Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 17)

6 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

Understanding ServerIron FWLB

DRAFT: BROCADE CONFIDENTIAL

Firewall selection

Once a ServerIron ADX has selected a firewall for a given traffic flow (source-destination pair of IP

addresses), the ServerIron ADX uses the same firewall for subsequent traffic in the same flow.

For example (using IPv4 addresses), if the ServerIron ADX selects firewall FW1 for the first packet

the ServerIron ADX receives with source address 1.1.1.1 and destination address 2.2.2.2, the

ServerIron ADX uses FW1 for all packets of flows from 1.1.1.1 to 2.2.2.2.

For example (using IPv6 addresses), if the ServerIron ADX selects firewall FW2 for the first packet

the ServerIron ADX receives with source address 1000::1 and destination address 2000::2, the

ServerIron ADX uses FW2 for all packets of flows from 1000::1 to 2000::2.

The ServerIron ADX uses one of the following methods to select a firewall for the first packet:

• Select the firewall based on a hash calculation – Used for stateless FWLB

• Select the firewall with the fewest open connections – Used for stateful FWLB

• Select the firewall with the fewest open connections per service – Used for stateful FWLB

Hashing mechanism

The ServerIron ADXs use the path information along with the hash mask value for each

source-destination pair of IP addresses in the user traffic to consistently send the same

source-destination pairs through the same paths. For FWLB, the hash mask must be set to all ones

(255.255.255.255 255.255.255.255 for IPv4 and FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF for IPv6) to ensure that a given source-destination pair

always goes down the same path.

The ServerIron ADX selects a firewall for forwarding a packet based on the packet’s hash value (the

binary sum of the source and destination addresses). Once the ServerIron ADX assigns a hash

value to a given source-destination pair, the ServerIron ADX associates that hash value with a path

and always uses the same path for the source-destination pair that has the assigned hash value.

Hashing based on TCP or UDP port

You can configure the ServerIron ADX to hash based on destination TCP or UDP ports. When the

ServerIron ADX uses the TCP or UDP port number in addition to the source and destination IP

address, traffic with the same source and destination IP address can be load balanced across

different paths, based on the destination TCP or UDP port number.

1 2 ... 12 13 14 15 16 17 18 19 20 21 22 ... 187 188

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 17