Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 23)

12 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

HA FWLB topology

DRAFT: BROCADE CONFIDENTIAL

HA FWLB topology

For high availability (HA), you can deploy pairs of ServerIron ADXs in active-active configurations on

each side of the firewalls. In an active-active configuration, both ServerIrons in a high-availability

pair actively load balance FWLB traffic. Active-active operation provides redundancy in case a

ServerIron ADX becomes unavailable, while enhancing performance by using both ServerIron ADXs

to process and forward traffic.

HA FWLB on the ServerIron ADX must be in stateful. Each ServerIron ADX sends session

information about its active traffic flows to the other ServerIron ADX. If a failover occurs, the

ServerIron ADX that is still active can provide service for the other ServerIron traffic flows using the

session information provided by the other ServerIron.

In an HA FWLB topology, both ServerIron ADXs actively load balance traffic to the firewalls. If one of

the ServerIron ADXs becomes unavailable, the other ServerIron ADX automatically takes over load

balancing for the sessions that were on the unavailable ServerIron ADX.

Figure 3 shows an example of HA FWLB topology.

FIGURE 3 HA FWLB topology

In this example, clients access the application servers on the private network through one of two

routers, each of which is connected to a ServerIron ADX. The ServerIron ADXs create session

entries for new traffic flows, including assignment of a firewall. The ServerIron ADXs then use the

session entries to forward subsequent traffic in the flow to the same firewall.

External Router

Internal Router

SI-A

SI-C

SI-B

SI-D

Layer 3

Firewall-1

Layer 3

Firewall-2

1 2 ... 18 19 20 21 22 23 24 25 26 27 28 ... 187 188

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 23