Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 124)

ServerIron ADX Firewall Load Balancing Guide 113

53-1002436-01

DRAFT: BROCADE CONFIDENTIAL

Chapter

Configuring FWLB for NAT Firewalls

In this chapter

•NAT firewalls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

•Configuring basic Layer 3 FWLB for NAT firewalls . . . . . . . . . . . . . . . . . . . . 114

•Configuration example for FWLB with Layer 3 NAT firewalls . . . . . . . . . . . 119

•Configuring IronClad Layer 3 FWLB for NAT. . . . . . . . . . . . . . . . . . . . . . . . . 121

•Configuration example for IronClad FWLB with Layer 3 NAT firewalls . . . . 129

NAT firewalls

Some Layer 3 firewalls perform Network Address Translation (NAT). These firewalls translate private

addresses on the private side of the network into public (Internet) addresses on the public side of

the network.

NOTE

The configuration steps for firewalls that perform NAT are identical to the steps for basic and

IronClad FWLB without NAT, with just one additional step. The additional step disables load

balancing for the NAT addresses.

You can deploy ServerIron ADXs to load balance NAT firewalls in a basic configuration or an

IronClad configuration, just as in the examples in the previous chapters. Configuring the ServerIron

ADXs for NAT requires only one additional step. The additional step disables load balancing for the

NAT addresses, which are the addresses the firewalls use when translating private addresses into

Internet addresses.

You can configure a single ServerIron ADX on each side of the firewalls (as in the basic

configuration example in

Figure 18) or you can configure active-standby pairs of ServerIron ADXs

on each side of the firewalls (as in Figure 19).

Firewalls perform NAT in a couple of ways. The ServerIron ADX supports load balancing for either

method and the ServerIron ADX configuration is the same for each method. You do not need to

know which method your firewalls are using to configure the ServerIron ADXs to load balance for

them.

The methods to perform NAT are as follows:

• Hiding internal addresses behind a single public address – The firewall is configured with a

single Internet address that it uses for clients that initiate traffic from within the private side of

the network. The firewall translates the source address for such traffic from the private

address of the client into the public address. The firewall keeps track of the private addresses

by including a Layer 4 port number from a pool of such numbers. When the firewall receives a

return packet from a destination, the firewall uses the port number to identify the correct

private address and translates the packet’s destination address from the public address into

the correct private address.

1 2 ... 119 120 121 122 123 124 125 126 127 128 129 ... 187 188

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 124