trying to migrate to routed mode

[davidm101]

We have multiples css11k configured as bridge mode.

The firewall has direct connection to all DMZ (one vlan per DMZ) and it is the default gateway for all servers. The CSS11K is connected to all DMZs and using the group NAT to relay traffic to the real servers. The firewall does NAT for public to private VIP.

We are trying to migrate to routed mode so the servers can capture true source IP addresses, reduce the number of default routes in the CSS and remove the public VIP NATed in the firewall (to setup content rule VIP using the public ip address).

A new test DMZ is setup and it is connected by CSS and the real HTTPs servers. A test ip address is

configured at the firewall without NAT and the firewall is configured to route the incoming traffic to the CSS through one of the existing DMZ. The content rule of the CSS is configured using the test public ip address. I can see traffic in/out through the two sniffers I setup (between f/w and CSS, and CSS and real server). Most of time, we cannot get page displayed. The firewall log showed all traffic in/out through the correct interface. The sniffer showed data retransmission, tcp rest, tcp out of order .....

Any suggestion.

p.s. The ssl certificate is associated with the public ip address. The server is working fine if we connect the firewall directly to the new test DMZ and have firewall does the server IP NAT.

[Gilles Dufour]

can we have the config and maybe the sniffer traces.

Gilles.

[davidm101]

here is section of the cfg (modified ip address and name):

############# using network 10.10.20.0/255.255.255.0 to route 100.1.1.1 traffic to CSS11K

ip route 0.0.0.0 0.0.0.0 10.10.20.1

ip route 0.0.0.0 0.0.0.0 10.10.10.1

!************************* INTERFACE *************************

interface 1/1

trunk

redundancy-phy

vlan 10

vlan 20

vlan 30

interface 2/1

trunk

vlan 10

vlan 20

vlan 30

interface 3/1

bridge vlan 999

phy 100Mbits-FD

!************************** CIRCUIT **************************

circuit VLAN10

redundancy

ip address 10.10.10.254 255.255.255.0

no redirects

circuit VLAN20

redundancy

ip address 10.10.20.254 255.255.255.0

no redirects

circuit VLAN30

redundancy

ip address 10.10.30.254 255.255.255.0

no redirects

circuit VLAN999

description "Box-to-Box Redundancy VLAN"

ip address 10.0.0.1 255.255.255.252

redundancy-protocol

!************************** SERVICE **************************

service VLAN10-SERVER-1

ip address 10.10.10.125

protocol tcp

port 80

domain test.vlan10.com

keepalive type tcp

keepalive port 80

active

service VLAN10-SERVER-2

ip address 10.10.10.126

protocol tcp

port 80

domain test.vlan10.com

keepalive type tcp

keepalive port 80

active

service VLAN20-SERVER-1

ip address 10.10.20.125

protocol tcp

port 80

domain test.vlan20.com

keepalive type tcp

keepalive port 80

active

service VLAN20-SERVER-2

ip address 10.10.20.126

protocol tcp

port 80

domain test.vlan20.com

keepalive type tcp

keepalive port 80

active

service ROUTED-SERVER

protocol tcp

ip address 10.10.30.18

no cache-bypass

keepalive type tcp

keepalive port 443

keepalive frequency 60

port 443

domain ROUTED-SERVER.com

active

!*************************** OWNER ***************************

owner vlan10

content vlan10.com

dnsbalance roundrobin

vip address 10.10.10.100

protocol tcp

port 80

balance aca

add service VLAN10-SERVER-1

add service VLAN10-SERVER-2

advanced-balance sticky-srcip

active

owner vlan20

content vlan20.com

vip address 10.10.20.100

protocol tcp

port 443

add service VLAN20-SERVER-1

add service VLAN20-SERVER-2

advanced-balance sticky-srcip

active

owner routed-segment

content routed-server.com

vip address 100.1.1.1

balance aca

port 443

protocol tcp

dnsbalance roundrobin

add service ROUTE-SERVER

active

!*************************** GROUP ***************************

group group.nat.vlan10

portmap number-of-ports 14304

vip address 10.10.10.100

add destination service VLAN10-SERVER-1

add destination service VLAN10-SERVER-2

active

group group.nat.vlan20

portmap number-of-ports 14304

vip address 10.10.20.100

add destination service VLAN20-SERVER-1

add destination service VLAN20-SERVER-2

active