Hi.I was wondering how to solve the following issue: Right now, I have several customers connected via ipsec individually, each one with a different virtual IP to several servers inside my network. What I want is to transform that into a single load balancer for all of them, BUT, without changing the IP on the client side. In that why I do not have to modify any phase02 on the tunnels, I want it to be as transparent as possible for the clients with a somewhat minimal disruption. I was wondering if that is possible with a single FW?, and if (please) anyone could give me a pointer for that. So far, what I was thinking was to create a LB for each client, but, I mean, it doesn´t feel optimal.Instead, a single LB for all the customers would be more effective. My issue is that I do not see a way to do it, like, pointing all current VIP to a single LB IP, but all inside the FW. So far, I do not see it without the need of another FW, and without messing up the client side of things. Any ideas?

Explorer

Question

Migrate from VIP to a single LoadBalancer

Forum|Forum|2 years ago
September 13, 2023
5 replies
2546 views

Hi.

I was wondering how to solve the following issue:

Right now, I have several customers connected via ipsec individually, each one with a different virtual IP to several servers inside my network.

What I want is to transform that into a single load balancer for all of them, BUT, without changing the IP on the client side. In that why I do not have to modify any phase02 on the tunnels, I want it to be as transparent as possible for the clients with a somewhat minimal disruption.

Untitled Diagram-Page-1.jpg

I was wondering if that is possible with a single FW?, and if (please) anyone could give me a pointer for that.

So far, what I was thinking was to create a LB for each client, but, I mean, it doesn´t feel optimal.

Instead, a single LB for all the customers would be more effective.

My issue is that I do not see a way to do it, like, pointing all current VIP to a single LB IP, but all inside the FW.

Untitled Diagram-Page-3.jpg

So far, I do not see it without the need of another FW, and without messing up the client side of things.

Any ideas?

FortiGate

AlexC-FTNT

Staff

You're correct. As long as all those tunnels point to individual VIPs, then you will need all of the VIPs.

And to use a single VIP will require the clients to point to that one single IP.

FortDoogAuthor

Explorer

Good day all.

I know, it´s been a while. But something came up to my mind.

EDIT:

Can the FW do the following while having multiple vdoms?

In vdom mode; "technically"; I could point all the VIPs to a LB in another vdom; right?; and I could do this without service interruption (the firewall already has 2 vdoms).

But the thing is, can the FW software understand all of this correctly? Is not a fancy solution BUT, if it works...

Jakob-AHHG

Explorer III

Does the FortiGate handle the IPsec?

If so, it should be easy to setup a loadbalancer behind the FG, make a cluster that points to the server(s) that can handle the customer and then flip the VIP's internal IP to the loadbalancer IP.

We have an internal LB from loadbalancer.org that handle both layer4 & layer 7 services, but we don't have IPsec tunnels in front of it (yet).

We have the LB in a DMZ range, balancing trafic in to webservers and internally to other systems.