This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

The general Astaro configuration

Hi all,

Now I have 1 Switch + 1 Astaro + 1 Load Balancer device. Switch-Layer 3 is including:

- Two vlans (2-3 ) serving for end-users, servers...

- Create one more vlan (ex: vlan 4 on SW-L3) and set ip 192.168.4.x and then connect this port to one ethernet port on Astaro (ex: IP 192.168.4.x)

- All vlans on the switch have been routed (using Inter vlan routing feature).

- Create one Default Route on Switch - L3 points to the Astaro's ethernet port we have told the above

I want to ask that how the rules (firewall rule, static route, nat...) can i configure on this Astaro to allow the internal vlan's users to connect the Internet?

P/S: The Astaro have one interface is connecting to the Load balancer device(with many internet lines)

Grateful thank

This thread was automatically locked due to age.

0 BarryG over 10 years ago

Hi, you need a Masquerading rule and firewall rules for each VLAN outbound.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 diemthuy over 10 years ago in reply to BarryG

Hi BarryG,
It means the traffic from Astaro to the Load Balancer is NAT. Why we do not use a Routing mechanism.
How about the 'Reply packet' come back to each Vlan.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Hi,

You can either disable the NAT on the LB, or NAT again on the UTM, or bridge the UTM.

Replies will be routed correctly as the UTM is stateful.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 diemthuy over 10 years ago in reply to BarryG

Hi,

After thinking, I have a routing solution as follows:

- Create a 'Interface' be called 'Internet' (on Astaro) with IP: 192.168.5.x and the LB also set a 'Interface' with IP: 192.168.5.x

- Firewall Rules:
      + one rule for: Vlan 2 (source) -----(ex: permit HTTP & HTTPS... )----- LB's Interface (destination)
      + Vlan 3 the same as the above

- Static Route:
      + Vlan 2-3 --- Internal Astaro's IP (192.168.x.4)

That is my idea. Pls give me an idea of this solution.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 diemthuy over 10 years ago in reply to diemthuy

Hi all,

No one can help me?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

If I follow your explanation, Thuy, it seems that you have a good plan. Remember that the 'Destinations' in Firewall rules are IPs and that Routing is, in essence, Layer-2.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 diemthuy over 10 years ago in reply to BAlfson

Hi,

I have a problem with the 'Destination' when I select the 'Destination' with Inside LB's IP not access the internet and now using the 'Destination' with 'Any' is fine.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel