Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 141)

130 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

Configuration example for IronClad FWLB with Layer 3 NAT firewalls

DRAFT: BROCADE CONFIDENTIAL

The server fw-port command identifies the port that connects this ServerIron ADX to its partner. If

you configure a trunk group for the link between the two partners, specify the first port (the primary

port for the group) in the trunk group.

SI-ActiveA(config)# server fw-port 5

The server fw-name commands add the firewalls to the ServerIron ADX. In the commands above,

“fw1” and “fw2” are the firewall names. These names are specific to the ServerIron ADX and do not

need to correspond to any name parameters on the firewalls themselves. The IP addresses are the

addresses of the firewall interfaces with the ServerIron ADX.

SI-ActiveA(config)# server fw-name fw1 192.168.1.2

SI-ActiveA(config-rs-fw1)# exit

SI-ActiveA(config)# server fw-name fw2 192.168.1.3

SI-ActiveA(config-rs-fw2)# exit

The following commands add firewall entries for the hidden NAT addresses. These entries prevent

the ServerIron ADX from load balancing the firewall traffic to these addresses. The ServerIron ADX

forwards a return packet addressed to one of these firewalls directly to the firewall that sent it,

instead of using the hash mechanism to select a path for the traffic.

ServerIronADX-A(config)# server fw-name fw3NAT 192.168.2.10

ServerIronADX-A(config-rs-fw3NAT)# exit

ServerIronADX-A(config)# server fw-name fw4NAT 192.168.2.3

ServerIronADX-A(config-rs-fw4NAT)# exit

The following commands configure the firewall group. The server fw-group 2 command changes the

focus of the CLI to firewall group 2 (IPv4 addresses). The server fw-group 4 command changes the

focus of the CLI to firewall group 4 (IPv6 addresses).

The sym-priority command specifies the priority of this ServerIron ADX with respect to the other

ServerIron ADX for the firewalls in the firewall group. The priority can be from 0 through 255. The

ServerIron ADX with the higher priority is the default active ServerIron ADX for the firewalls within

the group.

NOTE

If you specify 0, the CLI removes the priority. When you save the configuration to the startup-config

file, the sym-priority command is removed. Use this method to remove the priority. You cannot

remove the priority using the no sym-priority command.

The fw-name <firewall-name> command adds the firewalls to the firewall group. Notice that the

firewall entries for the hidden NAT addresses are not added.

SI-ActiveA(config)# server fw-group 2

SI-ActiveA(config-fw-2)# sym-priority 255

SI-ActiveA(config-fw-2)# fw-name fw1

SI-ActiveA(config-fw-2)# fw-name fw2

The fwall-info commands add the paths between this ServerIron ADX and the other ServerIron ADXs

through the firewalls. The paths enhance performance by ensuring that a given traffic flow (source

and destination IP addresses) always travels through the same firewall. In configurations that use

asynchronous firewalls, the paths enhance performance by eliminating excess authentications. In

this configuration, each ServerIron ADX has two paths to each of the two firewalls. The fifth path

goes to the router.

The paths are required, even if the firewalls are synchronized.

The first parameter with each command is a path ID. The second parameter is the port number of

the ServerIron ADX port that connects the ServerIron ADX to the firewall in the path.

1 2 ... 136 137 138 139 140 141 142 143 144 145 146 ... 187 188

Comments to this Manuals

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 141

Comments to this Manuals

Related products and manuals for Network switches Brocade Communications Systems ServerIron ADX 12.4.00