Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 18)

ServerIron ADX Firewall Load Balancing Guide 7

53-1002436-01

Understanding ServerIron FWLB

DRAFT: BROCADE CONFIDENTIAL

Stateful FWLB

A ServerIron ADX performs stateful FWLB by creating and using session entries for source and

destination traffic flows and associating each flow with a specific firewall.

When a ServerIron ADX receives a packet that needs to go through a firewall, the ServerIron ADX

checks to see whether it has an existing session entry for the packet:

• If the ServerIron ADX does not have a session entry with the packet’s source and destination

addresses, the ServerIron creates one. To create the session entry, the ServerIron ADX selects

the firewall that has the fewest open sessions with the ServerIron ADX and associates the

source and destination addresses of the packet with that firewall.

The ServerIron ADX also sends the session information to the other ServerIron ADX in the

high-availability pair, so that the other ServerIron ADX uses the associated path for the

corresponding traffic and does not create a new session for the same traffic flow.

• If the ServerIron ADX already has a session entry for the packet, the ServerIron ADX forwards

the traffic to the firewall in the session entry. All packets with the same source and destination

addresses are forwarded to the same firewall. Because the ServerIron ADXs in a

high-availability pair exchange session information, the same firewall is used regardless of

which ServerIron ADX receives the traffic to be forwarded.

In addition to the firewall selection method based on fewest sessions described previously, a

ServerIron ADX can also select a firewall that has the fewest open sessions for the requested

service. For example, with "port http" defined for each firewall, HTTP requests will be load balanced

to the firewall that has the least open HTTP connections.

Health checks

The ServerIron ADX regularly checks the health of the firewall paths and router paths, and of the

applications on the firewalls, if you add applications to the firewall configurations.

ServerIron ADXs on each side of a firewall exchange health information for the links in each path by

exchanging IP pings through the firewalls. When the ServerIron ADX on one side of a firewall

receives a reply to a ping it sends to the other ServerIron ADX, on the other side of the firewall, the

ServerIron ADX that sent the ping concludes that its partner on the other side of the firewall is

operating normally.

The pings are required because a ServerIron ADX can use link-state information to detect when the

local link (a link directly attached to a ServerIron ADX port) in a path goes down, but cannot detect

when the remote link in the path goes down. If the other ServerIron ADX fails to respond to a ping

on a specific port, the ServerIron ADX that sent the ping tries two more times, and then determines

that the remote link in the path must be down.

NOTE

For Layer 3 health checks, the health-checking mechanism requires that the firewalls be configured

to allow ICMP traffic between the two ServerIron ADXs and the ServerIron’s gateway router. If the

firewalls block the ICMP traffic between ServerIron ADXs, the health check will not work and, as a

result, your IronClad configuration will not function properly.

1 2 ... 13 14 15 16 17 18 19 20 21 22 23 ... 187 188

Comments to this Manuals

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 18

Comments to this Manuals

Related products and manuals for Network switches Brocade Communications Systems ServerIron ADX 12.4.00