Forum Discussion

Sergi0's avatar
Sergi0
Icon for Nimbostratus rankNimbostratus
Oct 17, 2017

Two DC and GTM solution

We want to implement GTM for DNS redundancy between DC1 and DC2. Each DC have design public_ip-FWL(NAT)-LTM(VIP_private_ip) What is the best place for GTM before or after firewall? What can we do fo...
application delivery
BIG-IP DNS
Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Oct 17, 2017
  • What is the best place for GTM before or after firewall?

That's up to your own policies. LTM (Which GTM sits on top of) provides firewall functionality. However that usually means you have to maintain rules in multiple places (i.e.your normal firewall and the GTM/LTM).

 

YMMV

 

  • What can we do for GTM respond with public ip address, irule?

Yes. There are a couple of iRules on codeshare that will do that for you.

 

Note that there is builtin 'translation' capability for wideip's, but that's for internal processing, not for serving addresses. So don't be confused by thinking it's for serving.

 

  • If we use irule for convert public to private ip will redundancy work between DC1 and DC2?

I don't see why not, but without knowing exactly your setup/business and security rules, etc then YMMV

 

  • Do we need to migrate public ip address to LTM as easiest solution?

Well... The addresses you service have to be routed to the right place. Whether you need to migrate is another (Long and involved usually) discussion. You could get 3 people in a room on this one and get 4 answers, where none of them are wrong.