Same ip pool on the Active/Active Cluster.

[Billy_]

Hi guys.

I want SSLVPN user to use NC IP Address from LDAP Server(LDAP Attribute).

They connect SA6500 Active/Active cluster.

But I have faced on critical problem.

In this case, both of SA6500 cluster nodes have to use same ip pool for users.

It means, internal L3 switch can't split route for SSLVPN user.

How can I get my goal?

Is it possible using another Load Balancer in the internal network for solving problem?

[erdinc_]

Hi ,

you can use a transparent/bridge device which is capable of learning Mac and send NC reverse packets this particular SA box . Load balancers have this ability called "auto last hop" , and some of the L3/L2 (fw , ips ) devices called reverse path forwarding check by MAC or so.

Erdinc Turna    

[RKB_]

Since its the A/A cluster the device will sync the NC connection profiles which contains details on how the IP address is going to be leased to users (static pool or from a DHCP server).

The other part of the config which will NOT be synched is under System -> Network -> Network connect

Here you specify the IP address filter for network connec clients indicating which pool of IP address will be handled by which node in the cluster.

Note: You can also make this filter a cluster wide setting.

Every NC user connecting to this cluster can get an unique NC IP address, now how the routing takes place is clear from the SA device to the backend network, but how the backend network takes care of routing back traffic to SA has to be determined.

Eg.,

Node A: IP pool from DHCP server - 192.168.1.1 to254

Node A: NC IP filter 192.168.1.1 to 192.168.1.100

Node B: IP pool from DHCP server - 192.168.1.1 to 254

Node B: NC IP filter 192.168.1.101 to 192.168.1.254

Users connecting to node A will get NC IP in the range of 1 to 100and users connecting to node B will get an IP in the range of 101 to 254

When NC uses start to send traffic, SA receives it and forwards to its next hop, now all the next hop / destination device needs to know is how to route back traffic.

May be you can have a route on the router / destination device for

192.168.1.1 to 192.168.1.100 gateway node A

192.168.1.101 to 192.168.1.254 gateway node B