What is Firewall Load Balancing (FWLB)

In today’s data centers, the security of the network, servers, and applications is paramount. A key component of this security infrastructure is the firewall, which protects against malicious or unauthorized access. However, as business activities increasingly rely on uninterrupted internet connectivity, a robust, scalable, and highly available firewall infrastructure is crucial. This is where Firewall Load Balancing (FWLB) comes into play.

What is Firewall Load Balancing? #

Firewall Load Balancing is a deployment architecture where multiple firewall systems are strategically positioned behind Server Load Balancers. Network traffic is distributed across a group of firewalls, creating a scalable and highly available security infrastructure. This setup ensures that if one firewall fails, others can seamlessly take over, maintaining business continuity.

Importance of Firewall Load Balancing #

Scalability #

Firewalls handle the heavy lifting of inspecting, analyzing, and modifying packets based on security policies. As traffic increases, the computational demands on firewalls grow, necessitating additional resources. With FWLB, new firewalls can be added dynamically, enhancing capacity without disrupting existing systems. This scalability is essential for accommodating growing traffic loads and ensuring consistent performance.

Reliability #

High availability is critical for any security infrastructure. FWLB enhances reliability by distributing traffic across multiple firewalls. If a firewall fails, the load balancer detects the failure and redirects traffic to other functioning firewalls. This redundancy minimizes downtime and ensures continuous protection.

Manageability #

Maintaining firewalls can be challenging, particularly when updating security policies or performing software upgrades. FWLB simplifies management by allowing individual firewalls to be taken out of service for maintenance without disrupting user traffic. This approach enables seamless updates and reduces the risk of unforeseen issues.

Implementing Firewall Load Balancing #

In a typical FWLB setup, firewalls are sandwiched between Server Load Balancers. Traffic from the internet and internal networks is directed to the least loaded firewall. Established network sessions are consistently routed through the same firewall to maintain packet inspection and security analysis.

Case Study Overview #

Consider a deployment where a Content Switch Module (CSM) is used to load balance firewalls across three secure segments: Internet (INET), Demilitarized Zone (DMZ), and Local Area Network (LAN). The goal is to ensure high availability, seamless management, and robust security across these segments.

Server and Application Requirements #

Servers in the DMZ need direct management from LAN stations.
Servers must initiate sessions for updates and patches.
Primary applications in the DMZ are HTTP and HTTPS based, requiring persistent connections.

Security Requirements #

Load balancing flows from all segments to the firewalls.
Each network path through the firewall must be verified before use.
High availability and the ability to handle multi-connection applications like FTP.

Infrastructure Requirements #

Minimal disruption to existing network protocols.
Seamless integration of CSMs in the current infrastructure.
Robust failover mechanisms to handle firewall failures.

Design Considerations #

Use ICMP probes to monitor firewall paths.
Configure port-channels for server and client VLANs to avoid single points of failure.
Ensure virtual IPs (VIPs) within the virtual server configuration are correctly subnetted to prevent routing loops.

FWLB Probes #

ICMP probes are crucial for verifying the availability of paths through firewalls. These probes are configured to monitor all firewall links, ensuring continuous path availability. The interval, retries, and failure thresholds for probes can be adjusted to meet specific requirements, ensuring timely detection and response to firewall failures.

How to implement FWLB with RELIANOID Load Balancer #

Implementing FWLB (Firewall Load Balancing) with RELIANOID Load Balancer involves configuring it as an external load balancer that routes traffic to a pool of firewalls, ensuring that connections are consistently routed to the same firewall for the duration of the session. Here’s a detailed guide on how to achieve this setup:

Network Architecture Overview #

External Load Balancer (RELIANOID): This will handle incoming traffic and distribute it to a pool of firewalls.
Firewalls: These will filter and forward traffic internally after being processed by the external load balancer.
Internal Load Balancers: Optionally, internal load balancers within the internal network may further distribute traffic after passing through the firewalls.

Configure RELIANOID Load Balancer (External Load Balancer) #

Create Layer 4 Farms

Log in to the RELIANOID web interface.
Navigate to the Farm section or similar.
Create Layer 4 Farms corresponding to the types of traffic you need to handle (e.g., TCP, UDP).

Define the listening IP addresses and ports for each farm.
Specify the servers (in this case, the firewalls) that will receive traffic from each farm.
Configure health checks to monitor the availability of each firewall.

Set Persistence (Affinity)

Enable persistence (sometimes called affinity or sticky sessions) to ensure that connections from the same client IP are consistently directed to the same firewall. This is crucial for maintaining session continuity, especially for protocols like HTTP/HTTPS where sessions can span multiple connections.

Configure Firewall Pool
Define a pool of firewalls in the RELIANOID load balancer configuration.

This pool represents the set of firewalls that will process incoming traffic.
Ensure that the firewalls are correctly configured to handle the traffic forwarded by the RELIANOID load balancer.

Traffic Flow #

External Traffic Handling

Incoming traffic reaches the RELIANOID load balancer.
Based on the Layer 4 farm configurations, the load balancer forwards traffic to the appropriate firewall based on destination IP address, port, or subnet.

Persistence Mechanism

The load balancer uses persistence mechanisms (source IP affinity typically) to ensure that connections from the same client IP are directed to the same firewall.
This is essential to maintain session state across multiple connections from the same client.

Firewall Processing

Each firewall in the pool receives traffic from the load balancer.
Firewalls inspect and filter traffic based on configured rules (e.g., allowing/denying traffic based on source/destination IP, ports, protocols).

Internal Load Balancers (Optional) #

Optionally, within your internal network, you may use additional load balancers to distribute traffic further after it has passed through the firewalls.
These internal load balancers can operate at the application or networking level depending on your specific requirements.

Testing and Validation #

Test the configuration to ensure that:

Traffic is correctly routed from the external load balancer to the firewalls.
Persistence mechanisms (affinity/sticky sessions) are functioning as expected.
Firewalls are correctly filtering and forwarding traffic to the internal network.

Monitoring and Maintenance #

Regularly monitor the performance of the RELIANOID load balancer, firewalls, and internal network components.
Ensure that configurations are updated as network and application requirements evolve.

Additional Considerations #

Security: Ensure that firewall rules are correctly configured to protect your network from unauthorized access.
Scalability: Plan for scaling your load balancer and firewall infrastructure as traffic demands increase.
Documentation: Maintain detailed documentation of your configuration, including network diagrams and configuration settings for easier troubleshooting and future reference.

Conclusion #

Firewall Load Balancing is essential for building a scalable, reliable, and manageable security infrastructure. By distributing traffic across multiple firewalls and ensuring high availability, FWLB protects against network failures and enhances overall security. Implementing FWLB requires careful planning and configuration, but the benefits of improved scalability, reliability, and manageability make it a worthwhile investment for any organization focused on maintaining robust cybersecurity.

By following these steps, you can effectively implement FWLB with RELIANOID Load Balancer as an external and internal load balancer, ensuring that traffic is efficiently routed to firewalls and managed according to your network security policies before being forwarded to the internal network.