- CheckMates
- :
- Products
- :
- General Topics
- :
- ConnectControl / Logical Servers within same subne...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ConnectControl / Logical Servers within same subnet
Hi,
currenty I'm experimenting with Logical Servers.
So far it works fine but there is one point on my list I'm unable to resolve.
I need to access my logical server from inside the same subnet as the VIP and the real servers.
I managed to set up proxy arp so reqests are forwardet from GW to destination server(s).
Packets are recevived from server(s) but as the src. address is located in the same subnet the replays are send to src directly.
Aswer packets arrive at the client but with real server IP and not VIP -> packets did not pass trough GW so no reverse NAT happend.
To resolve this I think I only have to src-NAT all my connections if they are from same subnet to an IP which is behind Gateway (from servers view)
BUT as ConnectControl is only a more inteligent destination NAT method working as impied rule (0) my src.Nat rules will never match.
Thank you for reading 🙂
/BR
Sascha
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
"Any" in original was the first attempt I made (CISS)
But install aborts: "Invalid <Any> in Source of Address Translation Rule ##. <Any> is valid only it the matching Translated column is <Original>"
But many thanks to you, your reply pushed me back to test with NAT and I found a solution:
Here is the summary what the tasks are to make an logical-server reachable from the same subnet:
- Create 2 access-rule for VIP and the corresponding Server-Group (sk87641)
- Create manual-proxy-arp for VIP (sk30197)
- In HA-Mode with VMAC use Real-IP of cluster member and VMAC
- do not use interface otherwise physical MAC of interface will be used)
- Create NAT rule: "same-subnet" -> "corresponding server-group" => "Cluster-object" (Hide) -> "original" (No sk found)
Thank you very much for spending your time with my problems.
Best regards,
Sascha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What specific NAT rules have you tried?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've tried:
ORG-SRC; ORG-DST; ORG-SRV; TRA-SRC; TRA-DST; TRA-SRV
Subnet-of-VIP; VIP; ANY; Subnet-of-VIP-GW-IP(Hide); Original; Original
In log I can see that NAT rule 0 matched (Which is the Logical-Server magic) but my NAT rule did not match.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you might have to make Original Source "any" in this context.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
"Any" in original was the first attempt I made (CISS)
But install aborts: "Invalid <Any> in Source of Address Translation Rule ##. <Any> is valid only it the matching Translated column is <Original>"
But many thanks to you, your reply pushed me back to test with NAT and I found a solution:
Here is the summary what the tasks are to make an logical-server reachable from the same subnet:
- Create 2 access-rule for VIP and the corresponding Server-Group (sk87641)
- Create manual-proxy-arp for VIP (sk30197)
- In HA-Mode with VMAC use Real-IP of cluster member and VMAC
- do not use interface otherwise physical MAC of interface will be used)
- Create NAT rule: "same-subnet" -> "corresponding server-group" => "Cluster-object" (Hide) -> "original" (No sk found)
Thank you very much for spending your time with my problems.
Best regards,
Sascha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm glad you figured it out
I was actually trying to find how we did this with AWS and ELBs, which also used these objects.
I believe you need to do something similar with NAT rules there.
