Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 58)

ServerIron ADX Firewall Load Balancing Guide 47

53-1002436-01

Configuring HA active-active FWLB

DRAFT: BROCADE CONFIDENTIAL

Adding the firewalls to the firewall group

To add the firewalls to the firewall group, enter the following commands.

ServerIronADX(config)# server fw-group-2

ServerIronADX(config-fw-2)# fw-name FW1

ServerIronADX(config-fw-2)# fw-name FW2

Syntax: server fw-group 2 | 4

This command changes the CLI to the firewall group configuration level. The IPv4 address format

firewall group number is 2. The IPv6 address format firewall group number is 4. These are the only

supported firewall groups.

Syntax: [no] fw-name <string>

This command adds a configured firewall to the firewall group. For an IPv6 firewall example, refer to

“IPv6 example for basic Layer 3 FWLB” on page 24.

Changing the load balancing method

By default, the ServerIron ADX load balances firewall traffic flows by selecting the firewall with the

lowest number of total connections. You can configure the ServerIron ADX to load balance based

on the lowest number of connections for the traffic flow’s application.

For example, suppose a configuration has two firewalls (FW1 and FW2), and each firewall has two

application ports defined (HTTP and SMTP). Also assume the following:

• FW1 has 10 HTTP connections and 80 SMTP connections.

• FW2 has 60 HTTP connections and 10 SMTP connections.

Using the default load balancing method, traffic for a new flow is load balanced to FW2, because

this firewall has fewer total connections. This is true regardless of the application in the traffic.

However, using the load balancing by application method, a new traffic flow carrying HTTP traffic is

load balanced to FW1 instead of FW2, because FW1 has fewer HTTP connections. A new traffic

flow for SMTP is load balanced to FW2, because FW2 has fewer SMTP connections.

To enable load balancing by application, enter the following command at the firewall group

configuration level.

ServerIronADX(config-fw-2)# fw-predictor per-service-least-conn

Syntax: [no] fw-predictor total-least-conn | per-service-least-conn

The total-least-conn parameter load balances traffic based on the total number of connections

only. This is the default.

The per-service-least-conn parameter load balances traffic based on the total number of

connections for the traffic’s application. This is valid for TCP or UDP applications.

1 2 ... 53 54 55 56 57 58 59 60 61 62 63 ... 187 188

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 58