I have a pair of CSS configured for Active-Active Virtual IP (VIP) and virtual interface redundancy. I was recently told that some servers on the backend VLAN need to talk to a client VIP. To ensure the CSS stays in a conversation I need to source NAT. Unfortunately the "client" users of the application cannot be subject to source NAT.
Long term I will be creating a new VLAN interface to split the servers up (waiting on cabling). As a short-term fix I want to implement a "one-armed" VIP as a temporary solution for server to server communication. Servers would point at this temporary VIP and a group used for source NAT.
My question is what VIP address do I use on the group? Do I use the Content rule VIP or configure different VIPs for the group? Also do I need unique group VIPs for each CSS when using this redundant configuration. I have axtra IP addresses available if I need to use them.
Example Configs
===============
CSS Number 1:
owner OneArmed
content ProdServers
protocol tcp
port 80
add service Prod1
add service Prod2
balance leastconn
vip address 192.168.1.10
active
!************************** CIRCUIT **************************
circuit VLAN1
ip address 192.168.0.5 255.255.255.0
ip virtual-router 1 priority 102 preempt
ip redundant-vip 1 192.168.0.10
!*************************** GROUP ***************************
group ProdServers
vip address 192.168.0.?? (192.168.0.10 or unique e.g. 192.168.0.20)
add destination service Prod1
add destination service Prod2
active
CSS Number 2:
owner OneArmed
content ProdServers
protocol tcp
port 80
add service Prod1
add service Prod2
balance leastconn
vip address 192.168.1.10
active
!************************** CIRCUIT **************************
circuit VLAN1
ip address 192.168.0.6 255.255.255.0
ip virtual-router 1 priority 101
!*************************** GROUP ***************************
group ProdServers
vip address 192.168.0.?? (192.168.0.10 or unique e.g. 192.168.0.21)
add destination service Prod1
add destination service Prod2
active
