Hi to all,

Sorry for the confusion..I'll summarise my question this time. My network topology is as follows:

I have 4 PCs acting as firewall that are directly connected to a switch. The switch is, in turn, connected to a router. I want to load balance traffic coming from the router onto the 4 PCs on a per-packet basis. The 4 PCs are on the same subnet and they forward traffic to destination nodes, which are also part of that subnet. How can I do that that load balancing part? Is there some kind of configuration that I have to do on the switch? Or will the fact that the 4 interfaces, to which the 4 PCs are connected, are pointing towards the same network address be enough for the switch to choose one interface at a time to forward the packets?

Many thx for the reply...

Warm regards,

Visham

Hi to all,

Sorry for the confusion..I'll summarise my question this time. My network topology is as follows (setup picture attached):

I have 4 PCs acting as firewall that are directly connected to a switch. The switch is, in turn, connected to a router. I want to load balance traffic coming from the router onto the 4 PCs on a per-packet basis. The 4 PCs are on the same subnet and they forward traffic to destination nodes, which are also part of that subnet. How can I do that that load balancing part? Is there some kind of configuration that I have to do on the switch? Or will the fact that the 4 interfaces, to which the 4 PCs are connected, are pointing towards the same network address be enough for the switch to choose one interface at a time to forward the packets?

Many thx for the reply...

Warm regards,

Visham

Hi,

Why not using 4 static routes on the router for the LAN (the LAN shouldn't be directly connected to the router, if i've understood your solution correct) with both the 4 different next-hop ip address and the outgoing interface (which will be the same for the 4 routes, to make sure that the route is removed if the interface failed), enabling CEF, and using the "ip load-sharing per-packet" under the interface, may Rick please comment on this suggestion.

I just have one question to Visham, how would you insure the return traffic from the LAN through the 4 FW.

HTH,

Mohammed Mahmoud.

Hi to all,

To mohammedmahmoud:

First of, may thx for the reply..I thought about the "ip load sharing per-packet command" but cisco documentation says that it is available in Routers of the 10000 series and above...maybe the "no ip route-cache" will do the trick of PPLB in routers of lower series. But I'm not sure how it works when there are those 4 static routes. Does it choose them one at a time in a round-robin fashion?

As for the return traffic, I am using a Linux box which has software to do that PPLB over the 4 firewall nodes. It was just that I'm nt sure of how to balance incoming traffic from the router onto the 4 firewall nodes.

Warm regards,

Visham

Hi Visham,

No, CEF and "ip load sharing per-packet" command is available in nearly all the Cisco routers in the recent codes, it works by sending one packet over the first path and another packet over the second path and so on packet by packet if there exists multiple paths with the same metric, my only doubt in your case was that all the paths have the same outgoing interface and thats why i've asked for Rick's comment, but in my opinion it should work.

HTH,

Mohammed Mahmoud.

Visham

I believe that your reference about the behavior of CEF being restricted to very high end routers must be from pretty old documentation. Mohammed is quite correct that CEF and per-packet load balancing is supported on pretty much all the router product line now.

I believe that Mohammed's suggestion of 4 static routes, and enabling CEF per-packet balancing would probably achieve what you have asked. But I wonder if that is really what you need. My primary concern is the effect of the 4 PCs acting as firewalls. Most firewalls maintain state about connections and will reject packets coming through the firewall that do not match the state table. So for example if the TCP 3 way handshake for a HTTP connection to a server went through PC#1 and then an HTTP packet to the server went through PC#2, the firewall would reject it because it had not seen the beginning of the TCP session. Do these PC firewalls not maintain state? How do they enforce their firewall rules?

HTH

Rick

Hi Rick,

Totally agree on your concern, and thus i think that per destination load balancing would be the solution as it would go ok with the firewall state, but still there is a problem, how would the router know that this packet flow should go back through the first FW for example (the one that has initiated the state in the state table when it was first sent to the internet).

BR,

Mohammed Mahmoud.

Mohammed

I agree that there is an issue about how you assure that return traffic (responses to traffic originating from outside) goes back through the same firewall as where the traffic originated. I believe that this is an issue whether you are doing per destination balancing or per packet balancing.

HTH

Rick

I'm performing state synchronisation on the stateful firewall nodes. Hence, since PPLB and stateful firewalling work well, I dont need to care which firewall the packets go through, since all the firewall nodes will have state info about the same connections.

Many thx to all of you for your help...

Warm regards,

Visham