Alteon Application Switch Operating System Application Guide
Firewall Load Balancing
660
Document
ID:
RDWR-ALOS-V2900_AG1302
On the dirty-side Alteon, one static route is needed for each traffic stream. For instance, the first
static route leads to an IP interface on the clean-side Alteon using the first firewall as the next
hop. A second static route leads to a second clean-side IP interface using the second firewall as
the next hop, and so on. By combining the redirection filter and static routes, traffic is load
balanced among all active firewalls.
All traffic between specific IP source/destination address pairs flows through the same firewall,
ensuring that sessions established by the firewalls persist for their duration.
Note:
More than one stream can be routed though a particular firewall. You can weight the
load to favor one firewall by increasing the number of static routes that traverse it.
4. The firewalls determine if they should allow the packets and, if so, forward them to a virtual
server on the clean-side Alteon.
Client requests are forwarded or discarded according to rules configured for each firewall.
Note:
Rule sets must be consistent across all firewalls.
5. The clean-side Alteon performs normal SLB functions.
Packets forwarded from the firewalls are sent to the original destination address, that is, the
virtual server on the clean-side Alteon. There, they are load balanced to the real servers using
standard SLB configuration.
6. The real server responds to the client request.
7. Redirection filters on the clean-side Alteon balance responses among different IP addresses.
Redirection filters are needed on all ports on the clean-side Alteon that attach to real servers or
internal clients on the clean-side of the network. Filters on these ports redirect the Internet-
bound traffic to a real server group that consists of a number of different IP addresses. Each IP
address represents an IP interface on a different subnet on the dirty-side Alteon.
8. Outbound traffic is routed to the firewalls.
Static routes are configured on the clean-side Alteon. One static route is needed for each stream
that was configured on the dirty-side Alteon. For instance, the first static route is configured to
lead to the first dirty-side IP interface using the first firewall as the next hop. The second static
route leads to the second dirty-side IP interface using the second firewall as the next hop, and
so on.
Since Alteon intelligently maintains state information, all traffic between specific IP source or
destination addresses flows through the same firewall, maintaining session persistence.
Note:
If Network Address Translation (NAT) software is used on the firewalls, FWLB session
persistence requires transparent load balancing to be enabled (see
).
9. The firewall determines if it should allow the packet and, if so, forwards it to the dirty-side
Alteon.
Each firewall forwards or discards the server responses according to the rules that are
configured for it. Forwarded packets are sent to the dirty-side Alteon and out to the Internet.
10. The client receives the server response.
