Skip to main content
FloToHu
FloToHu
Explorer
April 1, 2022
Solved

Virtual server with real servers on different subnets/interfaces - Possible? How?

  • April 1, 2022
  • 2 replies
  • 5378 views

Hi all,

 

I try to get "loadbalacing" (better call it host routing) working with virtual server and HTTP host as balancing method.

 

I got a cert with all 3 server names as aliases, configured all 3 servers with their hostnames.

 

Problem: What and how many firewall rules to get it working?

 

I added two rules for each subnet, but it seems that no matter which hostname I access, only one rule is triggered. The first host (serv1) which matches the triggered rule works flawless. The other two hosts just seem to work on startpage. Any hints how to fix this?

 

Do I need one very generic rule for both networks and why just works startpage? Is it due to persistance?

 

config firewall vip     edit "serv1-3"         set comment "Server1 + Server2 + Server3"         set type server-load-balance         set extip 172.16.0.1         set extintf "any"         set server-type https         set http-ip-header enable         set monitor "Check_Ping"         set ldb-method http-host         set persistence http-cookie         set extport 443         config realservers             edit 1                 set ip 10.10.0.6                 set port 5000                 set http-host "serv1.example.com"             next             edit 2                 set ip 10.200.0.150                 set port 8080                 set http-host "serv2.example.com"             next             edit 3                 set ip 10.200.0.10                 set port 8080                 set http-host "serv3.example.com"             next         end         set https-cookie-secure enable         set http-multiplex enable         set ssl-certificate "Cert-Serv1-3"         set ssl-http-location-conversion enable     next end


 Thanks in advance,

     FloToHu

Best answer by Debbie_FTNT

Hey FloToHu,

When the FortiGate receives traffic for a VIP, it will look for the first matching policy it can find, and direct all traffic via that policy.

Other policies for that VIP will be ignored.

To have FortiGate forward the traffic to all configured real servers, not just the one matching the first policy, you will need a single policy that matches all three real servers.

This is possible as follows:

- go to 'System > Feature Select/Visibility' and enable 'Multiple Interface Policies', then click 'Apply'

CAREFUL: this will change the policy table in FortiGate; instead of showing in interface pairs it will show as a simple table; some more care will be required when creating and ordering policies to ensure that the policies are in the correct order

-> enabling the setting will NOT change the current policy order, all existing policies will be matched as before, but creating new policies needs some additional care

- I would suggest taking a config backup before making this change, to have an option to fall back on

Debbie_FTNT_0-1649060940987.png

- edit the inbound policy you have created and add the other internal interfaces to the destination

- edit the outbound policy and add the other internal interfaces as source

-> delete the duplicate inbound/outbound policies

2 replies

Anthony_E
Staff
Anthony_E
Staff
April 4, 2022

Hello FloToHu,

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Thanks,

Best Regards
Debbie_FTNT
Staff & Editor
Debbie_FTNTAnswer
Staff & Editor
April 4, 2022

Hey FloToHu,

When the FortiGate receives traffic for a VIP, it will look for the first matching policy it can find, and direct all traffic via that policy.

Other policies for that VIP will be ignored.

To have FortiGate forward the traffic to all configured real servers, not just the one matching the first policy, you will need a single policy that matches all three real servers.

This is possible as follows:

- go to 'System > Feature Select/Visibility' and enable 'Multiple Interface Policies', then click 'Apply'

CAREFUL: this will change the policy table in FortiGate; instead of showing in interface pairs it will show as a simple table; some more care will be required when creating and ordering policies to ensure that the policies are in the correct order

-> enabling the setting will NOT change the current policy order, all existing policies will be matched as before, but creating new policies needs some additional care

- I would suggest taking a config backup before making this change, to have an option to fall back on

Debbie_FTNT_0-1649060940987.png

- edit the inbound policy you have created and add the other internal interfaces to the destination

- edit the outbound policy and add the other internal interfaces as source

-> delete the duplicate inbound/outbound policies

    FloToHu
    FloToHuAuthor
    Explorer
    April 4, 2022

    Hello @Debbie_FTNT ,

     

    thanks for your reply. We already have multiple interfaces enabled, since zones are to unflexible (interfaces cannot belong to more zones nor used standalone any more).  So it was easy to create this match-all-server rule and it seems to work.

     

    But since this single rule construct is too permissive in my eyes, I will look for another solution. I had hoped that there is a way to create a rule for each server subnet. One server needs a more restrictive source than the other ones.

     

    FloToHu

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    April 4, 2022

    Hey FloToHu,

    you could maybe put another policy on top with the VIP and that specific destination interface (with the more restrictive server) and set the specific source conditions?
    And below it, have the general VIP policy and the two other interfaces?
    It *should* work based on my understanding (as the restrictive policy would be matched on source criteria, and everything else would fall through to the second)
    -> problems would happen if you have two unrestricted policies with different interfaces and the same VIP; the FortiGate would match based on VIP and source and select the first matching policy, and ignore the second (for the other real-server) completely.

    Other than that, I wouldn't know of a solution though, apologies.

    Terms & ConditionsAccessibility statement