11-04-2003 01:55 PM - edited 02-20-2020 11:04 PM
Is there, anywhere, some document that compares/contrasts setting up two PIX's in failover mode versus load balancing them as discussed in this document?
I'm trying to figure out the benefits of doing the load-balanced configuration and weigh them against the cost of the CSS's.
Thank you.
-Mark Romer
11-04-2003 02:14 PM
Hi,
Load balancing with firewall will/may not work and is not a good idea. Firewalls behaviour is statefull inspection so if a packet leaves from one firewall and enters other , it will get discarded.
Failover PIXen is for redundancy and high availability as you already aware.
Thanks,
11-04-2003 02:52 PM
Thanks for the reply.
The CSS's on either side of the firewalls maintain a flow for each connection, ensuring that all traffic within a TCP session travels through the same firewall.
We are using this load balancing configuration for our production web farm. What I'm trying to figure out is what we might lose if we reconfigured the two PIXs for failover and used a couple of the CSS's elsewhere.
-Mark
11-05-2003 07:19 AM
Mark,
As you have seen load balancing PIX's with the CSS's does work and we have many customers doing it. Your question, however is difficult to answer. As I am sure you know, the idea with load balancing the PIX's is too split the load across 2 seperate platforms. Failover and load balancing in the PIX's is going to be quite different. If you moved to a failover setup and config'ed stateful failover as well, you would gain the ability to maintain "state" if one of the firewalls went down. Meaning, sessions that were open through the active firewall would be replicated over to the stand-by firewall so when the failover ooccured, the end user would not necessarily know. I do not think you would currently have this ability in the load balanced setup. Of course, the biggest concern you are going to need to take a look at is whether one PIX can currently handle that load that you have 2 PIX's handling now. The biggest concern would probably be the connections. You can issue a 'sh conn count' to get a rough idea of how many conns wach PIX has at the time the command is run. Summing these numbers and comparing it to the numbers we provide for max conns on your platform can give you a rough idea of what to expect.
I know this is not the concrete answer you were looking for but hopefully it gives you some ideas on where to start. Good luck.
Scott
11-05-2003 07:33 AM
Thanks, Scott. That gives me a direction to look in, at least.
-Mark
11-05-2003 04:44 PM
Does anyone load-balancing PIXs with Alteon switches ?
Best Regards,
Engel
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide