When multiple MIP's point to the same internal host, what IP address is used for new outgoing sessions from the internal host? - 行者无疆的日志

Knowledge Base ID:	KB14320
	2.0
	01 Jun 2009
	01 Jun 2009
	Firewall/IPSec_VPN ScreenOS

Synopsis:

Problem:

Solution:

When Multiple MIPs point to the same internal host, the last MIP added to the MIP table last is used for new outgoing sessions.

Here's an example of this logic:

Topology:

2.2.2.2 (internal host)--------2.2.2.1(Trust interface)---FW---(Untrust interface) eth0/0 MIP (1.1.1.1, 1.1.1.2, 1.1.1.3)

The MIP configuration was as follows:

Map IP Host IP Interface VRouter 1.1.1.1/32 2.2.2.2 ethernet0/0 trust-vr 1.1.1.2/32 2.2.2.2 ethernet0/0 trust-vr 1.1.1.3/32 2.2.2.2 ethernet0/0 trust-vr

Incoming traffic from the Internet was easily reachable to any of the MIP addresses (1.1.1.1, 1.1.1.2, 1.1.1.3).

When the internal host (2.2.2.2) initiated a new session to access the Internet, the NAT'd source IP Address shown in the traffic logs was 1.1.1.3 (the last MIP included in the MIP pool):

Date/Time           Source Address/Port   Dest Address/Port   Translated Source   Translated Dest Address/Port

2009-05-30 08:59:03 2.2.2.2:56352         4.2.2.2:1024        1.1.1.3:56352       4.2.2.2:1024 
2009-05-30 08:59:02 2.2.2.2:56252         4.2.2.2:1024        1.1.1.3:56252       4.2.2.2:1024 
2009-05-30 08:59:01 2.2.2.2:56152         4.2.2.2:1024        1.1.1.3:56152       4.2.2.2:1024

As an experiement, one MIP, 1.1.1.3, was removed from the table:

Map IP Host IP Interface VRouter 1.1.1.1/32 2.2.2.2 ethernet0/0 trust-vr 1.1.1.2/32 2.2.2.2 ethernet0/0 trust-vr <---------- This MIP will be used for outbound traffic as it is last in the table.
Here is the traffic LOG traffic output:

Date/Time           Source Address/Port    Dest Address/Port    Translated Source    Translated Dest Address/Port 

2009-05-30 08:59:30 2.2.2.2:56642          4.2.2.2:1024         1.1.1.2:56642        4.2.2.2:1024 
2009-05-30 08:59:31 2.2.2.2:56542          4.2.2.2:1024         1.1.1.2:56542        4.2.2.2:1024 
2009-05-30 08:59:32 2.2.2.2:56442          4.2.2.2:1024         1.1.1.2:56442        4.2.2.2:1024

Note that when multiple MIPs point to the same internal host, the last MIP added to the MIP table is used for new outgoing sessions.

Purpose:

Troubleshooting