Radware Alteon, Application Manual

Page: 659 / 842

Alteon Application Switch Operating System Application Guide
Firewall Load Balancing
Document ID: RDWR-ALOS-V2900_AG1302
659
A redirection filter on the dirty-side Alteon splits incoming client traffic into multiple streams. Each
stream is routed through a different firewall. The same process is used for outbound server
responses. A redirection filter on the clean-side Alteon splits the traffic, and static routes forward
each stream through a different firewall and then back to the client.
Although other metrics can be used in some configurations (see
Free-Metric FWLB, page 683 ), the
distribution of traffic within each stream is normally based on a mathematical hash of the source IP
address and destination IP addresses. This ensures that each client request and its related
responses will use the same firewall (a feature known as persistence) and that the traffic is equally
distributed. Persistence is required for the firewall as it maintains state and processes traffic in both
directions for a connection.
Although basic FWLB techniques can support more firewalls as well as multiple devices on the clean
and dirty sides for redundancy, the configuration complexity increases dramatically. The four-subnet
FWLB solution is usually preferred in larger scale, high-availability topologies (see
Four-Subnet
FWLB, page 668 ).
Basic FWLB Implementation
As shown in Figure 108 - Basic FWLB Process, page 659 , traffic is load balanced among the
available firewalls:
Figure 108: Basic FWLB Process
1. The client requests data.
The external clients are configured to connect to services at the publicly advertised IP address
assigned to a virtual server on the clean-side Alteon.
2. A redirection filter balances incoming requests among different IP addresses.
When the client request arrives at the dirty-side Alteon, a filter redirects it to a real server group
that consists of a number of different IP addresses. This redirection filter splits the traffic into
balanced streams: one for each IP address in the real server group. For FWLB, each IP address
in the real server group represents an IP Interface (IF) on a different subnet on the clean-side
Alteon.
3. Requests are routed to the firewalls.