|
Posted by Joutsen on December 18, 2006, 2:24 pm
If you were Registered and logged in, you could reply and use other advanced thread options
I'm hoping someone can help me with this one.
I have a Fortigate 300 with Internal, External and DMZ/HA ports.
I have 2 servers connected with each other in a Microsoft Cluster
Services (MSCS) cluster in the Internal subnet. There are also a number
of other non-clustered servers in the subnet.
There are web servers in the DMZ/HA subnet.
When the firewall is configured to allow this (for testing), External
traffic can connect successfully to the clustered servers in the
Internal subnet. Internal traffic can also connect to these 2 servers.
The problem is that DMZ/HA source traffic cannot connect to the
clustered server, even if all DMZ traffic is allowed to connect to
Internal. The web servers in DMZ can connect successfully to all other
servers in Internal, but still cannot connect to the MSCS cluster.
Machines in the DMZ cannot connect (or even ping) the cluster virtual
IP addresses, or the nodes' individual IP addresses.
For temporary testing, the fortigate is configured to not restrict any
access between Internal, DMZ and External.
When we had a Fortigate 100A, this was not a problem; everything worked
fine.
Does anyone know if there are problems with the Fortigate 300 not
allowing any connections between DMZ/HA and Internal when connecting to
Windows clustered servers? The Fortigate firmware is at: Fortigate-300
2.80,build489,051027
Thanks.
Joutsen
| 
XML site map