Forum Discussion

sachin_80710's avatar
sachin_80710
Icon for Nimbostratus rankNimbostratus
Jan 21, 2015

GTM behind firewall

Hi, Trying to understand how wide ip pool/pool member health monitor works, when GTM is behind firewall. we dont have LTM, GTM is directly checking the application server(generic host). We have created generic server object and under that we have created virtual server with public and private ip. In this scenario health check is done on private or public ip? Thanks, Sachin

 

5 Replies

  • To add more details, on firewall we have not allowed any outbound communication to application public ip. But still we see wide ip up.
  • Also i checked status of wide ip pool member, it show message 'offline Monitor /Common/tcp from public-IP-address state:timeout Public-IP-address mentioned in message is public ip of link configured in firewall. This public ip is natted to private ip of GTM listener

     

  • Hi sachin,

     

    How many servers do you have total, that are serving identical content. If you only have one server, you would probably be better served by an old-fashioned A record in Zonerunner. When you say "This public ip is natted to private ip of GTM listener", are you referring to the GTM's UDP listener on a GTM self IP?

     

  • Is it something like this:

     

    server_A 10.10.10.10 NAT ISP 1 > 111.111.111.111

     

    server_A 10.10.10.10 NAT ISP 2 > 222.222.222.222

     

    WIP myserver@mycorp.com

     

    pool members = 111.111.111.111, 222.222.222.222

     

    GTM self-IP (UDP listener) 10.10.10.20 NAT > 111.111.111.123 dns@mycorp.com

     

  • Hi Sachin,

     

    when specifying a server object in GTM (as you did for your generic host type servers) you have the option to define a NAT address. This will be the external address and GTM will respond with the external and routable IP address upon incoming DNS requests matching a Wide IP definition.

     

    Same definition has to be done for GTM as a server, especially if you plan to build a sync group with multiple GTM controllers in different datacenters.

     

    Based on the data center assignments GTM and other server objects may belong to the same data center and in this case GTM can check the virtual services on the "local" servers directly.

     

    Thanks, Stephan