Forum Discussion

jenmick1_43986's avatar
jenmick1_43986
Icon for Nimbostratus rankNimbostratus
Apr 29, 2011

Dual Firewalled Enviroments - 1 LB

Hello. We are looking for assistance with a simple way to route & load balance traffic in a setup that we haven't configured before. We have two separate firewalls for the environments behind our LTM/GTM load balancer and need to make sure that the following conditions are met:

 

 

1) We are attempting to load balance traffic sourcing from two separate firewalls and need to ensure that traffic is sent back through the proper firewall.

 

 

2) SNAT cannot be used in these environments as the developers need to see true source IPs.

 

 

3) The servers need to be able to connect to the correct firewall when they are the source.

 

 

4) We have no overlapping IP space, but have been using route domains to manage default gateways to ensure that traffic is routed correctly (which is working fine for IPv4). This will not be supported for IPv6 and it is necessary for the environments to be IPv6 compliant.

 

 

What would be the best manner to approach this?

 

config
design
  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Apr 29, 2011
    Hi jenmick1,

     

     

    Q: We are attempting to load balance traffic sourcing from two separate firewalls and need to ensure that traffic is sent back through the proper firewall.

     

    A: Shouldn’t the rest of your network configuration (non-BigIP) be taking care of your network routes and routing table for you? If the BigIP does not know the route it should utilize its default route.

     

     

    Q: SNAT cannot be used in these environments as the developers need to see true source IPs.

     

    A: Can you configure X-Forward in the HTTP Profile so that the True Client IP Address is placed in the header and the downstream application can retrieve it?

     

     

    Q: The servers need to be able to connect to the correct firewall when they are the source.

     

    A: If your servers are the source then they become a client and are passed through the BigIP if the traffic destination is not on a subnet that is owned by the BigIP. The traffic from the server should be allowed to pass through unaffected, but other devices might cause this not to work (firewall configurations).

     

     

    I can't offer any insight into your Route Domain issue, perhaps on someone else can give you some suggestions.

     

  • jenmick1_43986's avatar
    jenmick1_43986
    Icon for Nimbostratus rankNimbostratus
    Apr 30, 2011
    Perhaps I can clarify this a bit. There are 2 firewalls, each protecting a different set of subnets. The route domains with IPv4 allow me to set two different gateways since each FW handles calls for different environments. The developers are using one firewall to manage traffic from public space (anything not in company private IP space), and the other firewall manages company (internal) space.

     

     

    Can the load balancer differentiate between the two with a single default gateway? I think this is probably a better way to define what my developers are asking me for.

     

     

    Thanks!

     

    jenmick1

     

Related Content