Constructing high-performance firewall load-balancing clusters: practical experience and novel ideas

Lebin Cheng; Yan-Fa Li; Brian Jemes; Samuel Horowitz

doi:10.1117/12.434426

26 July 2001 Constructing high-performance firewall load-balancing clusters: practical experience and novel ideas

Lebin Cheng, Yan-Fa Li, Brian Jemes, Samuel Horowitz

Proceedings Volume 4527, Technologies, Protocols, and Services for Next-Generation Internet; (2001) https://doi.org/10.1117/12.434426
Event: ITCom 2001: International Symposium on the Convergence of IT and Communications, 2001, Denver, CO, United States

Abstract

Security and performance are probably the top two concerns of web hosting service providers. As available bandwidth of a hosting service is approaching Giga-bits-per-second, low throughput of a single firewall quickly becomes the bottleneck. Constructing a load-balancing cluster of multiple firewall devices seems to be an effective solution. In this paper, we first present a proof-of-concept firewall cluster using web load balancing switches. Our test cluster works; but has major limitations. First, the cluster set-up is too complex to be manageable in a large-scale deployment. Furthermore, the firewall cluster works only in a local area network. It does not work across the wide area network where asymmetric routing is possible. Based on these findings, we propose two novel approaches. The first approach introduces a Firewall Cluster Control Protocol (FCCP) for routers to direct network flows to the appropriate firewall device for processing. FCCP simplifies the implementation of firewall clusters by eliminating the load balancing switch requirement. The second approach, called Stateful Packet Forwarding (SPF), allows firewall devices in a cluster to discover the 'owner' of a network flow when asymmetric routing occurs. SPF can be potentially used in a geographically distributed firewall cluster.

Citation Download Citation

Lebin Cheng, Yan-Fa Li, Brian Jemes, and Samuel Horowitz "Constructing high-performance firewall load-balancing clusters: practical experience and novel ideas", Proc. SPIE 4527, Technologies, Protocols, and Services for Next-Generation Internet, (26 July 2001); https://doi.org/10.1117/12.434426

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available