Hello list,
I have a dual fw setup with 3 zones - lan, wan and dmz,
I have no problem with this setup in active/passive mode,
but in active/active mode the NAT for my lan does not work.
Please do help me out with any ideas how to make my setup run properly.
Here are the interface config files on FW1:
---
# cat /etc/hostname.em0
up
description "VLANs interface"
---
# cat /etc/hostname.em2
inet 10.0.2.201 255.255.0.0 NONE
description "lan interface"
---
# cat /etc/hostname.em3
inet xx.yy.zz.5 255.255.255.192 NONE
description "dmz interface"
---
# cat /etc/hostname.vlan1337
vlan 1337 vlandev em0
inet xx.yy.zz.157 255.255.255.248 NONE
description "wan VLAN"
---
# cat /etc/hostname.vlan3999
inet 10.129.255.253 255.255.255.252 NONE vlan 3999 vlandev em0
description "PFSync interface"
---
# cat /etc/hostname.pfsync0
up defer syncdev vlan3999
---
# cat /etc/hostname.carp1
carpdev em2 carpnodes 11:0,12:100 balancing ip-unicast
carppeer 10.0.2.202 pass xxyyzz
inet 10.0.2.200 255.255.0.0 NONE
inet alias 172.20.0.200 255.255.255.0 NONE
description "lan CARP"
---
# cat /etc/hostname.carp2
carpdev vlan1337 carpnodes 21:0,22:100 balancing ip-unicast
carppeer xx.yy.zz.158 pass yyzzxx
inet xx.yy.zz.156 255.255.255.248 NONE
description "wan VLAN1337 CARP"
---
# cat /etc/hostname.carp3
carpdev em3 carpnodes 31:0,32:100 balancing ip-unicast
carppeer xx.yy.zz.6 pass zzyyxx
description "dmz CARP"
inet xx.yy.zz.3 255.255.255.192 NONE
inet alias xx.yy.zz.4 255.255.255.192 NONE
inet alias xx.yy.zz.7 255.255.255.192 NONE
inet alias xx.yy.zz.8 255.255.255.192 NONE
inet alias xx.yy.zz.9 255.255.255.192 NONE
inet alias xx.yy.zz.10 255.255.255.192 NONE
inet alias xx.yy.zz.11 255.255.255.192 NONE
inet alias xx.yy.zz.12 255.255.255.192 NONE
inet alias xx.yy.zz.13 255.255.255.192 NONE
inet alias xx.yy.zz.14 255.255.255.192 NONE
inet alias xx.yy.zz.15 255.255.255.192 NONE
---
and here are the interface config files on FW2
---
# cat /etc/hostname.em0
up
description "VLANs interface"
---
# cat /etc/hostname.em2
inet 10.0.2.202 255.255.0.0 NONE
description "lan interface"
---
# cat /etc/hostname.em3
inet xx.yy.zz.6 255.255.255.192 NONE
description "dmz interface"
---
# cat /etc/hostname.vlan1337
vlan 1337 vlandev em0
inet xx.yy.zz.158 255.255.255.248 NONE
description "wan VLAN"
---
# cat /etc/hostname.vlan3999
inet 10.129.255.254 255.255.255.252 NONE vlan 3999 vlandev em0
description "PFSync interface"
---
# cat /etc/hostname.pfsync0
up defer syncdev vlan3999
---
# cat /etc/hostname.carp1
carpdev em2 carpnodes 11:100,12:0 balancing ip-unicast
carppeer 10.0.2.201 pass xxyyzz
inet 10.0.2.200 255.255.0.0 NONE
inet alias 172.20.0.200 255.255.255.0 NONE
description "lan CARP"
---
# cat /etc/hostname.carp2
carpdev vlan1337 carpnodes 21:100,22:0 balancing ip-unicast
carppeer xx.yy.zz.157 pass yyzzxx
inet xx.yy.zz.156 255.255.255.248 NONE
description "wan VLAN1337 CARP"
---
# cat /etc/hostname.carp3
carpdev em3 carpnodes 31:100,32:0 balancing ip-unicast
carppeer xx.yy.zz.5 pass zzyyxx
description "dmz CARP"
inet xx.yy.zz.3 255.255.255.192 NONE
inet alias xx.yy.zz.4 255.255.255.192 NONE
inet alias xx.yy.zz.7 255.255.255.192 NONE
inet alias xx.yy.zz.8 255.255.255.192 NONE
inet alias xx.yy.zz.9 255.255.255.192 NONE
inet alias xx.yy.zz.10 255.255.255.192 NONE
inet alias xx.yy.zz.11 255.255.255.192 NONE
inet alias xx.yy.zz.12 255.255.255.192 NONE
inet alias xx.yy.zz.13 255.255.255.192 NONE
inet alias xx.yy.zz.14 255.255.255.192 NONE
inet alias xx.yy.zz.15 255.255.255.192 NONE
-----
My nat for the lan is bind to the dmz interface:
ext_if1 = "vlan1337"
nat_addr = "{ xx.yy.zz.8/30, xx.yy.zz.12/30 }"
match out log on $ext_if1 from $lan to !<internal> nat-to $nat_addr
round-robin sticky-address tag nat
This scenario is working without carp or with active/passive carp,
but when I use the active/active configuration the nat stops working, but
everything else work like a charm.
Any ideas?
