Alteon Application Switch Operating System Application Guide
Firewall Load Balancing
678
Document
ID:
RDWR-ALOS-V2900_AG1302
Configure VRRP on the Secondary Clean-Side Alteon
In this example, the secondary Alteon uses primary clean-side Interface 1 as its peer.
Complete Primary Dirty-Side Alteon Configuration
The following is an example configuration for a primary dirty-side Alteon.
To complete the primary dirty-side Alteon configuration
1. Create an FWLB real server group on the primary dirty-side Alteon.
A real server group is used as the target for the FWLB redirection filter. Each IP address that is
assigned to the group represents a path through a different firewall. In this case, since two
firewalls are used, two addresses are added to the group.
Earlier, it was stated that this example uses IF 2 on all Alteons whenever routing through the top
firewall, and IF 3 on all Alteons whenever routing through the lower firewall. Therefore, the first
address represents the primary clean-side IF 2, and the second represents the primary clean-
side IF 3.
Using the hash metric, all traffic between specific IP source/destination address pairs flows
through the same firewall, ensuring that sessions established by the firewalls are maintained for
their duration (persistence).
Note:
Other load balancing metrics, such as leastconns, roundrobin, minmiss, response, and
bandwidth, can be used when enabling the transparent load balancing option. For more
information, see
2. Create the FWLB filters.
Three filters are required on the port attaching to the routers:
—
Filter 10 prevents local traffic from being redirected.
>> # /cfg/l3/vrrp/on
>> # /cfg/slb
>> # on
>> # sync/peer 1
>> # addr 10.10.4.10
>> # ena
>> # apply
>> # save
>> # /cfg/slb
>> # on
>> # real 1
>> # rip 10.10.3.1
>> # ena
>> # /cfg/slb/real 2
>> # rip 10.10.3.2
>> # ena
>> # /cfg/slb/group 1
>> # add 1
>> # add 2
>> # metric hash
