hmmm...ok....that makes sense...the issue is that the same VIP is listening on different ports in different content rules.
eg) the servers at the backend are doing http, https, and ftp...so the current rules listen on port 80, 443, and 21 respectively. the port ranges are for the ftp data channels...and are configured to listen on 17000-17100.
eg)
service webserver1
ip address 10.0.0.1
protocol tcp
port 80
active
service webserver2
ip address 10.0.0.2
protocol tcp
port 80
active
service ftpserver1
ip address 10.0.0.1
protocol tcp
port 21
active
service ftpserver2
ip address 10.0.0.2
protocol tcp
port 21
active
service ftpserver1_data
ip address 10.0.0.1
protocol tcp
port 17000 range 100
active
service ftpserver2_data
ip address 10.0.0.2
protocol tcp
port 17000 range 100
active
content webserver
vip address 20.0.0.1
add service webserver1
add service webserver2
protocol tcp
port 80
active
content ftpserver
vip address 20.0.0.1
add service ftpserver1
add service ftpserver2
protocol tcp
port 21
application ftp-control
content ftpserver_data
vip address 20.0.0.1
add service ftpserver1_data
add service ftpserver2_data
application ftp-control
port 0
Will that work? I don't want to unnecessarily expose the server to malicious traffic. Am I crafting the ftp data channel correctly?
How would I implement an ACL to only limit ports 17000 to 17100 using the above example?
thanks again!
sandeep
