Web: Example for Configuring Source NAT in Load Balancing Scenarios (Active and Standby FWs Using the Same Address Pool)

Procedure

1. Set interface IP addresses and assign the interfaces to security zones.
   1. Set interface IP addresses on FW_A and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE0/0/1 and set the parameters as follows:

         Zone	untrust
         IPv4
         IP Address	10.2.0.1/24

      3. Click OK.

      4. Repeat the preceding steps to configure GE0/0/3.

         Zone	trust
         IPv4
         IP Address	10.3.0.1/24

      5. Repeat the preceding steps to configure GE0/0/7.

         Zone	dmz
         IPv4
         IP Address	10.10.0.1/24

   2. Set interface IP addresses on FW_A and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE0/0/1 and set the parameters as follows:

         Zone	untrust
         IPv4
         IP Address	10.2.1.1/24

      3. Click OK.

      4. Repeat the preceding steps to configure GE0/0/3.

         Zone	trust
         IPv4
         IP Address	10.3.1.1/24

      5. Repeat the preceding steps to configure GE0/0/7.

         Zone	dmz
         IPv4
         IP Address	10.10.0.2/24

2. Configure OSPF on FW_A and FW_B.
   1. Configure OSPF on FW_A.
      1. Choose Network > Route > OSPF.
      2. Click Add in the OSPF list.
      3. Create an OSPF process and set the parameters as follows:
         • Process ID: 10
         • Router ID: 1.1.1.1
      4. Click of OSPF process 1. In the navigation tree, choose Basic Configuration > Area Settings.
      5. Click Add to create an area.
      6. Set area parameters as follows:

         Area	0.0.0.0
         IP Network	10.2.0.0
         Mask/Wildcard Mask	255.255.255.0

         Area	0.0.0.0
         IP Network	10.3.0.0
         Mask/Wildcard Mask	255.255.255.0

      7. Import a static route into OSPF and import the NAT address pool route to the upstream router.

         Choose Advanced Setting > Route Import and click Add.

         Set Route Type to UNR.

   2. Configure OSPF on FW_B.
      1. Choose Network > Route > OSPF.
      2. Click Add in the OSPF list.
      3. Create an OSPF process and set the parameters as follows:
         • Process ID: 10
         • Router ID: 1.1.1.2
      4. Click of OSPF process 10. In the navigation tree, choose Basic Configuration > Area Settings.
      5. Click Add to create an area.
      6. Set area parameters as follows:

         Area	0.0.0.0
         IP Network	10.2.1.0
         Mask/Wildcard Mask	255.255.255.0

         Area	0.0.0.0
         IP Network	10.3.1.0
         Mask/Wildcard Mask	255.255.255.0

      7. Import a static route into OSPF and import the NAT address pool route to the upstream router.

         Choose Advanced Setting > Route Import and click Add.

         Set Route Type to UNR.

3. Configure hot standby.
   1. Configure hot standby on FW_A.
      1. Choose System > High Availability > Dual-System Hot Standby.

         

      2. Click Edit.

      3. Select the Enable check box and configure hot standby as follows:

         

      4. Click OK.

   2. Configure hot standby on FW_B.
      1. Choose System > High Availability > Dual-System Hot Standby.
      2. Click Edit.

      3. Select the Enable check box and configure hot standby as follows:

         

      4. Click OK.

4. Configure NAT address pool port allocation in the load balancing scenario.
   

   In the hot standby load balancing scenario, If NAPT is configured, the FWs may have conflicting public ports. To prevent such conflicts, configure respective NAT resources (including public IP addresses and ports) for the FWs. You can run the hrp nat resource primary-group command on the active FW. The standby FW will automatically generate the hrp nat resource secondary-group command (if you run the hrp nat resource secondary-group command on the active FW, the standby FW will automatically generate the hrp nat resource primary-group command).

   HRP_M[FW_A] hrp nat resource primary-group

5. Configure a security policy on FW_A to allow OSPF packet exchange between FWs and Internet access from the intranet.
   The NAT policy configured on FW_A is automatically backed up to FW_B.

   1. Choose Policy > Security Policy > Security Policy.

   2. Click Add and select Add Security.

      Name	policy1
      Source Zone	local,trust,untrust
      Destination Zone	local,trust,untrust
      Action	Permit

6. Configure a NAT address pool and permit port conversion to reuse public network addresses.

   The NAT address pool configured on FW_A is automatically backed up to FW_B.

   1. Choose Policy > NAT Policy > NAT Policy > Source Translation Address Pool.

      

   2. In Source Translation Address Pool List, click Add and configure a NAT address pool based on the following parameter values.

      

7. Configure a NAT policy to allow intranet users to access the Internet by using post-NAT public IP addresses.

   The NAT policy configured on FW_A is automatically backed up to FW_B.

   1. Choose Policy > NAT Policy > NAT Policy > NAT Policy.

      

   2. In NAT Policy List, click Add and configure a NAT policy based on the following parameter values.

      

8. Configure the downstream devices, so that traffic from department A is forwarded through FW_A, and traffic from department B is forwarded through FW_B.
9. Configure interface addresses, static routes, and OSPF on the upstream and downstream routers. For information about the configurations, see the router product documentation. The configurations are omitted here.