Alteon Application Switch Operating System Application Guide
Firewall Load Balancing
658
Document
ID:
RDWR-ALOS-V2900_AG1302
One network interface card on the firewall is connected to the public side of the network, often to an
Internet router. This is known as the dirty, or untrusted, side of the firewall. Another network
interface card on the firewall is connected to the side of the network with the resources that must be
protected. This is known as the clean, or trusted, side of the firewall.
In the example in
Figure 106 - Firewall Configuration with FWLB, page 657
, all traffic passing
between the dirty, clean, and demilitarized zone (DMZ) networks must traverse the firewall, which
examines each individual packet. The firewall is configured with a detailed set of rules that
determine which types of traffic are allowed and which types are denied. Heavy traffic can turn the
firewall into a serious bottleneck. The firewall is also a single point-of-failure device. If it goes out of
service, external clients can no longer reach your services and internal clients can no longer reach
the Internet.
Sometimes a DMZ is attached to the firewall or between the Internet and the firewall. Typically, a
DMZ contains its own servers that provide dirty-side clients with access to services, making it
unnecessary for dirty-side traffic to use clean-side resources.
FWLB provides a variety of options that enhance firewall performance and resolve typical firewall
problems. Alteon supports the following FWLB methods:
•
Basic FWLB for simple networks—This method uses a combination of static routes and
redirection filters and is usually employed in smaller networks.
An Alteon filter on the dirty-side splits incoming traffic into streams headed for different
firewalls. To ensure persistence of session traffic through the same firewall, distribution is based
on a mathematical hash of the IP source and destination addresses. For more information, see
•
Four-Subnet FWLB for larger networks—Although similar to basic FWLB, the four-subnet
method is more often deployed in larger networks that require high-availability solutions. This
method adds Virtual Router Redundancy Protocol (VRRP) to the configuration.
Just as with the basic method, four-subnet FWLB uses the hash metric to distribute firewall
traffic and maintain persistence. For more information, see
.
Basic FWLB
The basic FWLB method uses a combination of static routes and redirection filters to allow multiple
active firewalls to operate in parallel.
Figure 107 - Basic FWLB Topology, page 658
illustrates a basic
FWLB topology:
Figure 107: Basic FWLB Topology
The firewalls being load balanced are in the middle of the network, separating the dirty side from the
clean side. This configuration requires a minimum of two Alteons: one on the dirty side of the
firewalls and one on the clean side.
Содержание Alteon
Страница 2: ...Alteon Application Switch Operating System Application Guide 2 Document ID RDWR ALOS V2900_AG1302 ...
Страница 42: ...Alteon Application Switch Operating System Application Guide Preface 42 Document ID RDWR ALOS V2900_AG1302 ...
Страница 582: ...Alteon Application Switch Operating System Application Guide High Availability 582 Document ID RDWR ALOS V2900_AG1302 ...
