NAT 1:1 configuration in HA-CARP mode

[empbilly]

Hello,

The 1:1 NAT configurations we had stopped working when we configured our 2 appliances in HA-CARP.

What does 1:1 NAT configuration work like in HA mode?

[viragomann]

@empbilly
I cannot think of any issue with this in the context of HA, as long as the external IP is the CARP VIP or or another virtual IP hooking up on the CARP VIP.

What exactly is your problem and how did you configure the NAT 1:1?

[empbilly]

@viragomann said in NAT 1:1 configuration in HA-CARP mode:

What exactly is your problem and how did you configure the NAT 1:1?

It was configured that way.

In the “interface” option, should I put the CARP VIP public IP?

[viragomann]

@empbilly
In the alias settings at Interface open the drop-down and select the CARP VIP.

[empbilly]

@viragomann said in NAT 1:1 configuration in HA-CARP mode:

In the alias settings at Interface open the drop-down and select the CARP VIP.

I had already done this some time ago. When I set it up this way, the VIP CARP in pfbackup is set to MASTER.

[SteveITS]

@empbilly For your IP alias I think /32 is wrong:

[viragomann]

@empbilly said in NAT 1:1 configuration in HA-CARP mode:

@viragomann said in NAT 1:1 configuration in HA-CARP mode:

In the alias settings at Interface open the drop-down and select the CARP VIP.

I had already done this some time ago. When I set it up this way, the VIP CARP in pfbackup is set to MASTER.

So there is something wrong with this IP or the CARP VIP, which you should troubleshoot.
Check the logs for hints.

Hooking up the IP alias on the CARP VIP is necessary for proper failover. If you just set it on the interface it can never failover to the secondary.

[empbilly]

@SteveITS said in NAT 1:1 configuration in HA-CARP mode:

For your IP alias I think /32 is wrong:

@viragomann said in NAT 1:1 configuration in HA-CARP mode:

So there is something wrong with this IP or the CARP VIP, which you should troubleshoot.
Check the logs for hints.

Hooking up the IP alias on the CARP VIP is necessary for proper failover. If you just set it on the interface it can never failover to the secondary.

Thank you both for your help!!!

I've set up a new carp just for this type of 1:1 NAT situation and I'm doing a port forward.