Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 28 / 866

Overview
4. NAT can also be enabled for packets that originate on the servers behind Equalizer and are
destined for subnets other than the subnet on which the servers reside -- on the appliance,
this is called outbound NAT. This is usually required in dual network mode when reserved IP
addresses (e.g., 10.x.x.x, 192.168.x.x) are being used on the internal interface, so that the
recipients do not see reserved IP addresses in packets originating from the servers. When
the global
outbound NAT
option is enabled, the appliance translates the source IP in packets
from the servers that are not part of a client connection to the the appliance’s Default VLAN
IP address (the external interface IP address on the E250GX and legacy ‘si’ systems), or to
the address specified in the server’s
Outbound NAT
tab. Enabling
outbound NAT,
as a result,
has a performance cost since the appliance is examining every outbound packet.
Note - When Equalizer is in single network mode, outbound NAT should be disabled. Since Equalizer resides on a
single subnet, outbound NAT is not needed, and may cause unexpected behavior.
When Equalizer receives a packet that is not destined for a virtual cluster IP address, a failover IP
address, a client IP address on an open connection, or one of its own IP addresses, the appliance
passes the packet through to the destination network unaltered.
28 Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.