Figure D-2. Proxy Map using IP Address Aliasing
In this network, the management application is managing devices in two DMZs via a Ranger Gateway
and a set of three ZoneRangers. The Ranger Gateway and management application are installed on
different servers. There are five devices to be managed in all: 10.2.1.1, 10.2.1.2, 10.4.1.1, 10.4.1.2, and
10.4.1.3. In order to enable the Ranger Gateway to intercept traffic destined for these devices, five IP
address aliases are defined on the Ranger Gateway application server: 10.10.1.21, 10.10.1.22,
10.10.1.23, 10.10.1.24, and 10.10.1.25. The management application server is configured with static
routes so that all traffic destined for the alias addresses will be routed to the Ranger Gateway server
(10.1.1.2). The Proxy Map in the Ranger Gateway is configured to translate the alias addresses to the
actual device addresses. Note that the management application server routing table in the figure above
could be simplified by configuring a single subnet route (10.10.1.0/24
->
10.2.1.2), provided that the
there are no devices with addresses in the specified subnet that need to be routed normally (e.g. to the
management application server’s default gateway). In general, alias addresses should be chosen so as to
avoid confusion with actual device addresses.
It should be noted that in the case where the management application and the Ranger Gateway are
installed in different servers, the need for static routing rules in the management application server can
typically be eliminated if the IP addresses alias values lie within the same subnet as the management
application server and Ranger Gateway server. From the example above, assuming that management
application server IP address and the primary address associated with the Ranger Gateway are both in
the 10.1.1.0/24 subnet, if sufficient unused addresses in this subnet could be found, these addresses
could be used as the alias addresses.
ZoneRanger 5.5 User's Guide
368
