Cisco LAN Switching Configuration : Server Load Balancing (SLB)

10-2: SLB Firewall Load Balancing

• Firewall load balancing balances traffic flows to one or more firewall farms.
• A firewall farm is a group of firewalls that are connected in parallel or that have their “inside” (protected) and “outside” (unprotected) interfaces connected to common network segments.

• Firewall load balancing requires a load-balancing device (IOS SLB) to be connected to each side of the firewall farm. A firewall farm with “inside” and “outside” interfaces would then require two load-balancing devices, each making sure that traffic flows are directed toward the same firewall for the duration of the connection. Figure 10-3 illustrates the basic firewall load-balancing concept.

  

  Figure 10-3 Firewall Load-Balancing Concept

• Firewall load balancing is performed by computing a hash value of each new traffic flow (source and destination IP addresses and ports). This is called a route lookup.
• The firewall load-balancing device then masquerades as the IP address for all firewalls in the firewall farm.
• Firewall load balancing can detect a firewall failure by monitoring probe activity.
• The HSRP can be used to provide a “stateless backup” redundancy for multiple firewall load-balancing devices. If one device fails, a redundant device can take over its function.
• Multiple firewall load-balancing devices can also use “stateful backup” for redundancy. Backup devices keep state information dynamically and can take over immediately if a failure occurs.

Configuration

1. Define a firewall farm.

   1. Assign a name to the firewall farm:

      (global) ip slb firewallfarm firewallfarm-name

      In IOS SLB, the collection of firewalls is referenced by firewallfarm-name (text string up to 15 characters).

   2. Identify one or more firewalls in the farm.

      • Specify the firewall’s IP address:

        (firewall-farm) real ip-address

        The firewall is directly connected (same logical subnet) to the load-balancing device with an interface at IP address ip-address.

      • (Optional) Assign a relative capacity weight:

        (real-firewall) weight weighting-value

        The real firewall is assigned a weighting-value (1 to 255; default 8) that indicates its capacity relative to other real firewalls in the firewall farm. These values are statically defined and are based on what you think the firewall can handle, relative to the others. The weight values are used only for round-robin or least-connections algorithms.

      • (Optional) Define one or more probes to detect a firewall failure:

        (real-firewall) probe probe-name

        The probe that is defined by probe-name (text string) is used periodically to determine whether the firewall has failed. Even if more than one probe is defined, the firewall is declared down if it fails just one probe. A firewall must pass all probes to be recovered again.

        TIP

        You must also define the probes separately, as described in section “10-3: SLB Probes.” Ping probes are the most useful for firewall load balancing. For each firewall in the firewall farm, configure a probe to send ping packets that pass completely through the firewall, destined for the firewall load-balancing device on the other side. This tests both “inside” and “outside” interfaces of the firewall, requiring them to be active and operational so that the ping probe is reflected from the other side. Be sure that the firewall is configured to allow ICMP ping packets to pass through.

      • Allow load balancing to begin using the firewall:

        (real-firewall) inservice

        By default, the real firewall is not used by SLB unless it is placed in service. To remove a firewall from service, use no inservice.

   3. (Optional) Define one or more flows that will be sent to the firewall farm:

      (firewall-farm) access [source source-ip-address network-mask]
        [destination destination-ip-address network-mask]

      When multiple firewall farms exist, traffic can be identified by address and sent through the appropriate firewall farm. A traffic flow is defined by its source and destination addresses and subnet masks. If either source or destination keywords are omitted, they default to 0.0.0.0 with a mask of 0.0.0.0, signifying all addresses and networks. This is the default behavior.

   4. (Optional) Choose a firewall load-balancing method:

      (firewall-farm) predictor hash address [port]

      By default IOS SLB uses the source and destination IP addresses of a flow to select a destination firewall. Use the port keyword to use the source and destination addresses, and the source and destination TCP or UDP port numbers, in the selection decision.

   5. (Optional) Use stateful backup to recover from a failure:

      (firewall-farm) replicate casa listening-ip remote-ip port-number
        [interval] [password [0|7] password [timeout]]

      The redundant load-balancing devices use CASA structure to exchange and replicate state information. This is sent from the listening-ip address (an interface on the local device) to the remote-ip address (an interface on the backup device), using port-number (1 to 65535). Replication messages are sent at interval seconds (1 to 300, default 10).

      A password (text string; use 0 if unencrypted, the default; or 7 if encrypted) can be used for MD5 authentication with the backup device. The optional timeout (0 to 65,535 seconds; default 180 seconds) defines a time period when the password can be migrated from an old value to a new one. During this time, both old and new passwords are accepted.

   6. (Optional) Adjust the TCP or UDP connection parameters.

      • Enter the TCP or UDP configuration mode:

        (firewall-farm) {tcp | udp}

        You might need to make adjustments to both TCP and UDP. In this case, this command can be repeated to configure each independently.

