Firewall Load-Balancing Example - Cisco Catalyst 2000 Configuration Handbook

f. (Optional) Adjust the TCP or UDP connection parameters.
Enter the TCP or UDP configuration mode:
■
(firewall-farm) {tcp | udp}
You might need to make adjustments to both TCP and UDP. In this case, this
command can be repeated to configure each independently.
■ (Optional; TCP only) Hold connections open after they are terminated:
(firewall-farm-protocol) delay duration
After a TCP connection is terminated, the connection context can be main-
tained for duration (1 to 600 seconds, default 10 seconds). This can be useful
when packets arrive out of sequence and the connection is reset before the last
data packet arrives.
■ (Optional) Hold connections open after no activity:
(firewall-farm-protocol) idle duration
When an absence of packets is detected for a connection, the connection is
kept open for duration (10 to 65,535 seconds; default 3600 seconds or 1 hour)
before an RST is sent.
(Optional) Specify the maximum number of connections:
■
(firewall-farm-protocol) maxconns number
At any given time, the real server is limited to number (1 to 4,294,967,295;
default 4,294,967,295) active connections.
■ (Optional) Assign connections from the same IP address to the same firewall:
(firewall-farm-protocol) sticky duration [netmask netmask]
For a given IP address, connections are assigned to the last-used firewall for
duration (0 to 65,535 seconds). A netmask can be given so that all source
addresses within the mask are assigned to the same firewall.
g. (IOS SLB only) Allow firewall load balancing to begin using the firewall:
(firewall-farm) inservice
By default, the firewall is not used by firewall load balancing unless it is placed
in service. To remove a firewall from service, use no inservice.

Firewall Load-Balancing Example

To perform firewall load balancing, two load-balancing devices are needed: one located
externally and one located internally with respect to the firewall farm. Figure 10-4 shows
a network diagram for this example.
Chapter 10: Server Load Balancing (SLB) 161