|
Scenario 1: Redirect traffic to a FQDN address to a different FQDN address.
This scenario can for example be used in case a legacy service using a FQDN address was migrated to a new FQDN address but the legacy FQDN is still in use. The goal is to forward traffic from FQDN legacy.service.com to FQDN new.service.com.
- Create FQDN address objects for each FQDN.
config firewall address
edit "legacy"
set type fqdn
set fqdn "legacy.service.com"
next
edit "new"
set type fqdn
set fqdn "new.service.com"
next
end
-
Create a firewall vip using previously created FQDN objects.
config firewall vip
edit "vip-Legacy_to_new"
set type fqdn
set extintf "any"
set arp-reply disable
set extaddr "legacy.service.com"
set mapped-addr "new.service.com"
next
end
-
Create a firewall policy referring to the previously created VIP in the destination address.
config firewall policy
edit 1
set name "Legacy_to_new"
set srcintf "internal"
set dstintf "external"
set action accept
set srcaddr "all"
set dstaddr "vip-Legacy_to_new"
set schedule "always"
set service "ALL"
next
end
Scenario 2: Perform port translation for a specific FQDN.
This scenario can for example be used in case a client initiates a connection using a different port than the one the server listens on.
Example: a user initiates SSH connection to new.service.com:22 but the server only accepts SSH connections on port 8022.
- Create a FQDN address object.
config firewall address
edit "new"
set type fqdn
set fqdn "new.service.com"
next
end
-
Create a firewall vip using a previously created FQDN object.
config firewall vip
edit "vip-ssh_to_new"
set type fqdn
set extintf "any"
set arp-reply disable
set extaddr "new.service.com"
set mapped-addr "new.service.com"
set extport 22
set mappedport 8022
next
end
-
Create a firewall policy referring to the previously created VIP in the destination address.
config firewall policy
edit 1
set name "ssh_to_new"
set srcintf "internal"
set dstintf "external"
set action accept
set srcaddr "all"
set dstaddr "vip-ssh_to_new"
set schedule "always"
set service "ALL"
next
end
|
