Alteon Application Switch Operating System Application Guide
Firewall Load Balancing
Document ID: RDWR-ALOS-V2900_AG1302
669
Just as with the basic method, four-subnet FWLB uses the hash metric to distribute firewall traffic
and maintain persistence, though other load-balancing metrics can be used by configuring an
additional transparent load balancing option (see
).
Four-Subnet FWLB Implementation
In the example in
Figure 111 - Example Four-Subnet FWLB Implementation, page 669
, traffic
between the redundant Alteons is load balanced among the available firewalls:
Figure 111: Example Four-Subnet FWLB Implementation
1. Incoming traffic converges on the primary dirty-side Alteon.
External traffic arrives through redundant routers. A set of interconnected switches ensures that
both routers have a path to each dirty-side Alteon.
VRRP is configured on each dirty-side Alteon so that one acts as the primary routing switch. If
the primary fails, the secondary takes over.
2. FWLB is performed between primary Alteons.
Just as with basic FWLB, filters on the ingress ports of the dirty-side Alteon redirect traffic to a
real server group composed of multiple IP addresses. This configuration splits incoming traffic
into multiple streams. Each stream is then routed toward the primary clean-side Alteon through
a different firewall.
Although other load-balancing metrics can be used in some configurations (see
), the distribution of traffic within each stream is normally based on a
mathematical hash of the IP source and destination addresses. Hashing ensures that each
request and its related responses use the same firewall (a feature known as persistence), and
that the streams are statistically equal in traffic load.
3. The primary clean-side Alteon forwards the traffic to its destination.
After traffic arrives at the primary clean-side Alteon, it is forwarded to its destination. In this
example, Alteon uses regular SLB settings to select a real server on the internal network for
each incoming request.
The same process is used for outbound server responses–a filter on the clean-side Alteon splits
the traffic, and static routes forward each response stream back through the same firewall that
forwarded the original request.
