<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">Yes, i think NAT will be the only option if you think about the self via VIP requesting usecase.<DIV><BR class="khtml-block-placeholder"></DIV><DIV>Org. Packet </DIV><DIV>SIP=RealServer1</DIV><DIV>DIP=VIP</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>SI gests this, and changes to</DIV><DIV>SIP=RealServer1</DIV><DIV>DIP=RealServer1</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>your packet will never be send out the NIC in this case since the destination is a local address.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Nils<BR><DIV><DIV>On Jan 22, 2007, at 8:58 PM, Mike Allen wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV>Yeah, from what you are describing, the problem is not the config. In your case, what is happening is the real servers are responding back to each other directly. To better illustrate, here is a quick packet walkthru. </DIV> <DIV> </DIV> <DIV>Original packet for flow setup</DIV> <DIV>SourceIP (SIP)=RealServer1</DIV> <DIV>DestIP (DIP)=VIP</DIV> <DIV> </DIV> <DIV>SI gets this, and changes to </DIV> <DIV>SIP=RealServer1</DIV> <DIV>DIP=RealServer2</DIV> <DIV> </DIV> <DIV>RealServer2 gets this, and responds appropriately, since its on the same vlan/L2 domain:<BR>SIP=RealServer2</DIV> <DIV>DIP=RealServer1</DIV> <DIV> </DIV> <DIV>If you have a L2 switch path that bypasses the ServerIron, it never sees this packet to do the reverse translation. This in turn gets dropped by RealServer1, since it is expecting a reply from the VIP ip, not RS2. Your options are to use DSR, Source-nat, or attach directly to the SI (or somehow ensure the SI is in both incoming and return path for traffic.) One other option (though a little more complicated) is to use NAT for the real servers. </DIV><SPAN class="sg"> <DIV> </DIV> <DIV>Mike<BR><BR> </DIV></SPAN><BR><BR> <DIV><SPAN class="gmail_quote">On 1/22/07, <B class="gmail_sendername">Ryan DeBerry</B> <<A href="mailto:rdeberry@gmail.com">rdeberry@gmail.com</A>> wrote:</SPAN> <BLOCKQUOTE class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">What is the vlan configuration like? You only have one VE? <DIV><SPAN class="e" id="q_1104b2f4e3c69423_1"><BR><BR> <DIV><SPAN class="gmail_quote">On 1/22/07, <B class="gmail_sendername"><A onclick="return top.js.OpenExtLink(window,event,this)" href="http://news.gmane.org/" target="_blank">news.gmane.org</A></B> <<A onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:matthew.kirkland@uk.clara.net" target="_blank"> matthew.kirkland@uk.clara.net</A>> wrote:</SPAN> <BLOCKQUOTE class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Hello<BR><BR>I am having an issue with a load balancer config whereby the real <BR>servers (smtp servers) cannot access the VIP that they are part of. <BR><BR>The servers are able to ping the VIP but any connections to port 25 are<BR>timed out.<BR><BR>The load balancer is running ip forwarding, with the VIP range and real <BR>server range on the same VE.<BR><BR>Enabling "server source-nat" resolves this , but makes all the <BR>connections on the servers appear to come from the load balancer alone.<BR><BR>I need the real servers to be able to contact the VIP without <BR>translation taking place.<BR><BR>Does anyone know a solution to this problem ? <BR><BR>Thanks<BR>Matthew Kirkland<BR>Claranet Network Engineering<BR><BR>_______________________________________________<BR>foundry-nsp mailing list <BR><A onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:foundry-nsp@puck.nether.net" target="_blank"> foundry-nsp@puck.nether.net</A><BR><A onclick="return top.js.OpenExtLink(window,event,this)" href="http://puck.nether.net/mailman/listinfo/foundry-nsp" target="_blank">http://puck.nether.net/mailman/listinfo/foundry-nsp</A> <BR></BLOCKQUOTE></DIV><BR></SPAN></DIV><BR>_______________________________________________<BR>foundry-nsp mailing list<BR><A onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:foundry-nsp@puck.nether.net"> foundry-nsp@puck.nether.net</A><BR><A onclick="return top.js.OpenExtLink(window,event,this)" href="http://puck.nether.net/mailman/listinfo/foundry-nsp" target="_blank">http://puck.nether.net/mailman/listinfo/foundry-nsp</A> <BR><BR><BR></BLOCKQUOTE></DIV><BR><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">_______________________________________________</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">foundry-nsp mailing list</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://puck.nether.net/mailman/listinfo/foundry-nsp">http://puck.nether.net/mailman/listinfo/foundry-nsp</A></DIV> </BLOCKQUOTE></DIV><BR></DIV></BODY></HTML>