Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 415 / 866

Using Persistence with Match Rules
When a match rule is configured you can specify that persistence methods for that match rule --
which supercede those the persistence method specified for a cluster. This is the persistence type
to be used when the match rules conditions are met. For example, if you configured a match rule
expression to redirect requests to Server A based on the criteria configured in an expression, you
can also configure the persistence type to be used when that criteria is met.
To configure persistence with match rules select a configured match rule on the left navigational
pane of the GUI. Select the
Persistence tab to display the configuration screen. It is configured
the same as the configuration of HTTP and HTTPS cluster persistence.
Changing the Spoof (SNAT) Setting Using Match Rules
By default, Equalizer uses the client IP address as the source address in the packets it forwards to
server pools, and then translates the server IP in server responses to Equalizer’s cluster IP. This
is commonly called a
Half-NAT configuration, since Equalizer is not performing Network Address
translation (or NAT) on client requests. Because the server pools behind Equalizer see the source
IP of the client, the server pools need to be configured to route client requests back through
Equalizer -- either by making Equalizer the default. This behavior is controlled by the
Spoof
option, which is enabled by default. Half-NAT configurations are only a problem when a client is
on the same subnet as the servers behind Equalizer, since the servers will try to respond directly
back to the client -- which will not recognize the server connection as a response to it’s original
request and so refuse the connection.
This "local client" problem is solved by disabling the
Spoof
option. When
Spoof
is disabled,
Equalizer translates the source IP address in the request to one of Equalizer’s IP addresses before
sending it on to the server. This is called
Source Network Address Translation , or SNAT -- and this
configuration is often called Full-NAT , since Equalizer is translating the client IP in packets from
clients, as well as the server IP in packets from servers. In this case, servers will send responses
to Equalizer’s IP address, so no special routing or gateway is needed on the server.
So, clusters with clients on a different subnet than the server pools behind it can have the spoof
option enabled, while clusters with only local clients should have spoof disabled.
But what do you do if you expect client requests to come to the cluster from the local server
subnet as well as other subnets?
In network configurations where Equalizer needs to be able to forward server responses to clients
on the server subnet as well as other subnets for the same virtual cluster IP, the
Spoof option can
be selectively enabled or disabled by creating a Layer 7 match rule that looks for specific client IP
addresses in incoming requests. When an incoming request’s source IP matches the rule,
Spoof
will be set as appropriate for that connection. This is commonly called Selective SNAT .
On Equalizer, implementing Selective SNAT using a Match Rule is the recommended method to
allow local access to Layer 7 clusters with
Spoof
enabled; other alternatives include:
l
adding static routes on all your server pools to clients on the server’s local subnet
l
creating two clusters -- one on the non-server subnet with spoof enabled, and one on the
server subnet with spoof disabled
Selective SNAT using a match rule is more easily implemented and maintained than either of the
above methods, but can be configured only for Layer 7 clusters. If you require Selective SNAT
with a Layer 4 cluster, you’ll need to use one of the above methods.
Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.
All Rights Reserved. 415
Equalizer Administration Guide