Welcome to the Sophos User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

LinkBack Thread Tools Display Modes
Join Date: May 2008
Posts: 37
#1 (permalink)  
Old 02-11-2012, 07:45 PM
Default Load balancer and NAT rules wtih exchange.

I have two exchange 2010 servers behind my firewall. i have configured DAG. Now i need to loadbalance OWA. I dont know how to do this with Astaro.

i currently have a FULL NAT rule going to one of the exchange servers and it works without issue. I found no problem configuring server loadbalancing but i dont know how to NAT that. i assumed that creating a loadbalanced group would creat some virtual item that i could put in the NAT rules but it didnt.

my FULL NAT looks like this.

source (any)
protocol (HTTP/HTTPS)
destination ( external IP)

DNAT Destination ( exchange server 1)
DNAT Protocol (none)

SNAT Destination (Internal IP)
SNAT Protocol (none).

any help would be greatful. I searched the forums and the astro website but only found generic answers.

Thank you.

Reply With Quote
BAlfson's Avatar
Grandis Professorem Astaro
Join Date: Mar 2007
Location: Oklahoma City
Posts: 21,496
#2 (permalink)  
Old 02-12-2012, 01:22 PM

I don't know what a "loadbalanced group" is - do you mean that you configured 'Server Load Balancing' in 'Network Security'?

If so, then I think your NAT rule is capturing the traffic before 'Load Balancing' gets a chance to work. Just disable the NAT, and the load balancing rule, if correctly configured, should do what you seem to want.

Your question is interesting. I didn't realize that Exchange servers in a DAG were, in effect, "clustered" instead of providing standby backup for each other in the event of failure of one server.

Cheers - Bob
ACE V7 - Astaro Preferred Partner since V3
SCA/UTM - Sophos Gold Solution Partner
Addicted to my iPhone!
Reply With Quote
Join Date: May 2008
Posts: 37
#3 (permalink)  
Old 02-13-2012, 03:40 PM
Default the mailbox role

Yes the mailbox Role is active/passive but the client access role needs to be loadbalanced for seemless failover since i am not using a different CAS server.

So i disabled my FULL NAT rule and created the loadbalanced server do i need to now create a packet filter rule when using server load balancing ?

Also i only have a single external iP so thats why i was using NAT.
Reply With Quote
Join Date: Jul 2001
Location: southern California
Posts: 12,066
#4 (permalink)  
Old 02-13-2012, 07:36 PM

Hi, iirc, you do need a PacketFilter rule with the load balancer (and it wouldn't hurt even if it's not needed):

Source: any
Dest: EXT Interface (or whatever interface/IP the LoadBalancer is setup for)

IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

All times are GMT. The time now is 01:38 AM.

Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.