Firewall Wizards mailing list archives
Re: pix/proxy issue
From: "Secure Scorp" <securescorp () gmail com>
Date: Tue, 5 Aug 2008 00:43:56 -0600
My understanding ( correct me if wrong), Topology: * You have two proxy servers in your PIX DMZ for internal users. * The two proxy servers have virtual IPs and are load balanced. * If lets say proxy-2 goes down, proxy-1 would take over .Techincally, in this case, proxy-1 will respond for proxy-2's Virtual IP. Issue: * When proxy fails, it is expected that everything should failover to teh proxy and it should work. *However, with PIX in front of proxies , this doesnt work. Suggestions: * To start with, after failing over ( and when it doesnt work ) , clear arp and xlate on the PIX. Test and please let me know the results. Thanks, Aditya Govind Mukadam On Thu, Jul 31, 2008 at 4:36 PM, bills <bills () momineen org> wrote:
I have just implemented a new dmz on our pix 535. The two forward proxies that reside in the dmz support internal web queries going out to the internet via virtual ip addresses assigned to each of the boxes. Internal users use dns round robin for a type of load balancing between the two boxes. The concept is that if one box goes down the other box will take over answering on both virtual ip addresses without the end user being impacted. This is working on 3 internal proxies that do not use the firewall and also works for 2 reverse proxies in the dmz but only accepting traffic from external sources. What is happening is that when I fail one box over to the other the traffic seems to not get past the firewall but if I switch the configuration back it works again. If I add a new virtual ip to test the traffic gets there but again if I try to fail it over to the other box no traffic seems to get to the other box. I have confirmed that the snmp heartbeat between the two boxes is working as it should and the proxy vendor has stated that its got to be the firewall preventing this. Does anyone know if it has something to do with state table or anything related to the pix settings? Default: fwd1 physical ip: 192.168.1.1 virtual ip master: 192.168.1.3 virtual ip slave: 192.168.1.4 fwd2 physical ip: 192.168.1.2 virtual ip master: 192.168.1.4 virtual ip slave: 192.168.1.3 Failover scenerio would be taking fwd2 out of the loop and the snmp heartbeat transistions the virtual ip to the other box. fwd1 physical ip: 192.168.1.1 virtual ip master: 192.168.1.3 virtual ip master: 192.168.1.4 fwd2 physical ip: 192.168.1.2 virtual ip slave: 192.168.1.4 virtual ip slave: 192.168.1.3 _______________________________________________ firewall-wizards mailing list firewall-wizards () listserv icsalabs com https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________ firewall-wizards mailing list firewall-wizards () listserv icsalabs com https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- pix/proxy issue bills (Aug 01)
- Re: pix/proxy issue Secure Scorp (Aug 05)