Re: pix/proxy issue

["Secure Scorp" <securescorp () gmail com>]

My understanding ( correct me if wrong),

Topology:
* You have two proxy servers in your PIX DMZ for internal users.
* The two proxy servers have virtual IPs and are load balanced.
* If lets say proxy-2 goes down, proxy-1 would take over .Techincally,
in this case, proxy-1 will respond for proxy-2's Virtual IP.

Issue:
* When proxy fails, it is expected that everything should failover to
teh proxy and it should work.
*However, with PIX in front of proxies , this doesnt work.

Suggestions:
* To start with, after failing over ( and when it doesnt work ) ,
clear arp and xlate on the PIX.  Test and please let me know the
results.

Thanks,
Aditya Govind Mukadam


On Thu, Jul 31, 2008 at 4:36 PM, bills <bills () momineen org> wrote:
> I have just implemented a new dmz on our pix 535.  The two forward proxies
> that reside in the dmz support internal web queries going out to the
> internet via virtual ip addresses assigned to each of the boxes.  Internal
> users use dns round robin for a type of load balancing between the two
> boxes.  The concept is that if one box goes down the other box will take
> over answering on both virtual ip addresses without the end user being
> impacted.  This is working on 3 internal proxies that do not use the
> firewall and also works for 2 reverse proxies in the dmz but only accepting
> traffic from external sources.  What is happening is that when I fail one
> box over to the other the traffic seems to not get past the firewall but if
> I switch the configuration back it works again.  If I add a new virtual ip
> to test the traffic gets there but again if I try to fail it over to the
> other box no traffic seems to get to the other box.  I have confirmed that
> the snmp heartbeat between the two boxes is working as it should and the
> proxy vendor has stated that its got to be the firewall preventing this.
>  Does anyone know if it has something to do with state table or anything
> related to the pix settings?
>
> Default:
> fwd1
> physical ip: 192.168.1.1
> virtual ip master: 192.168.1.3
> virtual ip slave: 192.168.1.4
>
> fwd2
> physical ip: 192.168.1.2
> virtual ip master: 192.168.1.4
> virtual ip slave: 192.168.1.3
>
> Failover scenerio would be taking fwd2 out of the loop and the snmp
> heartbeat transistions the virtual ip to the other box.
> fwd1
> physical ip: 192.168.1.1
> virtual ip master: 192.168.1.3
> virtual ip master: 192.168.1.4
>
> fwd2
> physical ip: 192.168.1.2
> virtual ip slave: 192.168.1.4
> virtual ip slave: 192.168.1.3
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () listserv icsalabs com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards