Virtual IP and load balancing

[#1]

On firmware 3.x when creating a virtual IP there is an option " Server Load Balance" and you could use " static" , " round robin" and " weighted" forwarding between 2 or more IPs. How can you do the same thing on Firmware 4.x?

[ede_pfau]

Hi, in v4.00 there is a new GUI menu " Load Balance" . Fortinet has separated the virtual IP configuration and the " real servers" to be more flexible. In the Virtual Server config, check the " Load Balance Method" which can be Static, Round Robin, Weighted, First Alive, Least RTT and Least Session. So actually there are more options than before. HTH.

[#3]

Thank you for the reply. You are right, there is an entire new menu about load balancing. I managed to complete the setup.

[#4]

I have another question still related to the VIPs. I have 2 servers that I need to " load balance" between and have to do so when I' m hitting them from the internal network and from external also. I did try a few things using virtual server and virtual IP but couldn' t make it work. Any one has any ideas? Thanks.

[rwpatterson]

How far did you get (or rather what part didn' t work)?

[#6]

Well, here is what I tried: At first I created a virtual server using an IP from the private network. I can " load balance" from internal, then created a virtual IP forwarding a real IP to the virtual server IP. Obviously I created the need it policies to allow the traffic between the ports. Virtual IP External IP --> Virtual Server (internal IP) Virtual Server Internal IP --> Real Server 1, Real Server 2 With this config I cannot get to the real servers from outside. I think it has something to do with NAT-ing. I hope I was clear enough.

[rwpatterson]

What I have done is: 1) Create the load balancing servers to work on the outside 2) Make the inside connections work with the outside IP My way works. By " Load Balancing" I don' t mean VIP. Using version 4+, use the LB feature. There should be no need for any Virtual IP translations. Hope that helps.

[#8]

Thanks for the quick reply. Yes that way works fine, I also had that config working. I thought there maybe is a way to keep the traffic on the internal interface. I guess it is fine this way. Thank you again. Cheers