      • (Optional; TCP only) Hold connections open after they are terminated:

        (firewall-farm-protocol) delay duration

        After a TCP connection is terminated, the connection context can be maintained for duration (1 to 600 seconds, default 10 seconds). This can be useful when packets arrive out of sequence and the connection is reset before the last data packet arrives.

      • (Optional) Hold connections open after no activity:

        (firewall-farm-protocol) idle duration

        When an absence of packets is detected for a connection, the connection is kept open for duration (10 to 65,535 seconds; default 3600 seconds or 1 hour) before an RST is sent.

      • (Optional) Specify the maximum number of connections:

        (firewall-farm-protocol) maxconns number

        At any given time, the real server is limited to number (1 to 4,294,967,295; default 4,294,967,295) active connections.

      • (Optional) Assign connections from the same IP address to the same firewall:

        (firewall-farm-protocol) sticky duration [netmask netmask]

      For a given IP address, connections are assigned to the last-used firewall for duration (0 to 65,535 seconds). A netmask can be given so that all source addresses within the mask are assigned to the same firewall.

   7. (IOS SLB only) Allow firewall load balancing to begin using the firewall:

      (firewall-farm) inservice

      By default, the firewall is not used by firewall load balancing unless it is placed in service. To remove a firewall from service, use no inservice.

Firewall Load-Balancing Example

To perform firewall load balancing, two load-balancing devices are needed: one located externally and one located internally with respect to the firewall farm. Figure 10-4 shows a network diagram for this example.

Figure 10-4 Network Diagram for the Firewall Load-Balancing Example

The firewall farm consists of two real firewalls. Their “outside” (unprotected) interfaces are at 192.168.1.2 and 192.168.1.3. Their “inside” (protected) interfaces are at 192.168.100.2 and 192.168.100.3. On the outside, the default gateway is 10.5.1.1, and the external SLB device is at 10.5.1.2.

The internal SLB device performs firewall load balancing for outbound traffic to the firewall farm. As well, it provides normal server load balancing for an internal server farm. The real servers are 10.70.1.10 and 10.70.1.20, and the virtual server appears as 10.5.1.80.

Ping probes are used by both external and internal SLB devices to test for firewall operation. An HTTP probe tests each of the real servers in the server farm. These use the default GET method and are sent every 240 seconds.

The configuration for the external load-balancing device is shown first:

(global) ip slb firewallfarm Outside
(firewall-farm) real 192.168.1.2
(real-firewall) weight 8
(real-firewall) probe Ping1
(real-firewall) inservice
(real-firewall) exit
(firewall-farm) real 192.168.1.3
(real-firewall) weight 8
(real-firewall) probe Ping2
(real-firewall) inservice
(real-firewall) exit
(firewall-farm) inservice
(firewall-farm) exit
(global) ip slb probe Ping1 ping
(probe) address 192.168.100.1
(probe) interval 10
(probe) faildetect 4
(global) ip slb probe Ping2 ping
(probe) address 192.168.100.1
(probe) interval 10
(probe) faildetect 4
(probe) exit

Now the configuration for the internal load-balancing device is shown:

(global) ip slb firewallfarm Inside
(firewall-farm) real 192.168.100.2
(real-firewall) weight 8
(real-firewall) probe Ping1
(real-firewall) inservice
(real-firewall) exit
(firewall-farm) real 192.168.100.3
(real-firewall) weight 8
(real-firewall) probe Ping2
(real-firewall) inservice
(real-firewall) exit
(firewall-farm) inservice
(firewall-farm) exit

(global) ip slb serverfarm Servers
(server-farm) nat server
(server-farm) probe HTTP1
(server-farm) real 10.70.1.10
(real-server) inservice
(real-server) exit
(server-farm) real 10.70.1.20
(real-server) inservice
(real-server) exit

(global) ip slb vserver Vservers
(virtual-server) serverfarm Servers
(virtual-server) virtual 10.5.1.80 tcp 0
(virtual-server) inservice
(virtual-server) exit

(global) ip slb probe Ping1 ping
(probe) address 192.168.1.1
(probe) interval 10
(probe) faildetect 4
(probe) exit
(global) ip slb probe Ping2 ping
(probe) address 192.168.1.1
(probe) interval 10
(probe) faildetect 4
(probe) exit
(global) ip slb probe HTTP1 http
(probe) port 80
(probe) interval 240
(probe) request

Displaying Information About Firewall Load Balancing

Table 10-2 lists some switch commands that you can use to display helpful information about SLB firewall load-balancing configuration and status.

Table 10-2. Commands to Display SLB Firewall Load-Balancing Configuration and Status Information

(exec) show ip slb reals

(exec) show ip slb reals detail

(exec) show ip slb firewallfarm

(exec) show ip slb conns [firewall firewallfarm-
name] [detail]

(exec) show ip slb probe [name probe_name] [detail]

(exec) show ip slb sticky