Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 129)

118 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

Configuring basic Layer 3 FWLB for NAT firewalls

DRAFT: BROCADE CONFIDENTIAL

Syntax: [no] static-mac-address <mac-addr> ethernet <portnum> [priority <0-7>] [host-type |

router-type]

The priority can be from 0 through 7 (0 is lowest and 7 is highest). The defaults are host-type and 0.

NOTE

The static MAC entries are required. You must add a static MAC entry for each firewall interface with

the ServerIron ADX. In addition, you must use the priority 1 and router-type parameters with the

static-mac-address command. These parameters enable the ServerIron ADX to use the address for

FWLB.

NOTE

If you enter the static-mac-address command at the global CONFIG level, the static MAC entry

applies to the default port-based VLAN (VLAN 1). If you enter the static-mac-address command at

the configuration level for a specific port-based VLAN, the entry applies to that VLAN and not to the

default VLAN.

Preventing load balancing of the NAT addresses

When you configure ServerIron ADXs for load balancing traffic across NAT firewalls, you must

disable load balancing on the NAT addresses themselves. You can use either of the following

methods to do so. Each method is equally valid and only one of the methods is required. You need

to use one of these methods only on the ServerIron ADX connected to the external network, not the

ServerIron ADX on the internal side of the network.

The methods for preventing load balancing of the NAT addresses are as follows:

• Configure the NAT addresses as firewall addresses, but do not configure paths for the

addresses. (This is shown in the "Extra Firewall Method" section.)

• Configure IP access policies (filters) to deny load balancing for traffic addressed to the NAT

addresses. (This is shown in the "Access Policy Method" section.)

NOTE

In FWLB configurations, the IP policies do not block traffic altogether. They deny load balancing

for the traffic. Thus, the ServerIron ADX does not load balance packets addressed to the NAT

addresses, but instead sends the traffic only to the firewall that originally sent the traffic.

Extra firewall method

To disable load balancing for the NAT addresses by adding firewalls for the addresses, enter

commands such as the following.

NOTE

Do not configure paths for the firewalls.

ServerIronADX-A(config)# server fw-name fw3NAT 209.157.23.107

ServerIronADX-A(config-rs-fw3NAT)# exit

ServerIronADX-A(config)# server fw-name fw4NAT 209.157.23.110

ServerIronADX-A(config-rs-fw4NAT)# exit

1 2 ... 124 125 126 127 128 129 130 131 132 133 134 ... 187 188

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 129