Configuración de Hairpin NAT (VIP) en la ruta de política

Equilibrador de carga.

# config firewall vip
edit «Test-VIP»
set uuid f3f77000-cec4-51eb-a69d-9b6116986fc3
set type server-load-balance
set extip 192.168.1.100
set extintf «port2»
set server-type http
set monitor «healthcheck»
set extport 80
# config realservers
edit 1
set ip 172.16.0.2
set port 80
       

El VIP está configurado en el enlace de Internet principal, pero todo el tráfico proveniente de la LAN 10.0.0.0/24 se enruta mediante la ruta de política sobre la configuración de la

interfaz WAN2.

Fw1 # show system interface port2  
# config system interface
    edit «port2»
        set vdom «root»
        set ip 192.168.1.1 255.255.255.0
        set allowaccess ping
        set type Physical
        set alias «wan1»
        set snmp-index 2
    next
end

Fw1 # show system interface port3
# config system interface
edit «port3»
set vdom «root»
set ip 192.168.2.1 255.255.255.0
set allowaccess ping
set type physical
set alias «wan2»
set snmp-index 3
next
end

Fw1 # show system interface port4
# config system interface
edit «port4»
set vdom «root»
set ip 10.0.0.1 255.255.255.0
set allowaccess ping
set type physical
set snmp-index 4
next
end

Fw1 # show system interface port5
# config system interface
edit «port5»
set vdom «root»
set ip 172.16.0.1 255.255.255.0
set allowaccess ping
set type physical
set snmp-index 5
next
end

Ruta de política desde Internet LAN 10.0.0.0/24 a través de WAN2.

Fw1 # show router policy
    edit 1
        set input-device «port4»
        set src «10.0.0.0/255.255.255.0»
        set dstaddr «all»
        set gateway 192.168.2.2
        set output-device «port3»
    next
end

Política de firewall de WAN1 a VIP.

Fw1 # show firewall policy
# config firewall policy
    edit 1
        set name «vip»
        set uuid d7b467a8-cec5-51eb-5f31-55cc9964d349
        set srcintf «port2»
        set dstintf «port5»
        set srcaddr «all»
        set dstaddr «Test-VIP»
        set action accept
        set schedule «always»
        set service «HTTP»
        set inspection-mode proxy
    next

Política de firewall de LAN a VIP.

Fw1 # show firewall policy
    edit 2
        set name «lan_to_vip»
        set uuid 4ef186ca-cec6-51eb-5395-e482928e6b56
        set srcintf «port4»
        set dstintf «port2»
        set srcaddr «Lan_10.0.0.0_24»
        set dstaddr «VIP_192.168.1.100»
        set action accept
        set schedule «always»
        set service «ALL»
    next
end

Flujo de depuración.

Fw1 # id=20085 trace_id=1 func=print_pkt_detail line=5700 msg=»vd-root:0 received a packet(proto=6, 10.0.0.2:54494->192.168.1.100:80) from port4. flag [S], seq 324277149, ack 0, win 64240″
id=20085 trace_id=1 func=init_ip_session_common line=5871 msg=»allocate a new session-00000860″
id=20085 trace_id=1 func=fw_pre_route_handler line=182 msg=»VIP-172.16.0.2:80, outdev-unknown»
id=20085 trace_id=1 func=__ip_session_run_tuple line=3492 msg=»DNAT 192.168.1.100:80->172.16.0.2:80″
id=20085 trace_id=1 func=vf_ip_route_input_common line=2566 msg=»Match policy routing id=1: to 192.168.2.2 via ifindex-5″
id=20085 trace_id=1 func=vf_ip_route_input_common line=2584 msg=»find a route: flag=04000000 gw-192.168.2.2 via port3″
id=20085 trace_id=1 func=fw_forward_handler line=640 msg=»Denied by forward policy check (policy 0)»
id=20085 trace_id=2 func=print_pkt_detail line=5700 msg=»vd-root:0 received a packet(proto=6, 10.0.0.2:54494->192.168.1.100:80) from port4. flag [S], seq 324277149, ack 0, win 64240″