firewall sandwich load balancing (fwd)

[Joseph Mack NA3T]

On Fri, 7 Jul 2006, David Lang wrote:

> the firewalls are transparent, they are just packet filters (think iptables 
> firewalls). there is no NAT takeing place anywhere.
>
> the issue I don't think you are understanding is that we aren't trying to 
> load balance the servers behind the firewalls, we are trying to load balance 
> the firewalls themselves

I understood that this was what you were trying to do, but 
the setup didn't make any sense to me.

>
> so you have
>
>        Internet
>  |                    |
> switch--------------switch
>  |                    |
> load balancer      load balancer
>  |                    |
> switch--------------switch
>  |                    |
> firewall            firewall
>  |                    |
> switch--------------switch
>  |                    |
> load balancer      load balancer
>  |                    |
> switch--------------switch
>  | | | | | | | | | | |
>          servers
>

got it.

> the servers themselves are NOT load balanced (at least for the purposes of 
> these discussions, any load balanceing that they have is done by seperate 
> equipment)

got it

> the outside load balancers need to make a decision on which firewall to send 
> the traffic through

how do they do that?

> the packets are sent through that firewall, and then go to the load balancer 
> on the inside which routes them to the server, the server responds and the 
> outbound traffic hits the inside load balancer, it needs to send the response 
> packets back to the same firewall that the inbound packets came through or 
> the firewall will reject them
>
> does this clarify things?

yes

> I had thought that the origional post that I refrenced described the problem 
> fairly well which is why I didn't go through everything again in my post.

ah well we've got it worked out now.

Here's my take on what you've got.

            A
           / \
         FW1 FW2
           \ /
            B

Machinew A and B want to talk. They can talk through either 
of two routes, both of which contain firewalls. The packets 
of interest are allowed through the firewalls. As far as A 
and B are concerned the firewalls aren't there. The rules of 
IP routing are such that any packet between A and B can pick 
either route. You want packets between A and B to choose a 
route dependant on the route chosen by previously 
transmitted packets.

I assume you want to do this to keep the firewalls happy. 
Presumably they're unhappy if they don't see matching 
packets. If this is what's happening, presumably you know 
what to do from here. Here's what I see.

o firewalls are designed to operate in a spot where all 
traffic goes through them. They can then do their accounting
etc. Firewalls are not designed (at least yet) to cooperate.
They need to be fast, they can't be talking to other
firewalls to make decisions on what to do with a packet.

o your design is being wagged by the tail of the firewall. 
The firewall is supposed to help you. Your firewall
doesn't work in the current setup. You could get one
that does, presumably by turning off stateful matching.

o you could rewrite IP routing.

Joe
-- 
Joseph Mack NA3T EME(B,D), FM05lw North Carolina
jmack (at) wm7d (dot) net - azimuthal equidistant map
generator at http://www.wm7d.net/azproj.shtml 
Homepage http://www.austintek.com/ It's GNU/Linux!