Cluster with Single Public IP

[Kevin_Orrison]

I have a cluster I am setting up behind a Cradlepoint running Verizon as the only ISP. I have a single static IP from Verizon. I'm curious how other folks have solved this. Would you trick the external interface with private IPs and static NAT them to the single Public IP? My first time working with a firewall behind cellular. Just looking for the simplest way to configure the external interfaces and VIP.

[KernelGordon]

If you're trying to set up a cluster with only public IP then I would suggest looking at sk32073.

[Kevin_Orrison]

This is going to be a site-to-site VPN cluster. Does the below note from this SK mean that I will not be able to initialize SIC using the method described in this SK? Could I NAT the member external interfaces to the static external IP to be used in the VIP?

"It is not possible to manage over the Internet the Cluster when IP addresses Addresses of its members and the VIP address are configured on different subnets.
In such configuration, the IP addresses of cluster members are supposed to be configured with private IP addresses (RFC 1918), and only one Cluster VIP address is supposed to be public.
Private IP addresses (RFC 1918) are not allowed over the Internet.
As a result, communication from the external Management Server to the private IP addresses of the physical cluster members will not be possible over the Internet for services such as SIC."

[KernelGordon]

The note from the SK means that you will not be able to manage this cluster remotely. If the Management Server is local to this cluster then you will be fine. The reasoning for this is explained by RFC 1918.

[Kevin_Orrison]

So the SMS is in the data center. You're saying with this "different subnet for VIP" configuration I won't be able to centrally manage the remote site firewall?

[KernelGordon]

That's correct. A SMS will not be able to manage Cluster over the Internet if that cluster is configured according to sk32073.