<html>
<body>
Looking at the config below I am pretty sure this is not a configuration
problem. I guess it is more a problem of the traffic flow. You have
mentioned that the private address space is 10.4.20.0/24. Clients out of
this subnet want to communicate with the outside world and this is the
traffic you would like to NAT - the traffic needs to pass the SI XL to
get NAT'ed - so what is the default gateway of the clients out of the
10.4.20.x subnet? Is it possible that the traffic is just bypassing the
XL which would imply that it is not going to get NAT'ed?<br><br>
R, Oliver<br><br>
At 21:56 20.03.2008, Gregori Parker wrote:<br>
<blockquote type=cite class=cite cite="">I really need some help here - I
am a Cisco/F5 engineer that has been<br>
thrown into a situation with a pair of Foundry Serveriron XLs, and I<br>
have little to no knowledge or resources for configuring them.<br><br>
I have a test environment that can be simplified to this:<br><br>
[/24 public]----[SI XL Active / NAT]----[/24 private]<br><br>
<br>
Public address space is 10.99.1.0/24, with the Active LB acting as a<br>
default gateway (10.4.20.1)<br><br>
Private address space is 10.4.20.0/24, with cisco 3560s doing HSRP
to<br>
act<br>
as a default gateway (10.99.1.1)<br><br>
I have a test VIP going, and it works fine - but I cant get outgoing
NAT<br>
to work. I want to be able to simply initiate a connection from
private<br>
address space, NAT to a single overloaded address on the LB, and<br>
interact with a 'public' address. Here is my configuration from
the<br>
Active LB, I appreciate any guidance.<br><br>
<br>
Current configuration:<br>
!<br>
ver 07.4.00T12<br>
global-protocol-vlan<br>
!<br>
!<br>
server backup ethe 13 00e0.5201.0c72<br>
server backup-preference 5<br>
server backup-group 1<br>
!<br>
server port 3389<br>
tcp<br>
!<br>
server router-ports 1 2<br>
!<br>
!<br>
server real test01 10.4.20.11<br>
port 3389<br>
!<br>
server virtual vtest01 10.99.1.11<br>
port 3389<br>
bind 3389 test01 3389<br>
!<br>
!<br>
vlan 1 name DEFAULT-VLAN by port<br>
no spanning-tree<br>
!<br>
vlan 2 by port<br>
untagged ethe 13<br>
no spanning-tree<br>
!<br>
vlan 11 by port<br>
untagged ethe 1<br>
router-interface ve 1<br>
!<br>
vlan 12 by port<br>
untagged ethe 2<br>
router-interface ve 2<br>
!<br>
hostname TESTLB01<br>
ip forward<br>
ip address 10.99.1.3 255.255.255.0<br>
ip nat inside<br>
ip nat inside source list 1 pool OutAdds overload<br>
ip nat pool OutAdds 10.99.1.2 10.99.1.2 netmask 255.255.255.0<br>
ip default-gateway 10.99.1.1<br>
ip policy 1 cache tcp 0 global<br>
ip policy 2 cache udp 0 global<br>
interface e 13<br>
no spanning-tree<br>
!<br>
interface ve 1<br>
ip standby-address 10.99.1.2 255.255.255.0<br>
!<br>
interface ve 2<br>
ip standby-address 10.4.20.1 255.255.255.0<br>
!<br>
access-list 1 permit 10.4.20.0 0.0.0.255<br><br>
<br><br>
_______________________________________________<br>
foundry-nsp mailing list<br>
foundry-nsp@puck.nether.net<br>
<a href="http://puck.nether.net/mailman/listinfo/foundry-nsp" eudora="autourl">
http://puck.nether.net/mailman/listinfo/foundry-nsp</a></blockquote>
<x-sigsep><p></x-sigsep>
<font face="Times New Roman, Times" size=2><br>
</font></body>
</html>