10-15-2004 01:09 PM
Currently CSS 11500 is setup on inside network behind firewall and is set with a default route of our core switch. If possible though would like to load balance servers on both the inside and DMZ networks. Is this going to be possible and if so how do I do it?
Thanks
10-16-2004 12:25 AM
with 1 css it is not possible without loosing on security.
The reason is that the CSS needs to see the response from the servers.
So you would have to make sure that traffic from the servers in the DMZ goes back to CSS located on the inside and then out through the firewall.
This is like connecting a router between dmz and inside which is not good.
Solution A - a 2nd CSS for the dmz.
Solution B - move the CSS on the outside [assuming you do not need to loadbalance connection from internal users]
Solution C - you leave the CSS on the inside but you configure client nat to guarantee that dmz servers will send traffic back to CSS through the firewall
[disadvantage - your servers won't know the real client ip address]
Regards,
Gilles.
10-16-2004 11:10 AM
That really helps, thank you....
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide