Multiple external IP passthrough for VDOMs

Question

Quick background on the environment.Root vdom contains all the physical connections to the VMWare stack and the internet. VDOM A - All internet bound traffic (inbound or outbound) runs through an intervdom link.  Everything works as expected.I understand how one would pass traffic through for either all ports or a single port from an external IP, through a VIP on Root, to the intervdom link IP of VDOM-A and then another VIP on VDOM-A to 'inside' VDOM-A.What happens when you need to have multiple external IPs all routing to something within VDOM-A?  With the intervdom link, VDOM-A essentially only has 1 'external' IP.  For example, you've got external IP: 40.40.40.40 that goes to WebserverA in VDOM-A and you've got 40.40.40.41 that goes to WebserverB in VDOM-A.  Do I create separate intervdom links for each external IP?Do I take the VIP from external to Root and do something like take 40.40.40.40 port 80 outside, translate it to 172.17.172.1 (intervdom link IP) port 80 then at the VDOM-A VIP, take 172.17.172.1 port 80 and translate to 10.10.10.10 port 80 (this I've done and it works).  Then take 40.40.40.41 port 80 outside, translate it it to 172.17.172.1 port 79 then at the VDOM-A VIP translate 172.17.172.1 port 79 and translate it to 10.10.10.11 port 80.So something like this:External IPRoot VIPVDOM A VIP40.40.40.40 port 80172.17.172.1 port 8010.10.10.10 port 8040.40.40.41 port 80172.17.172.1 port 7910.10.10.11 port 80 I'm not sure how else I would get the traffic from 'outside' to VDOM-A when VDOM-A essentially only has 1 IP.  I can't VIP both of the external IPs to port 80 but I'm also not sure how to get around it.

Toshi_Esumi · Accepted Answer

Then you need to keep your original design. As I said the subnet you would route from root to VDOM-A doesn't have to be on any interface (means can be bogus). You just need to have a static route toward the vdom-link(npu-vlink) at the root vdom. Then, you can just map them to local subnet like 10.10.10.0/24 by VIPs at VDOM-A.

Don't forget the opposite direction. Outgoing traffic for 10.10.10.0/24 toward the outside/interfnet needs to NATed as well. You might use the same subnet 172.17.172.0/24 or a different one. If different, you need to have another route at root vdom.

Toshi

Toshi_Esumi · Answer

VIPs are necessary because of NAT, hiding the internal subnets from outside/internet. Between VDOMs (root and other vdoms) if you don't have NAT you can just route them, then you don't need VIPs at the VDOM borders.

Further, if you route the public IPs/40.40.40.40 and .41 to VDOM-A, you don't need the VIPs at all even at the root VDOM.

Toshi

External IP	Root VIP	VDOM A VIP
40.40.40.40 port 80	172.17.172.1 port 80	10.10.10.10 port 80
40.40.40.41 port 80	172.17.172.1 port 79	10.10.10.11 port 80

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded