Application Description Firewall in front of LAN Different Servers located behind Firewall Firewall to be accessible from Internet Load Balancer to be installed in a TRANSPARENT MODE between Firewall and Internet routers Traffic to the Firewall to be received thru both Internet routers OptiQroute Load Balancers WAN 1 IP : 100.1.1.1/24 Gateway IP : 100.1.1.254 Peer IP : 209.73.186.238 T1 ROUTER : 100.1.1.254 LAN IP : 100.1.1.2/24 WAN IP : 100.1.1.10 100.1.1.20 100.1.1.30 100.1.1.40 WAN1 Internet LAN Firewall DSL ROUTER : 200.1.1.254 WAN2 10.0.0.254 WAN 2 IP : 200.1.1.1/24 Gateway IP : 200.1.1.254 Peer IP : 209.73.186.238 OptiQroute 2120 RSW Web Server Email Server Citrix Server FTP Server 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 1/ 13
Network Diagram Internet T1 ROUTER : 100.1.1.254 DSL ROUTER : 200.1.1.254 WAN 1 IP : 100.1.1.1/24 WAN 2 IP : 200.1.1.1/24 Gateway IP : 100.1.1.254 Peer IP : 209.73.186.238 WAN1 WAN2 Gateway IP : 200.1.1.254 Peer IP : 209.73.186.238 LAN IP : 100.1.1.2/24 WAN IP : 100.1.1.10 100.1.1.20 100.1.1.30 100.1.1.40 LAN Firewall 10.0.0.254 OptiQroute 2120 RSW Web Server Email Server Citrix Server FTP Server 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 Peer IP = Public IP entered to do constant pings to and determine that live is alive beyond the Internet router 2/ 13
IP Table Web Server Email Server Citrix Server FTP Server Private 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 WAN 1 100.1.1.10 100.1.1.20 100.1.1.30 100.1.1.40 WAN 2 200.1.1.10 200.1.1.20 200.1.1.30 200.1.1.40 3/ 13
Mapping Table Citrix Server Internet 100.1.1.1 Transparent 100.1.1.2 WAN1 LAN WAN2 200.1.1.1 Secondary IP : 200.1.1.30 DNAT Traffic arrives directly to Citrix on WAN1 thru 100.1.1.30 on a transparent mode. Citrix: 100.1.1.30 Firewall NAT Citrix can also be reached by accessing 200.1.1.30 (secondary WAN2 IP). The traffic is rerouted with Destination NAT by the Load Balancer to 100.1.1.30. Web Server Email Server Citrix Server FTP Server 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 4/ 13
Programming of the Load Balancer It is done in 4 steps: STEP 1 Configuration of WAN Interfaces (slide 6-8) We will enter the IP addresses of WAN, Peer IPs, Secondary WAN IPs, bandwidth values and enable Proxy ARP. STEP 2 Setup LAN Interface (slide 9) We will enter the IP address for LAN in the same segment as the WAN and enable Proxy ARP. STEP 3 Setup Host in the LAN/Firewall (slide 10) We will enter host located behind the Firewall as IP addresses in the LAN side of the balancer. At this point, and due to the transparent mode, the Firewall can be reached from the Internet with the public IP addresses. STEP 4 Setup DNAT Rules (slides 11-12) We will enter Destination NAT rules (DNAT) that will forward the traffic received on the second WAN interface to the public IP addresses that reside on the Firewall WAN port. Now the Firewall is being reached on both sets of public IP addresses. 5/ 13
Programming WAN interfaces : Expand Configuration, Interface and WAN 6/ 13
We enable Proxy-ARP to keep for Transparent Mode (need to be done both in WAN and LAN) We enter and define the parameters for the WAN interface. IP Address is the load balancer IP address with its network mask (/24 = 255.255.255.0). The Gateway IP is the IP of the router in front of the load balancer. The Peer IP is a PUBLIC IP that the load balancer uses to do pings to so that we can determine the line is alive. 7/ 13
We enter and define additional Peer Ip addresses (if the main Peer IP is not working, these extended IPs will be used to determine the line is alive ). Set up also the bandwidth associated to Internet lines. We need to define finally the SECONDARY IP addresses that will reside on the WAN ports. We WILL NOT INCLUDE the IP addresses that will be assigned to the Firewall WAN port or Internet routers, only those IP addresses that will be located at the WAN ports. 8/ 13
Under Configuration Interface LAN: we would enter the LAN IP address in the same segment as the WAN IPs and we need to enable the Proxy ARP as well. 9/ 13
Under Configuration Router We will enter the hosts/ip addresses that are present in the LAN or WAN. The hosts (IP addresses resident in the firewall) need to be entered with a network mask /32. 10 / 13
Finally we need to include Destination NAT Rules under Configuration NAT. These rules will redirect the traffic that arrives to the secondary IP addresses on the WAN ports to the IPs terminating in the Firewall. In the slide we can see that ALL TRAFFIC ARRIVING TO THE WAN INTERFACE WITH DESTINATION IP 200.1.1.10 (web server traffic) NEEDS TO BE DELIVERED TO 100.1.1.10 (IP in the firewall to further route to the web server). 11 / 13
The different NAT / DNAT rules entered to route traffic from the secondary WAN 2 Ips to the public Firewall public Ips 12 / 13
Information & Support Contact: www.alvaco.com Toll Free: 1-877-641-2109 Phone: 1-407-574-2017 Fax:1-407-574-2016 support@alvaco.com info@alvaco.com 13 / 13