Application Description

Transcription

1 Application Description Firewall in front of LAN Different Servers located behind Firewall Firewall to be accessible from Internet Load Balancer to be installed in a TRANSPARENT MODE between Firewall and Internet routers Traffic to the Firewall to be received thru both Internet routers OptiQroute Load Balancers WAN 1 IP : /24 Gateway IP : Peer IP : T1 ROUTER : LAN IP : /24 WAN IP : WAN1 Internet LAN Firewall DSL ROUTER : WAN WAN 2 IP : /24 Gateway IP : Peer IP : OptiQroute 2120 RSW Web Server Server Citrix Server FTP Server / 13

2 Network Diagram Internet T1 ROUTER : DSL ROUTER : WAN 1 IP : /24 WAN 2 IP : /24 Gateway IP : Peer IP : WAN1 WAN2 Gateway IP : Peer IP : LAN IP : /24 WAN IP : LAN Firewall OptiQroute 2120 RSW Web Server Server Citrix Server FTP Server Peer IP = Public IP entered to do constant pings to and determine that live is alive beyond the Internet router 2/ 13

3 IP Table Web Server Server Citrix Server FTP Server Private WAN WAN / 13

4 Mapping Table Citrix Server Internet Transparent WAN1 LAN WAN Secondary IP : DNAT Traffic arrives directly to Citrix on WAN1 thru on a transparent mode. Citrix: Firewall NAT Citrix can also be reached by accessing (secondary WAN2 IP). The traffic is rerouted with Destination NAT by the Load Balancer to Web Server Server Citrix Server FTP Server / 13

5 Programming of the Load Balancer It is done in 4 steps: STEP 1 Configuration of WAN Interfaces (slide 6-8) We will enter the IP addresses of WAN, Peer IPs, Secondary WAN IPs, bandwidth values and enable Proxy ARP. STEP 2 Setup LAN Interface (slide 9) We will enter the IP address for LAN in the same segment as the WAN and enable Proxy ARP. STEP 3 Setup Host in the LAN/Firewall (slide 10) We will enter host located behind the Firewall as IP addresses in the LAN side of the balancer. At this point, and due to the transparent mode, the Firewall can be reached from the Internet with the public IP addresses. STEP 4 Setup DNAT Rules (slides 11-12) We will enter Destination NAT rules (DNAT) that will forward the traffic received on the second WAN interface to the public IP addresses that reside on the Firewall WAN port. Now the Firewall is being reached on both sets of public IP addresses. 5/ 13

6 Programming WAN interfaces : Expand Configuration, Interface and WAN 6/ 13

7 We enable Proxy-ARP to keep for Transparent Mode (need to be done both in WAN and LAN) We enter and define the parameters for the WAN interface. IP Address is the load balancer IP address with its network mask (/24 = ). The Gateway IP is the IP of the router in front of the load balancer. The Peer IP is a PUBLIC IP that the load balancer uses to do pings to so that we can determine the line is alive. 7/ 13

8 We enter and define additional Peer Ip addresses (if the main Peer IP is not working, these extended IPs will be used to determine the line is alive ). Set up also the bandwidth associated to Internet lines. We need to define finally the SECONDARY IP addresses that will reside on the WAN ports. We WILL NOT INCLUDE the IP addresses that will be assigned to the Firewall WAN port or Internet routers, only those IP addresses that will be located at the WAN ports. 8/ 13

9 Under Configuration Interface LAN: we would enter the LAN IP address in the same segment as the WAN IPs and we need to enable the Proxy ARP as well. 9/ 13

10 Under Configuration Router We will enter the hosts/ip addresses that are present in the LAN or WAN. The hosts (IP addresses resident in the firewall) need to be entered with a network mask / / 13

11 Finally we need to include Destination NAT Rules under Configuration NAT. These rules will redirect the traffic that arrives to the secondary IP addresses on the WAN ports to the IPs terminating in the Firewall. In the slide we can see that ALL TRAFFIC ARRIVING TO THE WAN INTERFACE WITH DESTINATION IP (web server traffic) NEEDS TO BE DELIVERED TO (IP in the firewall to further route to the web server). 11 / 13

12 The different NAT / DNAT rules entered to route traffic from the secondary WAN 2 Ips to the public Firewall public Ips 12 / 13

13 Information & Support Contact: Toll Free: Phone: Fax: / 13