Organizing Policy Servers and EFW Devices
37
Organizing Policy Servers and EFW Devices
You can organize Policy Servers and EFW devices however you want, subject to the
following constraints:
■
No more than three Policy Servers can be in any one EFW domain.
■
The backup Policy Servers specified for a primary Policy Server must be in the same
EFW domain as the primary Policy Server.
■
To ensure better system performance, no more than 1,000 EFW devices should have a
single Policy Server assigned as their primary server.
■
An EFW device must have a UDP connection to its primary and backup Policy Servers.
The following list provides some examples of how you may choose to organize your Policy
Servers and EFW devices:
■
A single Policy Server managing all EFW devices.
This configuration is reasonable for sites with a small number of EFW devices having
highly reliable links to the Policy Server.
■
A single Policy Server acting as the primary Policy Server for all EFW devices,
and another Policy Server acting as the backup Policy Server.
This configuration uses the second Policy Server only as a backup in case of
unavailability of the primary Policy Server.
■
Multiple Policy Servers each serving as the primary for some subset of EFW
devices, with none of the Policy Servers having a backup.
This configuration provides load balancing because the Policy Server duties are spread
across the various Policy Servers.
■
Multiple Policy Servers each serving as the primary Policy Server for some
collection of EFW devices and each also serving as a backup to other Policy Servers.
In addition to load balancing, this configuration provides redundancy to address the
possible unavailability of individual Policy Servers.
You have a great deal of freedom in determining how to distribute EFW devices for load
balancing. For geographically distributed sites, you can co-locate Policy Servers with
associated EFW devices. For example, a site might accept an EFW device having to access
its backup Policy Server via a WAN as long as the primary Policy Server is usually reachable
via a LAN. For sites having a large number of EFW devices at a single geographic location,
EFW also supports simply allowing an administrator to assign EFW devices to Policy
Servers at random to evenly distribute the load across Policy Servers.
You can change the primary Policy Server for an EFW device by viewing the EFW device
and choosing a new Policy Server from the drop-down list in the Policy Server field.
You can split the EFW devices in a device set across several Policy Servers. You can also
configure your system so that EFW devices from many device sets report to the same
primary Policy Server. You can organize EFW devices in these ways because the EFW
system does not require any relationship between how the NICs are organized by the
primary Policy Server and how they are organized into device sets with a particular policy.
