Nortel Networks WEB OS 212777 - Manual (Page 318)

Web OS 10.0 Application Guide
318 n Chapter 13: Firewall Load Balancing
212777-A, February 2002
4. The firewalls decide if they should allow the packets and, if so, forwards them to a virtual
server on the clean-side Web switch.
Client requests are forwarded or discarded according to rules configured for each firewall.
N OTE – Rule sets must be consistent across all firewalls.
5. The clean-side Web switch performs normal SLB functions.
Packets forwarded from the firewalls are sent to the original destination address, that is, the vir-
tual server on the clean-side Web switch. There, they are load balanced to the real servers using
standard SLB configuration.
6. The real server responds to the client request.
7. Redirection filters on the clean-side Web switch balance responses among different IP
addresses.
Redirection filters are needed on all ports on the clean-side Web switch that attach to real serv-
ers or internal clients on the clean-side of the network. Filters on these ports redirect the Inter-
net-bound traffic to a real server group that consists of a number of different IP addresses. Each
IP address represents an IP interface on a different subnet on the dirty-side Web switch.
8. Outbound traffic is routed to the firewalls.
Static routes are configured on the clean-side switch. One static route is needed for each stream
that was configured on the dirty-side Web switch. For instance, the first static route would be
configured to lead to the first dirty-side IP interface using the first firewall as the next hop. The
second static route would lead to the second dirty-side IP interface using the second firewall as
the next hop, and so on.
Since Web switches intelligently maintain state information, all traffic between specific IP
source/destination addresses flows through the same firewall, maintaining session persistence.
N OTE – If Network Address Translation (NAT) software is used on the firewalls, FWLB ses-
sion persistence requires the RTS option to be enabled on the Web switch (see “Free-Metric
FWLB” on page 346 ).
9. The firewall decides if it should allow the packet and, if so, forwards it to the dirty-side
Web switch.
Each firewall forwards or discards the server responses according to the rules that are config-
ured for it. Forwarded packets are sent to the dirty-side Web switch and out to the Internet.
10. The client receives the server response.