Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 49)

38 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

Understanding ServerIron FWLB

DRAFT: BROCADE CONFIDENTIAL

Session limits

To avoid overloading a firewall, the ServerIron ADX does not forward a packet to a firewall if either of

the following conditions exists:

• The firewall already has the maximum allowed number of open sessions with the ServerIron

ADX. An open session is represented by a session entry. By default, a firewall can have up to

two million session entries on the ServerIron ADX. In a high-availability pair, the firewall can

have up to two million session entries combined on both ServerIron ADXs. You can change the

maximum number of sessions on an individual firewall basis to a number from 1 through

2,000,000.

• The firewall has already received the maximum allowed number of new sessions within the

previous one-second interval. By default, the ServerIron ADX will allow up to two million new

sessions to the same firewall. The maximum includes TCP and UDP sessions combined. You

can change the maximum number of sessions per-second separately for TCP and UDP, to a

value from 1 through 2,000,000.

Session aging

The ServerIron ADX ages out inactive session entries. The aging mechanism differs depending on

whether the session entry is a Layer 3 entry or a Layer 4 entry:

• Layer 3 session entries – The ServerIron ADX uses the sticky age timer to age out Layer 3

session entries. The default sticky age is 5 minutes. You can change the sticky age to a value

from 2 through 60 minutes.

- To change the timer, enter the server sticky-age <num> command at the global CONFIG

level of the CLI.

• Layer 4 session entries – The ServerIron ADX clears a session entry that has TCP ports when

the ServerIron ADX receives a TCP FIN or RESET to end the session. For a TCP session that

ends abnormally, the ServerIron ADX uses the TCP age timer to age out the session. The

ServerIron ADX uses the UDP age timer to age out all UDP sessions. The default TCP age timer

is 30 minutes. The default UDP age timer is 5 minutes. You can configure either timer to a

value from 2 through 60 minutes.

- To change the TCP age timer, enter the server tcp-age <num> command at the global

CONFIG level of the CLI.

- To change the UDP age timer, enter the server udp-age <num> command at the global

CONFIG level of the CLI.

NOTE

Server Load Balancing (SLB) uses the same values for the sticky age, TCP age, and UDP age timers.

If you change a timer, the change applies to both SLB and FWLB.

1 2 ... 44 45 46 47 48 49 50 51 52 53 54 ... 187 188

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 49