Home page logo
/

firewall-wizards logo Firewall Wizards mailing list archives

Re: pix/proxy issue
From: "Secure Scorp" <securescorp () gmail com>
Date: Tue, 5 Aug 2008 00:43:56 -0600

My understanding ( correct me if wrong),

Topology:
* You have two proxy servers in your PIX DMZ for internal users.
* The two proxy servers have virtual IPs and are load balanced.
* If lets say proxy-2 goes down, proxy-1 would take over .Techincally,
in this case, proxy-1 will respond for proxy-2's Virtual IP.

Issue:
* When proxy fails, it is expected that everything should failover to
teh proxy and it should work.
*However, with PIX in front of proxies , this doesnt work.

Suggestions:
* To start with, after failing over ( and when it doesnt work ) ,
clear arp and xlate on the PIX.  Test and please let me know the
results.

Thanks,
Aditya Govind Mukadam


On Thu, Jul 31, 2008 at 4:36 PM, bills <bills () momineen org> wrote:
I have just implemented a new dmz on our pix 535.  The two forward proxies
that reside in the dmz support internal web queries going out to the
internet via virtual ip addresses assigned to each of the boxes.  Internal
users use dns round robin for a type of load balancing between the two
boxes.  The concept is that if one box goes down the other box will take
over answering on both virtual ip addresses without the end user being
impacted.  This is working on 3 internal proxies that do not use the
firewall and also works for 2 reverse proxies in the dmz but only accepting
traffic from external sources.  What is happening is that when I fail one
box over to the other the traffic seems to not get past the firewall but if
I switch the configuration back it works again.  If I add a new virtual ip
to test the traffic gets there but again if I try to fail it over to the
other box no traffic seems to get to the other box.  I have confirmed that
the snmp heartbeat between the two boxes is working as it should and the
proxy vendor has stated that its got to be the firewall preventing this.
 Does anyone know if it has something to do with state table or anything
related to the pix settings?

Default:
fwd1
physical ip: 192.168.1.1
virtual ip master: 192.168.1.3
virtual ip slave: 192.168.1.4

fwd2
physical ip: 192.168.1.2
virtual ip master: 192.168.1.4
virtual ip slave: 192.168.1.3

Failover scenerio would be taking fwd2 out of the loop and the snmp
heartbeat transistions the virtual ip to the other box.
fwd1
physical ip: 192.168.1.1
virtual ip master: 192.168.1.3
virtual ip master: 192.168.1.4

fwd2
physical ip: 192.168.1.2
virtual ip slave: 192.168.1.4
virtual ip slave: 192.168.1.3

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]