Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 59)

48 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

Configuring HA active-active FWLB

DRAFT: BROCADE CONFIDENTIAL

Hashing load balance metric in FWLB

You configure the fw-predictor hash command under the firewall group. When this command is

configured, firewall selection is based on hashing of IP addresses (and ports optionally). The

packet will be dropped if hashing picks a firewall and if either of the following is true:

• The maximum number of sessions (max-conn command) is reached for that firewall.

• The connection rate is exceeded for the firewall or the firewall port.

The connection rate can be specified at the firewall level or a firewall port level.

To configure the hashing features, enter the following commands.

SLB-SI-A(config)# server fw-group 2

SLB-SI-A(config-fw-2)# fw-predictor hash

Syntax: fw-predictor hash

Enabling the active-active mode

To enable the FWLB active-active mode, enter a command such as the following at the firewall

group configuration level.

ServerIronADX(config-fw-2)# sym-priority 1

Syntax: [no] sym-priority <num>

The sym-priority command enables the active-active mode.

The <num> variable specifies a priority value from 1 through 255. While a value must be used, it

does not affect operation of the ServerIron ADX.

Using the value of “0” for the <num> variable is a special case. If you specify “0”, the CLI removes

the priority. When you save the configuration to the startup-config file, the sym-priority command is

removed. You cannot remove the priority using the no sym-priority command.

This command is also used for Symmetric Server Load Balancing (SSLB) where the value of the

<num> variable is significant. For more information about SSLB see the “Symmetric SLB” section

of the “High Availability” chapter in the ServerIron ADX Server Load Balancing Guide.

Configuring the paths and static MAC address entries

The paths go from one ServerIron ADX to the other ServerIron ADXs on the other side of each

firewall. A path also goes to the router.

A path consists of the following parameters:

• The path ID – A number that identifies the path. The paths go from one ServerIron ADX to the

other through the firewalls. A path also goes to the router. On each ServerIron ADX, the

sequence of path IDs must be contiguous (with no gaps), starting with path ID 1. For example,

path sequence 1, 2, 3, 4, 5 is valid. Path sequence 1, 3, 5 or 5, 4, 3, 2, 1 is not valid.

• The ServerIron ADX port – The number of the port that connects the ServerIron ADX to the

firewall. If your configuration does not require static MAC entries, you can specify a dynamic

port (65535) instead of the physical port number for firewall paths. Specifying the dynamic

port allows the ServerIron ADX to select the physical port for the path so you do not need to do

so. You cannot specify the dynamic port for router paths. Router paths require the physical

port number.

1 2 ... 54 55 56 57 58 59 60 61 62 63 64 ... 187 188

Comments to this Manuals

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 59

Comments to this Manuals

Related products and manuals for Network switches Brocade Communications Systems ServerIron ADX 12.4.00