Exchange Load Balancing

[rsaber]

Hello,

Basically the scenario is that we have one exchange server behind the firewall, external users are accessing this server usning a host name mapped by a service provider to two different Public IP's using DNS round robin,

Is it possible to configure two NATing rules for the same single host (the server). This way what ever IP the host name is hitting it will be successful,

But how can I overcome the issue for outgoing traffic, can I use PBR to send traffic using one link and in case it fails it will failover to the other link.

So at the end Incoming Traffic will be round robined and outgoing traffic will use one link and only failover when necessary.

Regards

[mikand]

I think you should be fine if you setup just two DNAT rules.

(example)

untrust -> trust

0.0.0.0 -> <firstip>

forward: <exchangeip>

untrust -> trust

0.0.0.0 -> <secondip>

forward: <exchangeip>

Im not sure if PA will then see this as a single flow and do the SNAT for you (I mean if client speaks to <firstip>, will the reply which <exchangeip> sends back to the PA device automatically use <firstip> as source when sending the reply back to client?).

For the flows which the <exchangeip> initiates on its own I dont think you would need a SNAT rule for that (unless your exchangeserver use a private ip and you need to speak to internet).

[rsaber]

Thanks,

But the issue in the PA routing table it will have the 1st ISP as a destination, so even if I recieve traffic from the second it will be sent through the first and be dropped.

I found a similar problem here:

https://live.paloaltonetworks.com/message/13974#13974

As I understood PA will add a feature called Symmetric Return which will send the traffic back to the same ISP it came from.

[mikand]

Oh yeah that part, hmpf...

Yeah wait for symmetric return to arrive and it will fix these problems 🙂