VIP Inbound / Real IP Outbound Issue

[kdawg]

I have an issue where the traffic comes in on the VIP(192.168.1.104)(lan3:1) Address but the system responds with the Real IP(192.168.1.102)(lan3). This is causing the firewall to drop the packets. Is their anyway to force the system to respond with the VIP instead of the Real IP? I'm running Serviceguard.

Snort output:

Request:
07/14-12:32:26.373588 10.0.0.3:53803 -> 192.168.1.104:14100 UDP TTL:43 TOS:0x0 ID:61605 IpLen:20 DgmLen:104

Response:
07/14-12:32:26.374622 192.168.1.102:14100 -> 10.0.0.3:53803 UDP TTL:64 TOS:0x0 ID:3444 IpLen:20 DgmLen:128 DF

Request:
07/14-12:32:27.378448 10.0.0.3:53803 -> 192.168.1.104:14100 UDP TTL:43 TOS:0x0 ID:61606 IpLen:20 DgmLen:104

Response:
07/14-12:32:27.378809 192.168.1.102:14100 -> 10.0.0.3:53803 UDP TTL:64 TOS:0x0 ID:3445 IpLen:20 DgmLen:128 DF

Request:
07/14-12:32:28.388685 10.0.0.3:53803 -> 192.168.1.104:14100 UDP TTL:43 TOS:0x0 ID:61607 IpLen:20 DgmLen:104

Response:
07/14-12:32:28.389114 192.168.1.102:14100 -> 10.0.0.3:53803 UDP TTL:64 TOS:0x0 ID:3446 IpLen:20 DgmLen:128 DF

Thanks in advance.

[RAC_1]

NAT. Before it goes back to firewall.

Anil

[Biswajit Tripathy]

As Anil suggested, NAT is an option.
IPFilter supports NAT on HP-UX. See
ipnat(5) and ipnat(1) manpages for more
details.

- Biswajit

[Florian Heigl (new acc)]

I'd go with NAT so that You can catch / rewrite the pakets directly on the active node AND remove the rule when the packet is switched over.

Use ipf/ipnat on the cluster nodes and load/remove extension rule groups from the startup scripts :>

I'm really glad this topic is coming up more often now, maybe at a point in future will make SG as people would expect. :>

[Jon M Zellhoefer]

You can put the entry for the VIP before the true address in /etc/hosts. You can also force the route manually so that it will reply with the VIP address. I've only seen this in older SG implementations, but the same fix should work for you.