CSS Implementation

[bdavis01]

Currently CSS 11500 is setup on inside network behind firewall and is set with a default route of our core switch. If possible though would like to load balance servers on both the inside and DMZ networks. Is this going to be possible and if so how do I do it?

Thanks

[Gilles Dufour]

with 1 css it is not possible without loosing on security.

The reason is that the CSS needs to see the response from the servers.

So you would have to make sure that traffic from the servers in the DMZ goes back to CSS located on the inside and then out through the firewall.

This is like connecting a router between dmz and inside which is not good.

Solution A - a 2nd CSS for the dmz.

Solution B - move the CSS on the outside [assuming you do not need to loadbalance connection from internal users]

Solution C - you leave the CSS on the inside but you configure client nat to guarantee that dmz servers will send traffic back to CSS through the firewall

[disadvantage - your servers won't know the real client ip address]

Regards,

Gilles.

[bdavis01]

That really helps, thank you....