Internal LAN load balancing

Forum|Forum|15 years ago
September 29, 2010
5 replies
17592 views

i know that the fortigate permits load balancing from an external virtual IP to multiple internal real servers. ive done that successfully my question is can this be done completely on the internal LAN? ie, have a virtual IP appear on the LAN that is redirected to multiple real IP addresses that are also on the LAN? if yes, how is it done? btw, the manual shows that there are many " types" of load balancing in a pull-down menu, including HTTP, HTTPS, SSL, TCP, etc. however, on my unit, when i create a new virtual server, the only choices are HTTP, TCP, UDP and IP. can' t find any of the other choices described. same thing for persistence. only 2 choices and the SSL one is always greyed out. anyone know why? thanks sjw

abelio

SuperUser

my question is can this be done completely on the internal LAN? ie, have a virtual IP appear on the LAN that is redirected to multiple real IP addresses that are also on the LAN? if yes, how is it done?

Balancing involves some type of NAT, so you cannot do that in the LAN (yes with another interfaces like a DMZ altough)

btw, the manual shows that there are many " types" of load balancing in a pull-down menu, including HTTP, HTTPS, SSL, TCP, etc. however, on my unit, when i create a new virtual server, the only choices are HTTP, TCP, UDP and IP. can' t find any of the other choices described. same thing for persistence. only 2 choices and the SSL one is always greyed out. anyone know why?

LB ' types' are directly related with virtual port settings

Maik

New Member

Balancing involves some type of NAT, so you cannot do that in the LAN (yes with another interfaces like a DMZ altough)

the destination can be on different interfaces but its not necessary: 10.1.1.1/24 points to 10.1.2.1/24 and 10.1.3.1/24 It also works on the same Interface: LB VIP from 10.1.1.1/24 with destination 10.1.1.2/24 and 10.1.1.3/24 on the same Interface will work. regards Maik

abelio

SuperUser

It also works on the same Interface: LB VIP from 10.1.1.1/24 with destination 10.1.1.2/24 and 10.1.1.3/24 on the same Interface will work.

To be able to do such VIPs doesn' t enable LB scenario at all; look rocampo' s above post about 3way handshake.

rocampo

New Member

my question is can this be done completely on the internal LAN? ie, have a virtual IP appear on the LAN that is redirected to multiple real IP addresses that are also on the LAN? if yes, how is it done?

If this is what you want: Virtual IP 192.168.1.1 that load balances to lets say 192.168.1.2, 192.168.1.3 and 192.168.1.4 then your client workstation is also on 192.168.1.x network lets say 192.168.1.100. I don' t think this is possible, mainly because the FG cannot keep track of the session and the TCP 3way handshake might not happen. Look at this scenario. 192.168.1.100 initiates connection to Virtual IP 192.168.1.1 FG answers due to proxy ARP and forwards the traffic to 192.168.1.2 This is where TCP 3 way handshake breaks... 192.168.1.2 responds to the TCP SYNC directly to 192.168.1.100. 192.168.1.100 receives this but since it is trying to connect to 192.168.1.1 it will discard the response from 192.168.1.2 3 way handshake does not happen, no TCP connection. If you are using windows servers and what to do this, look at clustering.

ede_pfau

SuperUser

I finally found the time to ask " my" Fortinet SE. He set it up in the lab and confirms that it works. My scenario would be to load balance 2 DNS as failover from primary to secondary DNS on a host can take up to 20 sec. Quite a surprise! A not-so-recent feature appears to be helpful in a different context. That' s what I call a tool!

ede_pfau

SuperUser

This might be a little confusing if you' re not used to it: In the VIP policy the VIP is given as the DESTINATION address, but is defined on the SOURCE interface. Example: you want to translate an internal IP 192.168.234.104 to your external favorite time server on wan1, 192.53.103.104. You define a VIP " ext_NTP_VIP" with ' external IP addr' =192.168.234.104, ' external interface' =internal, ' mapped to addr' =192.53.103.104, [' port' =123 if you like]. The policy to use the VIP is: source IF=internal, source addr=all, dest IF=wan1, dest addr=ext_NTP_VIP, service=NTP. If you define the VIP on the wrong IF you won' t see it in the drop down list.