This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XGS 2100 Loopback NAT

We are looking to deploy an HA pair of XGS2100 firewalls to our data centre. My issue is I cannot get a loopback NAT to work when I am starting the conversation from the same zone as the destination server is in. IF the loopback is to a different zone all is good.

I have googled this for hours and spent hours on the phone with support to no avail. I do have a support ticket open already but I hoping someone might have some additional insight into this.

The Firewall currently have 18.5 MR1 installed.

This thread was automatically locked due to age.

0 Robert Reid over 3 years ago in reply to LuCar Toni

The counter is not increasing on the rule but is on the NAT rule. No I am not seeing the traffic in the logviewer. I'm just as confused as from this machine I can hit the Management using the WAN IP Address of .2 and it comes up like I am on the inside network which I am.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Robert Reid

I have the strong feeling there is something odd going on in your setup. You should contact support to get this more analyzed. I think, there is something going on, which is oddly enough.

Do you have multiple HA Clusters in your setup?
Cancel
Vote Up 0 Vote Down

Cancel
0 Robert Reid over 3 years ago in reply to LuCar Toni

I already have a ticket open with support for this issue. This is the only HA cluster we have other than the SG cluster that is being replaced by these ones. Originally I was having issues with traffic between VLANs but that was corrected by MR1. I won't be able to put these into production until I can get this fixed.

I appreciate and thank you for the time you have taken to try to assist.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Robert Reid

Go to the HA Cluster Config and change the Cluster ID.
Cancel
Vote Up 0 Vote Down

Cancel
0 Robert Reid over 3 years ago in reply to LuCar Toni

Done but made no difference
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Robert Reid

You could try to figure out, why conntrack is not showing anything. Because even conntrack -L should show some connections. At least the connection build up.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to Robert Reid

Hi Robert Reid,

Could you please provide the support ticket number by sending a personal message? I will follow up with it internally and provide you an update.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 3 years ago in reply to LuCar Toni

Hi,

I am having a similar issues conntrack not showing connections through the hairpin NAT. Does conntrack only show traffic that passes LAN to WAN or WAN to LAN but not LAN to LAN?

ian
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to rfcat_vk

There should be no difference. Regardless from zone or port.

Only if the routing (packet) is not flowing through XG, it will not be shown.
Cancel
Vote Up 0 Vote Down

Cancel