Jimmy,
Do you enable DSR?
Regards,
-----Mensagem original-----
De: [email protected]
[mailto:[email protected]] Em nome de Jimmy Stewpot
Enviada em: Thursday, July 29, 2010 4:29 AM
Para: Jimmy Stewpot
Cc: [email protected]
Assunto: Re: [f-nsp] serveriron traffic flow for SMTP
Hi All,
When I set the servers default gateway to the VIP IP rather than the router
IP the system began to function as I had hoped.
Regards,
Jimmy.
----- Original Message -----
From: "Jimmy Stewpot" <[email protected]>
To: [email protected]
Sent: Thursday, 29 July, 2010 3:43:15 PM
Subject: [f-nsp] serveriron traffic flow for SMTP
Hello,
I currently have a problem which I am trying to find a simple solution to. I
am hoping that someone here will be able to provide some tips. We have an
SMTP VIP which has two real servers associated with them. In front of the
Load balancer we have a Cisco ASA firewall which has permit rules for SMTP
to both real servers and the VIP on port 25 both directions. The inbound
email comes to port 25 on the VIP and then gets load balanced to the
respective real servers without any problems. However the return connection
comes back directly to the gateway which resides on the ASA. The problem is
that the ASA then has no session and rejects the SYN ACK and the connections
are not established. The simple solution is to use source-nat but that
removes any possible use of rbl's and black lists because every source
address appears as the VIP IP.
Is there any easy way around that while still allowing us to have the smtp
restrictions required (e.g. rbls etc).
sh ver
SW: Version 10.2.01nTI4 Copyright (c) 1996-2007 Foundry Networks, Inc.
Compiled on Feb 01 2010 at 20:02:55 labeled as WJR10201n
HW: Stackable Router, SYSIF version 21, Serial #: Non-exist
Regards,
Jimmy Stewpot.
_______________________________________________
foundry-nsp mailing list
[email protected]
http://puck.nether.net/mailman/listinfo/foundry-nsp
_______________________________________________
foundry-nsp mailing list
[email protected]
http://puck.nether.net/mailman/listinfo/foundry-nsp
_______________________________________________
foundry-nsp mailing list
[email protected]
http://puck.nether.net/mailman/listinfo/foundry-nsp
