Enable Server Pool load balancing using Access rules

NAT rules are the preferred way to enable Server Pool load balancing. For backward compatibility, it is still possible to enable Server Pool load balancing using Access rules.

When you use a Server Pool element in the Destination cell of an Access rule, the rule enables Server Pool load balancing and specifies which traffic is directed to the Server Pool. When the rule matches traffic, the Server Pool uses NAT to change the destination IP address to the IP address of the server that the firewall selects for the connection. Reverse NAT (for the replies the server sends back to the client) is handled automatically. No separate NAT rule is required.

If you use Access rules to enable Server Pool load balancing, note the following:
  • The Server Pool does automatic NAT from the external addresses you configured in the Server Pool element to the addresses of the included servers. Make sure that there are no overlapping NAT rules in the policy. You can add a NAT rule that disables further NAT for matching connections (empty NAT cell), if necessary.
  • If you want to balance traffic that arrives through a VPN using a Server Pool, NAT must be enabled in the properties of the VPN element (NAT is disabled by default for traffic that uses a VPN).
  • You must create a separate rule for each Server Pool.
  • If the same Server Pool provides more than one service, you must create a separate rule for each Service.
  • You must enable Connection Tracking for the rule that directs traffic to the Server Pool. The Server Pool uses NAT, which does not work without Connection Tracking.

For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Open the Firewall Policy for editing and add an IPv4 or IPv6 Access rule.
    Note: If the Server Pool uses both IPv4 and IPv6 addresses, you must create separate IPv4 and IPv6 Access rules.
  2. Configure the rule to match the Source, Destination, and Service of the traffic that you want to direct to the Server Pool.
    Note: Each rule must contain only one Service.
  3. Set the Action to Allow.
  4. In the Action Options, enable Connection Tracking.
    The following example rules direct traffic from external networks to the HTTP Server Pool and to the HTTPS Server Pool.
    Source Destination Service Action
    Not Internal network Expression HTTP Server Pool HTTP Allow Connection tracking: normal
    Not Internal network Expression HTTPS Server Pool HTTPS Allow Connection tracking: normal
  5. If you are using static DNS entries, save and Install the Firewall Policy to transfer the changes.

Next steps

If you want the NGFW Engine to automatically update dynamic DNS (DDNS) entries for the Server Pool according to the available NetLinks, configure DDNS updates.