2

Scenairo: SSG140 in HA configuration. Four interfaces:

  • LAN (trust) eth0/0 172.20.0.0./24
  • ISP1 (untrust) eth0/1 1.1.1.130/28
  • ISP2 (untrust) eth0/2 2.2.2.194/28
  • ISP3 (untrust) eth0/3 3.3.3.130/28

ServerX with LAN IPs, and Mapped IPs (MIPs)

  • 172.20.10.100 -> 1.1.1.135
  • 172.20.20.100 -> 2.2.2.195
  • 172.20.30.100 -> 3.3.3.135

Default route 0.0.0.0/0 eth0/1 gw 1.1.1.129

Static destination routes for DNS servers of each ISP to use respective gateways:

  • DNS-ISP1 1.7.8.9/32 eth0/1 gw 1.1.1.129
  • DNS-ISP2 2.5.6.4/32 eth0/1 gw 2.2.2.193
  • DNS-ISP3 3.1.2.3/32 eth0/1 gw 3.3.3.129

One vrouter: trust-vr.

Here is our challenge:

Current:

  • Outbound traffic bound to 172.20.10.100 will pickup MIP 1.1.1.135
  • Outbound traffic bound to 172.20.20.100 will pickup IP 1.1.1.130
  • Outbound traffic bound to 172.20.30.100 will pickup IP 1.1.1.130

Required:

  • Outbound traffic bound to 172.20.10.100 will pickup MIP 1.1.1.135
  • Outbound traffic bound to 172.20.20.100 will pickup MIP 2.2.2.195
  • Outbound traffic bound to 172.20.30.100 will pickup MIP 3.3.3.135

If we setup default routes on eth0/2 and eth0/3 then this has no effect as to the outbound traffic result.

If we setup connected routes on eth0/2 and eth0/3 then this overrides any destination routing.

If we setup source based routing for the server based on its 172.20.0.0/24 addresses, then this affects tunnel traffic.

If we setup source based routing for the server based on its MIP'ed addresses, then this has no material effect.

Should we be using policy based routing? Or are we missing a trick?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.