Internal LAN load balancing

[sjwinick]

i know that the fortigate permits load balancing from an external virtual IP to multiple internal real servers. ive done that successfully my question is can this be done completely on the internal LAN? ie, have a virtual IP appear on the LAN that is redirected to multiple real IP addresses that are also on the LAN? if yes, how is it done? btw, the manual shows that there are many " types" of load balancing in a pull-down menu, including HTTP, HTTPS, SSL, TCP, etc. however, on my unit, when i create a new virtual server, the only choices are HTTP, TCP, UDP and IP. can' t find any of the other choices described. same thing for persistence. only 2 choices and the SSL one is always greyed out. anyone know why? thanks sjw

[rocampo]

my question is can this be done completely on the internal LAN? ie, have a virtual IP appear on the LAN that is redirected to multiple real IP addresses that are also on the LAN? if yes, how is it done?

If this is what you want: Virtual IP 192.168.1.1 that load balances to lets say 192.168.1.2, 192.168.1.3 and 192.168.1.4 then your client workstation is also on 192.168.1.x network lets say 192.168.1.100. I don' t think this is possible, mainly because the FG cannot keep track of the session and the TCP 3way handshake might not happen. Look at this scenario. 192.168.1.100 initiates connection to Virtual IP 192.168.1.1 FG answers due to proxy ARP and forwards the traffic to 192.168.1.2 This is where TCP 3 way handshake breaks... 192.168.1.2 responds to the TCP SYNC directly to 192.168.1.100. 192.168.1.100 receives this but since it is trying to connect to 192.168.1.1 it will discard the response from 192.168.1.2 3 way handshake does not happen, no TCP connection. If you are using windows servers and what to do this, look at clustering.

[ede_pfau]

I finally found the time to ask " my" Fortinet SE. He set it up in the lab and confirms that it works. My scenario would be to load balance 2 DNS as failover from primary to secondary DNS on a host can take up to 20 sec. Quite a surprise! A not-so-recent feature appears to be helpful in a different context. That' s what I call a tool!

[ede_pfau]

This might be a little confusing if you' re not used to it: In the VIP policy the VIP is given as the DESTINATION address, but is defined on the SOURCE interface. Example: you want to translate an internal IP 192.168.234.104 to your external favorite time server on wan1, 192.53.103.104. You define a VIP " ext_NTP_VIP" with ' external IP addr' =192.168.234.104, ' external interface' =internal, ' mapped to addr' =192.53.103.104, [' port' =123 if you like]. The policy to use the VIP is: source IF=internal, source addr=all, dest IF=wan1, dest addr=ext_NTP_VIP, service=NTP. If you define the VIP on the wrong IF you won' t see it in the drop down list.

[CHR57]

Can someone explain more in detail how to have the Virtual Server on the same lan as the Real Servers?

[CHR57]

I can't get this to work.

It works when I change the virtual server address to another subnet on the same v-lan.