Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 86
- Page / 188
- Table of contents
- BOOKMARKS
Rated. / 5. Based on customer reviews
ServerIron ADX Firewall Load Balancing Guide 75
53-1002436-01
Configuration example for basic multizone FWLB
4
DRAFT: BROCADE CONFIDENTIAL
The following command identifies the router port, which is the ServerIron ADX port connected to a
router. In the example in
Figure 13 on page 73, each ServerIron ADX has one router port. If the
link is a trunk group, enter the primary port number. In this example, the router port is port 5.
Zone1-SI(config)# server router-ports 5
The following commands add the firewalls.
Zone1-SI(config)# server fw-name FW1 209.157.24.1
Zone1-SI(config-rs-FW1)# exit
Zone1-SI(config)# server fw-name FW2 209.157.24.254
Zone1-SI(config-rs-FW2)# exit
The names are specific to the ServerIron ADX and do not need to correspond to any name
parameters on the firewalls themselves. The IP addresses are the addresses of the firewall
interfaces with the ServerIron ADX.
The following command configures an Access Control List (ACL) for the IP addresses in the DMZ
zone (zone 2). The command configures a standard ACL for the addresses in zone 2, which
contains addresses in the 209.157.25.x/24 sub-net. The “0.0.0.255” values indicate the
significant bits in the IP address you specify. In this case, all bits except the ones in the last node of
the address are significant.
In this configuration, only one zone definition is required on each ServerIron ADX, including
Zone1-SI. Because the Zone1-SI ServerIron ADX is already in zone 1, the ServerIron ADX will
forward packets either to the ServerIron ADX in zone 2 or to the only other ServerIron ADX that is
not in zone 2. In this case, the only other ServerIron ADX is the one in zone 3. Thus, if ServerIron
ADX Zone1-SI receives a packet that is not addressed to the sub-net Zone1-SI is in, and is not
addressed to a sub-net in zone 2, the ServerIron ADX assumes that the packet is for an address in
the other zone, zone 3. The ServerIron ADX forwards the packet to the ServerIron ADX in zone 3.
Zone1-SI(config)# access-list 2 permit 209.157.25.0 0.0.0.255
Although each zone in this example contains one Class C sub-net, you can configure ACLs for any
range of addresses and even for individual host addresses.
NOTE
This example shows a numbered ACL instead of a named ACL. You must use numbered ACLs. The
FWLB software does not support zone configuration based on named ACLs.
The following commands configure the firewall group parameters. In this case, the commands
configure the firewall zones, add zone 2, and add the firewalls.
Zone1-SI(config)# server fw-group 2
Zone1-SI(config-fw-2)# fwall-zone Zone2 2 2
Zone1-SI(config-fw-2)# fw-name FW1
Zone1-SI(config-fw-2)# fw-name FW2
Syntax: [no] fwall-zone <zone-name> <zone-number> <acl-number>
The fwall-zone command configures a firewall zone. To configure a zone, specify the following
variables:
The <zone-name> variable specifies an ASCII string that identifies the zone.
The <zone-number> variable specifies the number of the zone being configured. This variable can
be specified as an integer from 1 through 10. Refer to
Table 3 for the maximum number of zones
and paths supported on the ServerIron ADX ADX.
The <acl-number> variable specifies the standard ACL that specifies the IP addresses in the zone.
- ServerIron ADX 1
- Document History 2
- Contents 3
- About This Document 8
- Document conventions 9
- Notice to the reader 10
- Related publications 11
- ServerIron FWLB Overview 12
- Firewall environments 14
- Load balancing paths 15
- Firewall selection 17
- Hashing mechanism 17
- Stateful FWLB 18
- Health checks 18
- Path health checks 19
- Application health checks 19
- Firewall health check debug 21
- Basic FWLB topology 22
- HA FWLB topology 23
- Failover 24
- Router paths 24
- Multizone FWLB topology 25
- FWLB configuration limits 26
- Configuring Basic FWLB 28
- IPv4 Firewall-1 37
- IPv4 Firewall-2 37
- External 40
- Internal 40
- Firewall-2 42
- Firewall-1 42
- Configuring HA FWLB 48
- Session limits 49
- Session aging 49
- Task Reference 52
- Configuring the firewall port 53
- Configuring the partner port 54
- Configuring the router port 55
- Configuring the firewalls 55
- Adding the firewalls 55
- Connection rate control 57
- Complete CLI example 62
- HA FWLB with VRRP 73
- Usage notes 78
- Configuring Multizone FWLB 82
- Zone 3Zone 2 84
- Zone1-SI(config)# no span 85
- Failover algorithm 92
- Commands on Zone1-SI-A zone 1 92
- DRAFT: BROCADE CONFIDENTIAL 100
- 53-1002436-01 102
- SI-A SI-A 104
- In this chapter 124
- NAT firewalls 124
- Extra firewall method 129
- Access policy method 130
- Specifying the partner port 134
- Specifying the router ports 134
- Configuring FWLB and SLB 146
- Configuring SLB-to-FWLB 148
- Configuring the real servers 149
- Enabling SLB-to-FWLB 150
- Configuring FWLB-to-SLB 152
- Enabling FWLB-to-SLB 154
- FWLB configuration overview 166
- TCP/UDP port statistics 169
- FWLB path information 172
- Field Description 173
- • 6 – TCP 174
- • 17 – UDP 174
- In this appendix 176
- FWLB selection algorithms 182
- Configuration guidelines 186
- Denying FWLB 187
Related products and manuals for Network switches Brocade Communications Systems ServerIron ADX 12.4.00
(12 pages)
(64 pages)© 2020, manymanuals.com. All rights reserved. | 1.116 s |
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Comments to this Manuals