Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 27 / 866

Network Address Translation and Spoofing
The servers load balanced by Equalizer provide applications or services on specific IP addresses
and ports, and are organized into virtual clusters, each with its own IP address. Clients send
requests to the cluster IP addresses on the appliance instead of sending them to the IP addresses
of the servers.
Central to the operation of any load balancer is the Network Address Translation (NAT)
subsystem. On Equalizer, NAT is used as follows:
1. When Equalizer receives a client packet, it always translates the destination IP (the cluster
IP) to the IP address of one of the server instances in a server pool. The server IP used is
determined by the cluster’s load balancing settings.
2. Depending on the setting of the cluster
spoof
option, Equalizer may also perform Source
NAT, or SNAT.
When the
spoof
option is enabled on a cluster, then SNAT is disabled: the NAT subsystem
leaves the client IP address as the source IP address in the packet it forwards to the server.
For this reason, the servers in a cluster with
spoof
enabled are usually configured to use
Equalizer’s IP address as their default gateway to ensure that all responses go through the
appliance (otherwise, the server would attempt to respond directly to the client IP).
When the
spoof
option is disabled on a cluster, then SNAT is enabled. Equalizer translates
the source IP (the client IP) to one of the appliance’s IP addresses before forwarding pack-
ets to a server. The servers will send responses back to the appliance’s IP (so it is usually
not necessary to set the appliance as the default gateway on the servers when
spoof
is dis-
abled).
Match rules can be used to selectively apply the
spoof
option to client requests. This is some-
times called selective SNAT. See
"Creating a New Match Rule"
on page 404.
3. When a server sends a response to a client request through Equalizer, the NAT subsystem
always translates the source IP in the response packets (that is, the server IP) to the cluster
IP to which the client originally sent the request. This is necessary since the client sent its
original request to the cluster IP and will not recognize the server’s IP address as a
response to its request -- instead, it will drop the packet.
Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.
All Rights Reserved. 27
Equalizer Administration Guide