Using NAT Load Balancing

Topics:

•	Prerequisites

•	Configuring NAT Load Balancing

•	Troubleshooting NAT Load Balancing

Prerequisites

The examples shown in the Tasklist section on the next few pages utilize IP addressing information from a demo setup – please make sure and replace any IP addressing information shown in the examples with the correct addressing information for your setup. Also note that the interface names may be different.

NOTE: It is strongly advised that you enable logging for all categories, and enable name resolution for logging.

To enable logging and alerting, log into the firewall’s Management GUI, go to Log > Categories, choose Debug from the drop-down next to Logging Level, chose All Categories from the drop-down next to View Style, check the boxes in the title bar next to Log and Alerts to capture all categories, and click on the Apply button in the upper right hand corner to save and activate the changes. For an example, see the screenshot below. Debug logs should only be used for initial configuration and troubleshooting, and it is advised that once setup is complete, you set the logging level to a more appropriate level for your network environment.

To enable log name resolution:

1	Go to Log > Name Resolution.

2	Choose DNS then NetBIOS from the Name Resolution Method drop-down menu.

3	Click the Accept button in the upper left hand corner to save and activate the changes.

Configuring NAT Load Balancing

To configure NAT load balancing, you must complete the following tasks:

1	Create address objects.

2	Create address group.

3	Create inbound NAT LB Policy.

4	Create outbound NAT LB Policy.

5	Create Firewall Rule.

6	Verify and troubleshoot the network if necessary.

To complete this configuration, perform the following steps:

1	Create Network Objects:

a	Go to the Network > Address Objects page.

b	Create the network objects for both of the internal Web servers and the Virtual IP (VIP) on which external users will access the servers.

2	Create an Address Group:

a	Click on the Address Groups tab.

b	Create an address group named www_group.

c	Add the two internal server address objects you just created.

3	Create an Inbound NAT Rule for www_group:

a	Create a NAT rule to allow anyone attempting to access the VIP to get translated to the address group you just created, using Sticky IP as the NAT method.

NOTE: Do not save the NAT rule just yet.

4	Set LB Type and Server Liveliness Method.

a

On the Advanced tab of the NAT policy configuration control, you can specify that the object (or group of objects, or group of groups) be monitored via ICMP ping or by checking for TCP sockets opened. For this example, we are going to check to see if the server is up and responding by monitoring TCP port 80 (which is good, as that is what people are trying to access).

b	Click the Add button to save and activate the changes.

NOTE: Before you go any further, check the logs and the status page to see if the resources have been detected and have been logged as online. Two alerts will appear as Firewall Events with the message Network Monitor: Host 192.160.200.220 is online (with your IP addresses). If you do not see these two messages, check the steps above.

c	Click the Close button.

5	Create Outbound NAT Rule for LB Group.

a	Create a NAT rule to allow the internal servers to get translated to the VIP when accessing resources out the WAN interface (by default, the X1 interface).

6	Create Firewall Rule for VIP.

a	Create a firewall rule to allow traffic from the outside to access the internal Web servers via the VIP.

7	Test Your Work.

a	From a laptop outside the WAN, connect via HTTP to the VIP using a Web browser.

NOTE: If you wish to load balance one or more SonicWALL SRA Appliances, repeat Step 1 through Step 7, using HTTPS instead as the allowed service.

Troubleshooting NAT Load Balancing

If the Web servers do not seem to be accessible, go to the Firewall > Access Rules page and mouseover the Statistics icon.

If the rule is configured incorrectly you will not see any Rx or TX Bytes; if it is working, you will see these increment with each successful external access of the load balanced resources.

You can also check the Firewall > NAT Policies page and mouseover the Statistics icon. If the policy is configured incorrectly you will not see any Rx or TX Bytes; if it is working, you will see these increment with each successful external access of the load balanced resources.

Finally, check the logs and the status page to see if there are any alerts (noted in yellow) about the Network Monitor noting hosts that are offline; it may be that all of your load balancing resources are not reachable by the firewall and that the probing mechanism has marked them offline and out of service. Check the load balancing resources to ensure that they are functional and check the networking connections between them and the firewall.