Perfect Load Balancing
As the network expands, enterprises may deploy multiple links at the network egress to share traffic. The increasing volume of network services places great pressure on enterprise servers, with a single server unable to meet access requirements. Ideally, this single server will be expanded into multiple servers to process the growing traffic. But how do these links or servers collaborate to share the traffic? To address this issue, firewalls provide inbound and outbound load balancing functions.
1. Outbound load balancing
When multiple links are deployed on an enterprise network egress, outgoing traffic is evenly distributed among these links in most cases. This method improves network stability and reliability but may not meet the following requirements:
- • Traffic destined for a specific ISP network must be forwarded through the outgoing interface connected to the ISP network.
- • Traffic from the enterprise network must be evenly distributed to ISP networks through their respective links to avoid congestion when a service is deployed on multiple ISP networks.
- • User traffic destined for a server on the Internet must be forwarded through the path with the smallest delay; high-speed links must forward additional traffic whereas low-speed links can be properly utilized without congestion.
Firewalls support outbound load balancing functions, such as ISP link selection, transparent DNS, and intelligent traffic steering, easily satisfying the above requirements and applying to a variety of multi-link load balancing scenarios.
Figure 12.24 shows outbound load balancing.
1. ISP link selection
When an enterprise network has links to multiple ISP networks, it is possible to add the network address of each ISP to a specific ISP address file, import the file to a firewall, and specify parameters such as the next hop or outbound interface for the file to generate static routes to the ISP networks in batches. User traffic is then forwarded to the corresponding
FIGURE 12.24 Outbound load balancing.
ISP network based on a matching static route. This mechanism ensures that traffic destined for a specific ISP network is forwarded through the corresponding outgoing interface without being diverted to other ISP networks.
2. Transparent DNS
After transparent DNS has been configured, a firewall changes the destination addresses of DNS requests and sends them to DNS servers on different ISP networks based on weights (in percentage). This approach balances the Internet traffic of intranet users between the ISP links to avoid congestion and improve user experience.
3. Intelligent traffic steering
Intelligent traffic steering detects the delay of the links to a remote host and then selects the optimal link with the shortest delay in order to rapidly forward services. A route weight and bandwidth threshold can be manually set for each link based on performance, enabling service traffic to be forwarded through different links as planned.
2. Inbound load balancing
In Figure 12.25, traffic from external users to multiple servers on the intranet is evenly balanced through inbound load balancing. This ensures that traffic is evenly distributed to each server, preventing one from being fully loaded while others are idle. The firewall supports server load balancing and smart DNS.
1. Server load balancing
Server load balancing enables multiple servers to process services that have been arranged for a single server, increasing service processing efficiency and capability. A server cluster is formed which externally acts as a single logical server, with the
firewall allocating traffic to the individual servers. If a server is faulty, the firewall will no longer allocate traffic to it, and if the capacity of the server cluster is insufficient, additional servers will need to be added. These internal changes are transparent to users, facilitating network O&M and future adjustment.
Server load balancing ensures that traffic can be evenly distributed to servers. The firewall can adjust traffic allocation algorithms based on service types, meeting specific service requirements and improving service quality and efficiency. The following algorithms are available:
- - Round robin: Client service traffic is allocated to each server in turn.
- - Weighted round robin: Client service traffic is allocated to servers based on weights.
- - Least connection: Client service traffic is allocated to the server with the least number of concurrent connections.
- - Weighted least connection: Client service traffic is allocated to the server with the least number of concurrent weighted connections.
- - Sticky session: All client service traffic is allocated to the same server using the source IP address-based hash algorithm.
- - Weighted sticky session: All client service traffic is allocated to the same server, and more service traffic is allocated to servers with a higher weight.
- 2. Smart DNS
When an enterprise network has a DNS server deployed, smart DNS enables a firewall to intelligently send the IP address of the outgoing interface connected to the ISP network that serves the requesting user. The user initiates access data traffic to this address, so that the user traffic is directly forwarded to a specific web server dedicated to the ISP network where the user resides. This mechanism prevents traffic diversion, reduces web access delay, and improves service experience.
