This message was deleted.

Can't see it causing an issue off the top of my head, just make sure that Storefront has an entry for each FQDN in the Gateway config settings. Are you using a wildcard cert or SNI?

WildCard

I'm assuming you're NATting two different addresses because you want to point two different domain names to the same virtual server, is this not the case?

Same VIP and Port? Assign session policies with AAA Groups. If working with various domains use nFactor to present a domain Dropdown menu for the user. If you tell us more about your use case there should be a solution for that ✌🏼

@CTXMike it's not the case....

ok, what's the use case for doing it like this then? two ISPs at one site but no BGP/etc?

One FQDN like abc.domain.com is registered with both Nated IP

technically speaking, if you're NATting at the firewall/router in front of the ADC then you shouldn't have an issue, curious to know why it's setup this way though as it's not common.

Use Case - when one Nated IP goes down traffic should be moved to second NATed IP

right, so two different carriers, two different firewalls, something like that?

Two different carriers, Single Firewall

OK, gotcha. The most important thing for you to do is make sure the firewall is configured to flush the NAT table if one of the carriers goes down, or else anyone with an existing connection on the old (bad) carrier will be unable to connect until its NAT entry expires

To flush the NAT table do we need configure anything spl ?

Unfortunately I can't provide guidance on that, you'll need to confirm with the firewall vendor to make sure that's setup.

Okay thanks

If customers own their IP addressing and are using BGP then their routers will generally handle the failover automatically. If not then I've seen users configure GSLB with two services at the same site (one for each carrier) - if monitors fail for one carrier then GSLB will start handing out the other one. I have also had customers use NAT like you describe which is why I brought up the flushing issue.

Okay...

BGP is the "proper" solution as well. You "can" do this, but you will have problems and it will not be seamless.

Okay