Network Load Balancing Server

[Kriminal]

Hi to all,
I would like to create a NLB on Checkpoint 80.30 for Microsoft Exchange.
I've created a logical servers (one public ip and three MS exchange servers), it works like a charm if policy triggered (different network), but on the same subnet it doesn't work.
Any idea?
Thank you.

[Bob_Zimmerman]

I doubt the firewall would do automatic proxy ARP for the virtual server. You could try adding a proxy ARP statement or using a VIP which isn't on any real network you use.

[EricAnderson]

I agree with Zimmie. If your client is coming from the same subnet as the servers, but trying to hit the public IP, you're likely creating a hairpin situation that could confuse things a bit.

Maybe create a second Logical Server using a Private IP instead, and have internal clients hit that?

You could also try creating the Logical Server using a Private IP and then creating a manual static NAT?

If we're missing something, please clarify/expand on your original post.

-E

[Kriminal]

First of all, thanks for your replies.
The client and the server are on different network, no problem with it.
I try to explain:
Client on eth1 (10.10.10.X)
NLB on eth2 (200.200.200.X/24)
Some server that needs to comunicate with exchange on eth2 (200.200.200.X/24)
Exchange server on eth2 (200.200.200.X/24)
All works correctly except with the servers on eth2, because this server open a session to NLB but receive the answer directly form exchange server bypassing the firewall.
I moved the Exchange Servers on eth3 (50.50.50.X/24) and using the "NAT hide" behind the ip of the NLB, seems working correctly.
Thank you.

[EricAnderson]

That makes perfect sense. If the server is on the same subnet, Exchange servers will reply directly. You could work around this by NATing the traffic, making the Exchange servers think it's coming from eth2 itself, but I can't imagine what the benefit would be, other than forcing the traffic through the GW.

If your goal is to inspect that traffic, then putting Exchange on a separate network is the proper way to go anyway.

-E