Forum Discussion

syedimam_147051's avatar
syedimam_147051
Icon for Nimbostratus rankNimbostratus
Dec 11, 2014

Multi-tenant environment: Multiple external vlan and one internal VLAN

Hi I want to build a multi-tenant web hosting environment. To make things simple, I want to keep multiple external vlans (single vlan and /24/customer) and one internal vlan only. The servers are situated behind another internal firewall zones. I would like to keep one interface of internal firewall connecting logically to my LB on internal vlan and ingress interface with servers with sub interfaces configured. The SNAT pool can be automaped or we can use SNAT pool of internal vlan subnet range. The pool members for each customer belongs to separate /24. Ther question is if it is possible to have traffic from multiple external vlans and going to single internal vlan for both forward and reverse traffic from servers. Below is the sample configuration for one customer. For every other customer, we have separate external subnet and separate pool members subnet.

 

Customer will type www.abc.com on their browser ABC.com (Registered to public IP/DNS) (157.1.1.1)

 

Perimeter Firewall: Interface facing external public IP ? Interface facing to internal network 10.10.10.1

 

Will hit on perimeter firewall and get translated to 10.10.10.10 (VIP for abc.com). Firewall will forward traffic to internal interface facing LB.

 

LB LB external interface 10.10.10.254 VIP (abc.com) 10.10.10.10 (Tagged interface to carry multiple external vlans each for one customer) Internal Interface 192.168.1.254 (This interface can be built as untagged interface and switch port will be access port) Pool Members (Cust web servers): (2.2.2.10-2.2.2.13)

 

A static route to be added to reach network 2.2.2.0/24 via 192.168.1.1 SNAT automap can be used which will vary interface address .254 but it is restricted to 65000 sessions. We can reserve 10 IPs from 192.168.1.0/24 network to use as SNAT Pool by monitoring total number of sessions.

 

Internal Firewall

 

interface facing LB 192.168.1.1 Interface facing servers 2.2.2.1

 

Servers to have static route to reach 192.168.1.0/24 network via 2.2.2.1

 

application delivery
design
LTM
snat
vlan

3 Replies

Sort By
  • wesleyjack's avatar
    wesleyjack
    Icon for Nimbostratus rankNimbostratus
    Dec 16, 2014

    Hello syediman,

     

    "The[ir] question is if it is possible to have traffic from multiple external vlans and going to single internal vlan for both forward and reverse traffic from servers."

     

    We have several data centers with F5s operating in a similar fashion. Multiple external VLANs to multiple internal VLANs (however one VLAN in specific is most used). We use SNAT pools, but since you only have one Internal automap should be okay. No issue with carrying multiple VLANs, we actually carry both external and internal on the same trunk. (F5-on-a-stick) Static route to get to 2.2.2.0/24 is a must.