About marregoces

Hi Amaresh,   The internal server may not need a public IP as it could be access from By Internet users through NAT.   These are the steps to follow:   1. assigned a public IP to the public load balancer that front-end the VM-Series FWs 2. add a NAT policy to all the FWs behind the public LB. The policy, I call it "Inbound DNAT". In the original packet section use Untrust in the src and dst zones, and add the IP address of the eth1 FW interface. In the Translater packet section use Dynamic IP and Port as Translation Type, Interface Address as Address Type and ethernet1/2 as Interface (leave IP address as None). Select the Destination Address Translatation and type either the IP address load balancer that front ends the internal server farm or the IP address of the internal server (private IP - make sure is static so if you reboot it does not change)   You also need to configure routing on the VM-Series and routing entry in the UDR to direct traffic in the internal server subnet through the VM-Series.   ... View more