Technical data

ManualsBrandsBrocade Communications Systems ManualsComputer equipment8/8

Firewall Load Balancing Guide

Zone1-SI-S(config)# vlan 1

Zone1-SI-S(config-vlan-1)# static-mac-address 00e0.5201.a17a ethernet 4/11 priority

1 router-type

Zone1-SI-S(config-vlan-1)# static-mac-address 00e0.5207.973c ethernet 4/1 priority 1

router-type

Zone1-SI-S(config-vlan-1)# exit

Zone1-SI-S(config-tc-2)# server fw-group 2

Zone1-SI-S(config-tc-2)# fw-predictor per-service-least-conn

Zone1-SI-S(config-tc-2)# exit

Zone1-SI-S(config)# access-list 2 permit 10.10.2.0 0.0.0.255

Zone1-SI-S(config)# server fw-group 2

Zone1-SI-S(config-tc-2)# fwall-zone Zone2 2 2

Zone1-SI-S(config-tc-2)# exit

Zone1-SI-S(config)# server remote-name web1 10.10.2.40

Zone1-SI-S(config-rs-web1)# port http

Zone1-SI-S(config-rs-web1)# exit

Zone1-SI-S(config)# server remote-name web2 10.10.2.42

Zone1-SI-S(config-rs-web2)# port http

Zone1-SI-S(config-rs-web2)# exit

Zone1-SI-S(config)# server remote-name web3 10.10.3.41

Zone1-SI-S(config-rs-web3)# port http

Zone1-SI-S(config-rs-web3)# exit

Zone1-SI-S(config)# server remote-name web4 10.10.3.43

Zone1-SI-S(config-rs-web4)# port http

Zone1-SI-S(config-rs-web4)# exit

Zone1-SI-S(config)# server virtual www.web.com 10.10.1.10

Zone1-SI-S(config-vs-www.web.com)# port http

Zone1-SI-S(config-vs-www.web.com)# bind http web1 http web2 http web3 http web4 http

Zone1-SI-S(config-vs-www.web.com)# exit

Zone1-SI-S(config)# server slb-fw

Zone1-SI-S(config)# ip l4-policy 1 fw tcp 0 global

Zone1-SI-S(config)# ip l4-policy 2 fw udp 0 global

Zone1-SI-S(config)# write memory

Commands on Zone 2’s Active ServerIron (Zone2-SI-A)

The following commands configure ServerIron Zone2-SI-A in zone 2. The configuration is similar to the

configuration for ServerIron Zone1-SI-A, except the ACL and zone information are for zone 3, and FWLB-to-SLB is

enabled instead of SLB-to-FWLB.

ServerIron> enable

ServerIron# configure terminal

ServerIron(config)# hostname Zone2-SI-A

Zone2-SI-A(config)# vlan 1

Zone2-SI-A(config-vlan-1)# always-active

Zone2-SI-A(config-vlan-1)# no spanning-tree

Zone2-SI-A(config-vlan-1)# router-interface ve 1

Zone2-SI-A(config-vlan-1)# exit

Zone2-SI-A(config)# interface ve 1

Zone2-SI-A(config-ve-1)# ip address 10.10.2.222 255.255.255.0

Zone2-SI-A(config-ve-1)# exit

Zone2-SI-A(config)# ip route 0.0.0.0 0.0.0.0 10.10.2.1

Zone2-SI-A(config)# no ip icmp redirects

Zone2-SI-A(config)# vlan 10

Zone2-SI-A(config-vlan-10)# untagged ethernet 4/9 to 4/10

Zone2-SI-A(config-vlan-10)# exit

Zone2-SI-A(config)# trunk switch ethernet 4/9 to 4/10

Zone2-SI-A(config)# server fw-port 4/9

Zone2-SI-A(config)# trunk switch ethernet 4/11 to 4/12