IPs and static NAT them to the single Public IP? My first time working with a firewall behind cellular. Just looking for the simplest way to configure the external interfaces and VIP.

Re: Cluster with Single Public IP

KernelGordon — Wed, 28 Feb 2018 20:11:19 GMT

If you're trying to set up a cluster with only public IP then I would suggest looking at sk32073.

Re: Cluster with Single Public IP

Kevin_Orrison — Wed, 28 Feb 2018 22:02:51 GMT

This is going to be a site-to-site VPN cluster. Does the below note from this SK mean that I will not be able to initialize SIC using the method described in this SK? Could I NAT the member external interfaces to the static external IP to be used in the VIP?

"It is not possible to manage over the Internet the Cluster when IP addresses Addresses of its members and the VIP address are configured on different subnets.
In such configuration, the IP addresses of cluster members are supposed to be configured with private IP addresses (RFC 1918), and only one Cluster VIP address is supposed to be public.
Private IP addresses (RFC 1918) are not allowed over the Internet.
As a result, communication from the external Management Server to the private IP addresses of the physical cluster members will not be possible over the Internet for services such as SIC."

Re: Cluster with Single Public IP

KernelGordon — Wed, 28 Feb 2018 22:10:04 GMT

The note from the SK means that you will not be able to manage this cluster remotely. If the Management Server is local to this cluster then you will be fine. The reasoning for this is explained by RFC 1918.

Re: Cluster with Single Public IP

Kevin_Orrison — Wed, 28 Feb 2018 22:15:36 GMT

So the SMS is in the data center. You're saying with this "different subnet for VIP" configuration I won't be able to centrally manage the remote site firewall?

Re: Cluster with Single Public IP

KernelGordon — Thu, 01 Mar 2018 00:45:42 GMT

That's correct. A SMS will not be able to manage Cluster over the Internet if that cluster is configured according to sk32073.