04-18-2016 12:54 PM
I can't find anything which goes into enough detail on Active-Active design around NAT and more importantly ARP.
The easiest way to explain the current deployment is as follows:
Each firewall is connected to unique networks and routers internally and externally.
The expectation is to provide redundancy by putting both firewalls in HA A/A and setting floating addresses so that each firewall will be the primary for its site as listed above but in the event of a site or firewall failure the remaining firewall will take over both site and firewall responsibility.
From a network point of view we have L2 connectivity for all networks across both sites. The A/A config is such that floating IPs mean the correct firewall will ARP for the correct addresses for that site. Everything works fine apart from the NAT. DeviceID 0 is Primary, DeviceID 1 is Secondary
Destination NAT for Site 1 is fine. I have bound all destination NAT rules for Site 1 to the “Primary” device. So Firewall A arps for all destination NAT addresses. If Firewall A fails the remaining device becomes primary and ARPs for all destination NAT addresses.
The Problem 1:
Destination NAT for Site 2 can only be bound to DeviceID 1 which means if it fails the remaining firewall doesn’t arp for the Destination NAT. If I change the NAT binding to both I get an arp conflict for the IP as both firewalls are on the same L2 network and its hit and miss as to which firewall the routers send the traffic.
The Problem 2:
Source NAT can only be bound to DeviceID 0 or DeviceID 1. Which means similar to problem 1 I either get no failover or an ARP conflict.
I feel like the solution is to have a "Secondary" bind option and to allow Source NAT rules to be able to be bound to both Primary and Secondary devices.
Am I missing something from the network design or is this a limitation of the Active-Active Technology. A work around would be to disable the NAT rules from ARPing and it all being managed by the HA floating address configuration. Is there a CLI command to disable NAT rule ARPing?
Any advice appriciated.
