Virtual server with real servers on different subnets/interfaces - Possible? How?

[FloToHu]

Hi all,

I try to get "loadbalacing" (better call it host routing) working with virtual server and HTTP host as balancing method.

I got a cert with all 3 server names as aliases, configured all 3 servers with their hostnames.

Problem: What and how many firewall rules to get it working?

I added two rules for each subnet, but it seems that no matter which hostname I access, only one rule is triggered. The first host (serv1) which matches the triggered rule works flawless. The other two hosts just seem to work on startpage. Any hints how to fix this?

Do I need one very generic rule for both networks and why just works startpage? Is it due to persistance?

config firewall vip
    edit "serv1-3"
        set comment "Server1 + Server2 + Server3"
        set type server-load-balance
        set extip 172.16.0.1
        set extintf "any"
        set server-type https
        set http-ip-header enable
        set monitor "Check_Ping"
        set ldb-method http-host
        set persistence http-cookie
        set extport 443
        config realservers
            edit 1
                set ip 10.10.0.6
                set port 5000
                set http-host "serv1.example.com"
            next
            edit 2
                set ip 10.200.0.150
                set port 8080
                set http-host "serv2.example.com"
            next
            edit 3
                set ip 10.200.0.10
                set port 8080
                set http-host "serv3.example.com"
            next
        end
        set https-cookie-secure enable
        set http-multiplex enable
        set ssl-certificate "Cert-Serv1-3"
        set ssl-http-location-conversion enable
    next
end

 Thanks in advance,

     FloToHu

[Anthony_E]

Hello FloToHu,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Debbie_FTNT · Accepted solution]

Hey FloToHu,

When the FortiGate receives traffic for a VIP, it will look for the first matching policy it can find, and direct all traffic via that policy.

Other policies for that VIP will be ignored.

To have FortiGate forward the traffic to all configured real servers, not just the one matching the first policy, you will need a single policy that matches all three real servers.

This is possible as follows:

- go to 'System > Feature Select/Visibility' and enable 'Multiple Interface Policies', then click 'Apply'

CAREFUL: this will change the policy table in FortiGate; instead of showing in interface pairs it will show as a simple table; some more care will be required when creating and ordering policies to ensure that the policies are in the correct order

-> enabling the setting will NOT change the current policy order, all existing policies will be matched as before, but creating new policies needs some additional care

- I would suggest taking a config backup before making this change, to have an option to fall back on

- edit the inbound policy you have created and add the other internal interfaces to the destination

- edit the outbound policy and add the other internal interfaces as source

-> delete the duplicate inbound/outbound policies

[FloToHu]

Hello @Debbie_FTNT ,

thanks for your reply. We already have multiple interfaces enabled, since zones are to unflexible (interfaces cannot belong to more zones nor used standalone any more).  So it was easy to create this match-all-server rule and it seems to work.

But since this single rule construct is too permissive in my eyes, I will look for another solution. I had hoped that there is a way to create a rule for each server subnet. One server needs a more restrictive source than the other ones.

FloToHu

[Debbie_FTNT]

Hey FloToHu,

you could maybe put another policy on top with the VIP and that specific destination interface (with the more restrictive server) and set the specific source conditions?
And below it, have the general VIP policy and the two other interfaces?
It *should* work based on my understanding (as the restrictive policy would be matched on source criteria, and everything else would fall through to the second)
-> problems would happen if you have two unrestricted policies with different interfaces and the same VIP; the FortiGate would match based on VIP and source and select the first matching policy, and ignore the second (for the other real-server) completely.

Other than that, I wouldn't know of a solution though, apologies.