Networks

Ask something
Discussion Locked

NAT & SLP

0 helpful
5 replies

by kesl

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

For reasons too numerous to mention we must maintain a small portion of our large tree behind a NAT firewall. We need to run IP and IXP on these servers, but have the servers perform time, replica and schema sync via IPX only since IP is totally blocked and IPX is totally open through the NAT firewall. When IP is not bound everything works OK. When we bind IP and IPX to servers behind this firewall they run erratic and slow... maybe an IP timeout situation... also when IP is bound we can no longer
open the container in ConsoleOne... the error points to network timeout (it opens fine without IP bound). We would like to know the proper
settings that would allow IP to run on the LAN, but not on the WAN and force NCP and the various syncs to use IPX or at a minimum cause IP to
timeout quicker. Also it would be nice to know what exactly will not work with the configuration. We know that SLP will not work through the NAT. What parts of ZENWorks will and will not work? Will NDPS work in such an
environment? The option is to not bind IP at all but this causes our backup software to fail.

thanx...

5 replies

by duster52

I had the same problem. This is what is happening with IP....When the servers try to communicate they use the IP address(es) that are bound to their NIC(s). A server one side of the NAT will try to talk via IP using the bound IP address of a server on the other side of the NAT. This IP address is unreachable because of the firewall/NAT configuration....So...you lose things like time synch and replica synchronization.

Not sure about NDPS (it really depends on the whether the printers are IP or IPX or both), but you should not lose anything with ZEN.

The only real solution that I see is moving those servers out of the NAT. You can have all of the servers on the same side, and the workstations on the other side....

This discussion is closed to new replies.