- Bronze, 100 points or more
Hi there. I have a problem that I'm having difficulties solving. I inherited a network design that I think is responsible for the problem but I'm hoping someone out there can help me out. Here's what I've got:
web-servers: dual NIC's with one NIC on a "local" VLAN (10.10.0.0/24), and the other NIC on the load-balancer backend VLAN (10.10.4.0/24)
Load-balancers: back-end VLAN (10.10.4.0/24), front-end in DMZ 10.10.8.0/24). Default-gateway goes to DMZ firewalls.
The problem I'm running into is that I can only configure it so that I can either connect directly to each web-server or I can only connect to the load-balanced vip address -- it's one or the other. I'm fairly certain that this is because since proper load-balancing requires all traffic to go through the load-balancer, the default gateway on my web servers is the Load-balancer.
I'm trying to configure it so that I can have access to the load-balanced VIP addresses from the local VLAN (10.10.0.0/24). How do I make that work though? I've tried using groups, but that didn't seem to work. One thing I haven't tried yet is to create a vip address for VLAN1. I've attached my config for review.
Thanks for your help!
you can change the default gateway of the server to be a router in the local vlan.
This will give you access to the servers directly.
Then, to get access to the vip, you need to configure a group with a group address belonging to the server subnet (10.10.4.x).
Like this, servers do not need to use a gw to respond to the CSS.
Give that a try and let me know if it works.