Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 61)

50 ServerIron ADX Firewall Load Balancing Guide

53-1002436-01

Configuring HA active-active FWLB

DRAFT: BROCADE CONFIDENTIAL

To configure the static MAC address entries for ServerIron ADX SI-Ext-A in Figure 10, enter the

following commands.

ServerIronADX(config-fw-2)# vlan 1

ServerIronADX(config-vlan-1)# static-mac-address 0050.da92.08fc ethernet 4/5

priority 1 router-type

ServerIronADX(config-vlan-1)# static-mac-address 0050.da8d.5218 ethernet 4/1

priority 1 router-type

Syntax: [no] static-mac-address <mac-addr> ethernet <portnum> [priority <0-7>] [host-type |

router-type]

The priority can be from 0 through 7 (0 is lowest and 7 is highest). Use a priority higher than 0.

Use router-type for the entry type.

If you are using the always-active feature (by entering the always-active command in VLAN 1 for

simplified Layer 2 topology), you also must enable the L2-Fwall feature by entering the following

command.

ServerIronADX(config-fw-2)# l2-fwall

Syntax: [no] l2-fwall

Dropping packets when a firewall reaches its limit

By default, if the ServerIron ADX receives traffic that it needs to forward to a firewall, but the firewall

already has the maximum number of sessions open or has exceeded its maximum connection rate,

the ServerIron ADX uses a hashing mechanism to select another firewall. The hashing mechanism

selects another firewall based on the source and destination IP addresses and application port

numbers in the packet.

If you want the ServerIron ADX to drop the traffic instead of load balancing it using the hashing

mechanism, enter the following command.

ServerIronADX(config-fw-2)# fw-exceed-max-drop

Syntax: [no] fw-exceed-max-drop

The ServerIron ADX drops traffic only until the firewall again has available sessions.

Restricting TCP traffic to a firewall to established sessions

By default, the ServerIron ADX sends a properly addressed TCP data packet to a firewall regardless

of whether the ServerIron ADX has received a TCP SYN for the traffic flow. For example, if the

ServerIron ADX receives a TCP packet addressed to TCP port 8080 on IP address 1.1.1.1, the

ServerIron ADX forwards the packet to the firewall connected to 1.1.1.1 regardless of whether the

ServerIron ADX has received a TCP SYN for the session between the packet's source and 1.1.1.1.

For tighter security, you can configure the ServerIron ADX to forward a TCP data packet only if the

ServerIron ADX has already received a TCP SYN for the packet's traffic flow (source and destination

addresses). For example, with the tighter security enabled, the ServerIron ADX does not forward a

TCP data packet to 1.1.1.1 unless the ServerIron ADX has already received a TCP SYN for the

session between the packet's source and 1.1.1.1.

To enable the tighter security, enter the following command at the global CONFIG level of the CLI.

ServerIronADX(config)# server fw-strict-sec

1 2 ... 56 57 58 59 60 61 62 63 64 65 66 ... 187 188

Comments to this Manuals

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 61

Comments to this Manuals

Related products and manuals for Network switches Brocade Communications Systems ServerIron ADX 12.4.00