Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Kevin_Orrison
Collaborator

Cluster with Single Public IP

I have a cluster I am setting up behind a Cradlepoint running Verizon as the only ISP. I have a single static IP from Verizon. I'm curious how other folks have solved this. Would you trick the external interface with private IPs and static NAT them to the single Public IP? My first time working with a firewall behind cellular. Just looking for the simplest way to configure the external interfaces and VIP.

0 Kudos
5 Replies
KernelGordon
Employee Alumnus
Employee Alumnus

If you're trying to set up a cluster with only public IP then I would suggest looking at sk32073.

Kevin_Orrison
Collaborator

This is going to be a site-to-site VPN cluster. Does the below note from this SK mean that I will not be able to initialize SIC using the method described in this SK? Could I NAT the member external interfaces to the static external IP to be used in the VIP?

"It is not possible to manage over the Internet the Cluster when IP addresses Addresses of its members and the VIP address are configured on different subnets.
In such configuration, the IP addresses of cluster members are supposed to be configured with private IP addresses (RFC 1918), and only one Cluster VIP address is supposed to be public.
Private IP addresses (RFC 1918) are not allowed over the Internet.
As a result, communication from the external Management Server to the private IP addresses of the physical cluster members will not be possible over the Internet for services such as SIC."

0 Kudos
KernelGordon
Employee Alumnus
Employee Alumnus

The note from the SK means that you will not be able to manage this cluster remotely. If the Management Server is local to this cluster then you will be fine. The reasoning for this is explained by RFC 1918.

0 Kudos
Kevin_Orrison
Collaborator

So the SMS is in the data center. You're saying with this "different subnet for VIP" configuration I won't be able to centrally manage the remote site firewall?

0 Kudos
KernelGordon
Employee Alumnus
Employee Alumnus

That's correct. A SMS will not be able to manage Cluster over the Internet if that cluster is configured according to sk32073.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events