Can not config Source NAT to Server Load Balancing Server (internal) in Sophos correct .

Hi, Phuoc, and welcome to the UTM Community!

Pinging is regulated on the 'ICMP' tab of Firewall.  If you can't resolve your problem there. try #1 in Rulz.  Any luck with these suggestions?

Cheers - Bob

I try to ping and access services  to virtual IP Server from network Server but I can not .

I can ping and access services to virtual IP Server from network User

You can see more detail with the attachment . Can you help me check where I am wrong ?

8078.22122016.pdf

If you want ping requests to transit he UTM, you must select 'Gateway forwards pings.'

Also, I don't understand "virtual IP address" in this context - what do you mean specifically?

Cheers - Bob

Hi BAlfson,

virtual IP address=Virtual server in load balancing rule.

I this case, I have 2 server app: IP SV1=10.1.1.101, IP SV1=10.1.1.102, Virtual Server = 10.1.1.112 (I create a host name VSV12 have IP 10.1.1.112).

All Server in a network server 10.1.1.0/24. All User in a network Users 10.1.2.0/24

All Users can access to Virtual Server App(10.1.1.112) but Others Servers in network server can not access to Virtual Server App(10.1.1.112).

When 10.1.1.99 sends a packet to 10.1.1.112, it will be load balanced to 10.1.1.101 or 10.1.1.102.  The response packet will be sent directly back to 10.1.1.99 because it is in 10.1.1.0/24.  10.1.1.99 will drop the packet because it was expecting the response to come from 10.1.1.112.

If these are web servers, you could achieve what you want using Webserver Protection, but the easiest is probably to have servers in 10.1.1.0/24 send directly to other servers instead of going through the load balancer.

Cheers - Bob

Hi BAlfson,

Webserver Protection is a good feature for load balancing for only web services . But I want load balancing other services not only for web services . How can I do that ?

You cannot use Load Balancing unless the Requesting and Responding devices are in disjoint subnets.  I think you might be able to use a trick with NAT though:

SNAT : {server DMZ subnet} -> Any -> {server DMZ subnet} : from {server DMZ} (Address)

Did that work?

Cheers - Bob

Hi BAlfson,

It really work as you guide . 

I try to do other way not use Virtual Server that is not IP address in a interface (such as DMZ address or additional address) . In my way, I create a virtual Server host and used in Load Balancing NAT rule with IP is not in any interfaces of firewall and I didn't work . After that I try to create a SNAT rule but I can not find the way to success . Do you know how to config with that way ?

Thank you so much for your helps.

Using your example above, did you try the following?

SNAT : {10.1.1.0/24} -> Any -> {10.1.1.0/24} : from {10.1.1.112}

Did that work?

Cheers - Bob

Hi BAlfson,

It didn't work but I change a little {10.1.1.0/24} change to a host 10.1.1.101/32.

It can work now . Thank you so much for your helps .