Types Of Firewall Configurations; Ip Reverse-Sticky For Firewalls; Csm Firewall Configurations - Cisco catalyst 6500 series Configuration Note

Chapter 11 Configuring Firewall Load Balancing
When you configure Layer 3 load balancing to firewalls, use source NAT in the forward direction and
Note
destination NAT in the reverse direction.

Types of Firewall Configurations

The CSM supports these two firewall configuration types:
•
•

IP Reverse-Sticky for Firewalls

The CSM currently supports sticky connections. Sticky connections ensure that two distinct data flows
originating from the same client are load balanced to the same destination.
Load-balanced destinations are often real servers. They may be firewalls, caches, or other networking
devices. Sticky connections are necessary for the proper functioning of load-balanced applications.
These applications utilize multiple connections from the same client to a server. The information
transferred on one connection may affect the processing of information transferred on another
connection.
The IP reverse-sticky feature is configured for balancing new connections from the same client to the
same server, as described in
feature is especially important in the case of buddy connections, such as an FTP data channel or a
streaming UDP data channel.

CSM Firewall Configurations

The CSM can support these firewall configurations:
•
•
•
•
In Figure
the flow from the Internet to the intranet. On the path to the intranet, CSM A balances traffic across
VLANs 5, 6, and 7 through firewalls to CSM B. On the path to the Internet, CSM B balances traffic
across VLANs 15, 16, and 17 through firewalls to CSM A. CSM A uses the VLAN aliases of CSM B in
its server farm, and CSM B uses the VLAN aliases of CSM A in its server farm.
OL-4612-01
Dual-CSM configuration—Firewalls are located between two CSMs. The firewalls accept traffic
from one CSM and send it to a second CSM for load balancing to servers or return to the requesting
device.
Single-CSM configuration—Firewalls accept traffic from a CSM and send it back to the same CSM
for load balancing to servers, or they can return traffic to the requesting device.
"Configuring Reverse-Sticky for Firewalls" section on page
Stealth firewalls for dual CSM configurations
Regular firewalls for dual CSM configurations
Regular firewalls for single CSM configurations
Mixed firewalls (stealth and regular) for dual CSM configurations
11-1, traffic moves through the firewalls and is filtered in both directions. The figure shows
(Figure 11-1)
(Figure 11-2)
(Figure 11-3)
Catalyst 6500 Series Content Switching Module Configuration Note
Understanding How Firewalls Work
11-24. This
(Figure 11-4)
11-3