High Availability (active/standby) and NAT on Gaia

[marcinw]

Hi 

We think about migration from one FW to two FWs in active/ standby mode. Requirement regarding physical interfaces are clear , each physical interface requires 3 IPS (2 on each FW and 1 Virtual) , but what about IPs with static NAT and public services? For example we have set up our mail server  with external IP 1.1.1.1/24 (not physical interface) , does it mean that we will have to allocate also additional IPs 1.1.1.2 and 1.1.1.3 for HA ?

thanks

[Chris_Atkinson]

NAT IPs are per cluster not per node.

[marcinw]

thank you for response, so it is not required allocating additional 2 IPs for external logical IPs, it's just the same principle of working , the same NAT table is kept by 2 firewalls regardless of NAT direction inside-outside or outside-inside and virtual addresses are not needed  ? We should allocate additional IPs to physical interfaces/subinterfaces ?

[Chris_Atkinson]

ClusterXL itself doesn't change the number of IPs needed for NAT

[BikeMan · Accepted solution]

so it is not required allocating additional 2 IPs for external logical IPs: correct

the same NAT table is kept by 2 firewalls regardless of NAT direction inside-outside or outside-inside and virtual addresses are not needed : yes

We should allocate additional IPs to physical interfaces/subinterfaces : no

You only have to check proxy arp config : if any, must be the same on both cluster's member.

Then push policy.