We have an ECommerce website that need to access our servers that are in our DMZ zone. These servers has IP 172.x.x.5, 172.x.x.6 and 172.x.x.8, these servers are configured in a cluster with IP 172.x.x.7. So incoming and outgoing communication is through the cluster IP address.
I configured, if from any source wants to contact IP 194.x.x.187 it has to be NAT to the cluster IP address. From intern connections this works and we get a window to authenticate to the servers and that is what we want. If I do the same from external IP address (from my home computer), I only get a blank page. In the firewall monitoring I see that this connection is allowed, without any problem.
What I think the problem is, that I need to configure that the DMZ address 172.x.x.7 needs to be translated to the external IP address 194.x.x.187, because otherwise the server will answer with a different IP address and the client doesn't recognize it.
But how do I configure this, if my theory is right?
Thanks in advance.
Could you please attach the snapshot or mention how the NAT and security policies are configured for this server cluster located in DMZ zone ?
Based on your description, you can configure following NAT and Security policy :
Untrust to Untrust if destination is 194.x.x.187 translate to 172.x.x.7
Untrust to DMZ if destination is 194.x.x.187 allow
Just to test move both of these rules to test, commit and test it from external connection and see if that resolves the issue. Thank you.
Please provide us snapshot for traffic log for untrust to DMZ. That will help us to determine policy, NAT or server issue.
Ok I found the problem. The problem was not the firewall but the authentication with the IIS authentication method. This needs to be NTLM.
I am glad you found the issue. Always try to look traffic log, You can determine NAT, Policy or pre/post firewall issues from it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!