topic Re: SmartZone with NAT IP (without internal IP- in SmartZone and Virtual SmartZone

SmartZone with NAT IP (without internal IP-

lienmonden — Wed, 24 May 2023 09:01:00 GMT

Hi Pack,

We have a local SmartZone (vSZ-H) that we host for our end customers. We use a control NAT IP for the end customers, so they can connect to our SmartZone. Once their AP's are connected, they also receive our internal IP as well on the AP/switch ("get scg ip" shows the internal IP and the NAT IP).

Is it possible to hide the internal IP? So when the AP/switch is connected, they don't receive the internal IP - only the NAT IP which they use to make their connection.

thanks!

Re: SmartZone with NAT IP (without internal IP-

sanjay_kumar — Thu, 25 May 2023 05:14:20 GMT

Hi @lienmonden

Could you please confirm the vSZ version running? Also is the vSZ deployed on Cloud platform like AWS?

We had a similar issue in the past where the ICX was receiving the private IP of the controller and has been fixed so that the ICX can only get the Public IP of the controller.
Please confirm the above information so that I can confirm the fix.

Re: SmartZone with NAT IP (without internal IP-

lienmonden — Thu, 25 May 2023 07:42:56 GMT

Version = 6.1.1.0.959

vSZ is deployed in VMWare (ESXi), so no Cloud platform

Re: SmartZone with NAT IP (without internal IP-

abilashpr — Sat, 03 Jun 2023 11:30:09 GMT

Hi @lienmonden ,

You would get the internal IP displayed in the output of "get scg" command, if you don't want that to be seen, the other way is configuring the NAT on the firewall instead vSZ, provided you allow all the ports that needs to be open for AP/Switch/vSZ communication on the firewall.

May the Force be with You!!!

Abilash PR

Re: SmartZone with NAT IP (without internal IP-

lienmonden — Thu, 15 Jun 2023 06:25:15 GMT

Hi Abilash,

We use NAT on the firewall like you say + NAT IP is configured on the SmartZone. Can we remove the NAT IP setting on the SmartZone?

Thanks!

Re: SmartZone with NAT IP (without internal IP-

Kiran_Raval — Thu, 15 Jun 2023 07:38:40 GMT

Hi @lienmonden

Since controller is behind NAT, we have to configure Control NAT IP. Please get output of "show interface" from the controller CLI and "get scg" from AP CLI.

Re: SmartZone with NAT IP (without internal IP-

abilashpr — Thu, 15 Jun 2023 22:19:30 GMT

Hi @lienmonden ,

There are two ways of deploying this, Lets assume you have Site A and Site B.

Type 1.

Run Site to Site VPN between the two Sites and NAT internal IP of SZ's and AP's so that their subnets are reachable across the Sites, Firewall Rules has to be configured accordingly.

Type - 2

1. Nat SZ/vSZ Internal IP on the Site 'A' Firewall's Public IP so that it could be reached on the Internet, you have to open ports for AP-Controller communication mentioned in Admin Guide.

2. Now, you should be able to access vSZ using the Public IP A.A.A.A, on the Site 'B' Firewall you have to open ports for AP-Controller Communication mentioned in Admin Guide.

3. For this to work seamlessly you should configure rules on both Site's Firewall so that there are no reachability issues.

In both these methods you don't have to configure NAT IP on the SZ/VSZ. If you have AP's deployed in the same site as vSZ/SZ you have to direct the AP to reach SZ/VSZ internal IP.

When Onboarding each site you have to configure rules on both Firewall's so there aren't any connectivity issues between each site.

There is lot of work that needs to be done on the firewall, just to hide your vSZ's internal IP on the AP and you should watch the latency too so that AP's don't lose any heart beats.

In your setup please check the connectivity of the vSZ from remote site by removing the NAT IP on the vSZ, if you don't set correct configurations on the firewall you may have connectivity issues.

I currently use Type 1 as I have few APs (less than 100) on the remote Sites.

Hope it helps!!!

May the One Force be with You!!!

Regards,
Abilash