Hello Community,
we're about to implement a video conferencing server via a virtual machine (sitting on VMWare ESXi). The VM uses Ubuntu 16.4 as an OS and has two NICs. One of them needs to use a public IP address, as we can't use a STUN/TURN server, the other one is used for management only and has a private IP. To still be secure, we're about to use proxy-arp on our XG 310 firewall (18.0.4). The interface on the firewall used for this is a LAG, containing 2 Ports (3 and 7). It has a private IP, which just functions as 'dummy', as it gets its 'real' IP via the proxy-arp.
The XG uses 2 proxy-arp entries actually, one on the LAG, which gets the public IP of the ISP gateway and one on the WAN interface, which gets the public IP of the server.
On the VM, we have configured one NIC with mentioned public IP and the ISP's router as a gateway. The same gateway is also default. And there's a directly connected route in the /22 subnet which contains the public IP and the gateway. On the XG we have added routes to the VM via the LAG interface and to the ISP router via the WAN interface (although the latter is probably not necessary because it's the default gateway).
Now to the problem: We cannot reach the LAG interface at all from the server - and the server not from the XG. A ping from the VM comes up with 'destination unreachable' message, which looks like there's no route to the gateway. But there is (actually it's directly connected). If we try arp -a, the internal interface gets the MAC address from its gateway without any issues, the proxy-arp interface alwalys comes up with <incomplete>. Which, again, is an indicator for a non functioning connection. A tracepath also stops at the interface IP with a H! for unreachable.
Problem is that it SHOULD work. At least in my opinion. I even tried to add the MAC address of the LAG interface manually to the ARP table, which unfortunately didn't do the trick either.
Oh, there's also a stacked switch between the XG and the ESXi-Host, but all ports are sitting untagged in the some VLAN, so this shouldn't be the issue.
Please, can anyone help me out on this one?
Many thanks in advance!
This thread was automatically locked due to age.
