Weak End System model and Multi-Homed servers

[Dave Franks]

Looking for some guidance on a particular situation:

Currently I have two dedicated Windows 2000 IIS 5.0 servers. They are
multihomed with two IP addresses on one NIC card each. Each server is a
clone of the other, except for IP addresses (obviously). Each IP address is
assigned to a separate web site. Assume web "A" is on the first listed IP
address "IP1", and web "B" is on the second IP address "IP2". The first and
second IP's are as viewed within the advanced TCP/IP setting of the protocol
properties window. DNS has an entry for "IP1", but not "IP2" for both these
boxes. Host headers are not being used. The server is accessed by a hardware
load balancer which maps to the appropriate real servers. We'll name these
VIP's "V1" and "V2" respectively. These VIP's are in DNS. The server will
talk directly to the client after the client traverses the load balancer.


|--> Server 1 --> IP1 --> Web "A"
VIP V1 ---> |
|--> Server 2 --> IP1 --> Web "A"


|--> Server 1 --> IP2 --> Web "B" \
VIP V2 ---> | |-->
Remote web services call
|--> Server 2 --> IP2 --> Web "B" /


My question is; When a client talks to VIP "V2", Web "B" and in turn V2/B
makes a call to an external web service (different subnet), what source IP
address is the remote web services box seeing? I assume since there is only
one MAC address on the NIC card and if I'm correct, windows binds the first
IP address it finds to this NIC/MAC. In this case then would the V2/B server
be sending as "IP1" to the destination web services box?

Is IIS smart enough to use it's own IP address as the source, or is it just
putting it on the stack and letting it (the stack) decide who is sending it?

Any clarification would be appreciated.

Thanks...

DF

 

[Sam Norris]

I'm wondering this also ... if an IIS site is bound to a specific IP
why does it choose to send packets back out to the client with a
different source IP ?

Sam

 

[Dave Franks]

It does in fact use the "Primary/First" IP address "IP1" as the source
address when calling the remote machine. After checking some logs it was
very clear.

My concern is if you stick a firewall between the two (IIS and remote Web
Services), what IP address would you need to allow to pass through. In the
past I would have used both (actually all four in this case) and now it
seems that it has been overkill and has unneeded security exposure now.

DF