05-23-2011 02:04 PM
I currently have a static-nat configured with a single rule publishing http/https and it has been working well but now I have a need to add an additional web server hosting other webpages and I added a second rule listening on a seperate external IP (added to the proxy-arp table) and created policies to allow access from untrust to dmz for http/https on that internal IP. Now everything seemed to get sluggish and I get a lot of dropped connections on the first rule for the static-nat, should I have a seperate static-nat and rule for each machine on the dmz I publish? I am using 10.4R3.2 firmware.
I am currently working on splitting up my DMZ into anonymous and authenticated zones to see if that would make a difference.
05-23-2011 07:16 PM
I would recommend a single static NAT ruleset and a rule for each public IP. Don't forget your proxy-arp entry and policies. I'm not aware of any issues that would cause your issue. Feel free to post your config and we can have a look.
05-23-2011 08:09 PM
Thanks, I found the issue. At some point my secondary in the cluster took over and the routing engine "I think" didn't turn on, after restarting the whole cluster everything is working fine. What was odd though was my old rules continued to work but anything new that was being published to the internet failed. After reseting everything though all is good.
05-24-2011 04:40 AM