Brocade_IP_Primer_eBook

Configuring FWLB
hash table. If a match exists, it will send the connection to the corresponding
firewall. If it does not exist, the ServerIron selects the receiving firewall, and
updates the hash table with the new entry.
Let's take a look at a more detailed example:
MAC: 0001.2345.6701
IP: 123.1.2.1/29
CONSOLE MODEM COMPACT FLASH 1
2
3
4
CONSOLE MODEM COMPACT FLASH 1
2
3
4
TX / RX LINK
TX /RX LINK
TX /RX LINK
TX /RX LINK
TX / RX LINK
TX /RX LINK
TX /RX LINK
TX /RX LINK
HA
Firewall Firewall
10/100
10/100
10/100
10/100
10/100
10/100
10/100
10/100
NetScreen – 204
NetScreen – 204
FW1 FW2
POWER
STATUS-1
ALARM
HA
SESSION
FLASH
IP: 192.168.1.1/29
MAC: 0001.2345.6702
BI
4XG
BI24C
T X RX T X RX T X RX T X RX
BI
4XG
BI24C
T X RX T X RX T X RX T X RX
BI24C
6 12 18 24
30 36 42 48
BI24C
BigIron RX-8
NETWORKS
1 7 13 19
25 31 37 43
BI24C
BI24C
BI
BI24C
4XG
T X RX T X RX T X RX T X RX
BI
BI24C
4XG
T X RX T X RX T X RX T X RX
AC OK DC OK ALM
EJECT SYS AC OK DC OK ALM
EJECT SYS AC OK DC OK ALM
EJECT SYS AC OK DC OK ALM
We've defined FW1 and FW2. We've defined them as members of fw-group 2.
Now, we need to define paths. On SI-Outside, we need to define two paths (one
through FW1 and one through FW2) to get to SI-Inside. Likewise, on SI-Inside,
we need to define two paths (one through FW1 and one through FW2) to get to
SI-Outside. Let's configure:
SLB-SI-Outside#conf t
SLB-SI-Outside(config)#server fw-group 2
SLB-SI-Outside(config-tc-2)#fwall-info 1 3 192.168.1.3
123.1.2.1
SLB-SI-Outside(config-tc-2)#fwall-info 2 7 192.168.1.3
123.1.2.2
The syntax of the “fwall-info” command is:
EJECT SYS
SI-Outside
ServerIron
e3 e7
IP: 123.1.2.3/29
e2
IP: 192.168.1.3/29
SI-Inside
ServerIron
e3 e4
BI
4XG
BI24C
T X RX T X RX T X RX T X RX
BI
4XG
BI24C
T X RX T X RX T X RX T X RX
BI24C
6 12 18 24
30 36 42 48
BI24C
BigIron RX-8
NETWORKS
1 7 13 19
25 31 37 43
BI24C
BI24C
BI
BI24C
4XG
T X RX T X RX T X RX T X RX
BI
BI24C
4XG
T X RX T X RX T X RX T X RX
AC OK DC OK ALM
EJECT SYS AC OK DC OK ALM
EJECT SYS AC OK DC OK ALM
EJECT SYS AC OK DC OK ALM
fwall-info
The first number is the path number. You will start with one, and move consecutively
through (no gaps) the numbers until reaching 32. The next number is
the outgoing interface number. In the first path, the interface facing FW1 is e
3. The interface facing FW2 is e 7 (as noted in the second path). The first IP
address is the IP address of the opposite ServerIron. Since we're on SI-Outside,
we want to reach the IP address of SI-Inside. Finally, we tell it the next
hop IP address to get there. In this example, the first path directs SI-Outside
through interface e 1 to 123.1.2.1 (FW1). The second path directs SI-Outside
through interface e 2 to 123.1.2.2 (FW2).
Brocade IP Primer 377
POWER
STATUS-1
ALARM
SESSION
FLASH
e5
EJECT SYS
MAC: 1234.5678.9A01
IP: 123.1.2.2/29
IP: 192.168.1.2/29
MAC: 1234.5678.9A02