Load Balancer Smart Routing for Firewall Connection Stickiness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewall clustering systems struggle with load balancing for complex connections, such as FTP or voice over IP, where control and data are on different connections, leading to different firewalls processing different packets of the same connection, which is not effectively managed by current load balancing systems.
Innovation Solution
A system and method for smart load balancing that involves a load balancer connected to a cluster of security network components, where control information is used to direct packets of complex connections, maintaining connection stickiness by identifying and routing packets through the same security network component, even for encrypted sessions, and includes a protocol to manage new connections and multicast packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional load balancing methods are used for complex connections, then load distribution is achieved, but connection stickiness is lost and different firewalls process different packets of the same connection
Solution Approach 1:
The system performs preliminary actions by establishing control connections before data connections are created. The load balancer proactively manages control connections to coordinate packet routing before the actual data traffic begins, ensuring that all packets of a complex connection are directed to the same firewall node. This preliminary coordination resolves the contradiction by preventing connection stickiness loss before it occurs.
Solution Approach 2:
The control connection acts as an intermediary mechanism between the load balancer and firewall nodes. Through control connections, the load balancer exchanges coordination information with firewalls to manage complex connections. This intermediary layer enables the load balancer to maintain connection stickiness while distributing load, as the control connection mediates the routing decisions for subsequent data packets.
2Reliability
If all firewall nodes filter all arriving data packets, then comprehensive security inspection is achieved, but processing efficiency decreases due to unnecessary packet processing
Solution Approach 1:
The system applies local quality by assigning specific packets to specific firewall nodes based on connection characteristics. Instead of all nodes processing all packets uniformly, the load balancer uses control connection information to determine which firewall node should handle which packets. This creates non-uniform distribution where each node processes only the packets it is responsible for, improving efficiency while maintaining security inspection completeness through targeted processing.
3Productivity
If hash-based load balancing is used, then simple connections are handled efficiently, but complex connections with control and data on different connections cannot maintain connection stickiness
Solution Approach 1:
The system transitions from static hash-based load balancing to dynamic control-connection-based load balancing. Instead of using fixed hash functions that work well for simple connections, the system dynamically manages control connections to coordinate packet routing for complex connections. This dynamic approach adapts to different connection types, maintaining the efficiency of simple connections while enabling proper handling of complex connections with control and data on separate connections.
Data Source
AI summary
A system and method for protecting data communications in a system including a load-balancer connected to a cluster of security network components, e.g. firewall node. The load-balancer transfers one or more of the data streams respectively to the security components. The security network components transmit control information to the load-balancer and the control information includes an instruction regarding balancing load of the data streams between said security network components; The load-balancer balances load based on the control information. Preferably, network address translation is performed by the load-balancer based on the control information or network address translation is performed by the security network component and the control information includes information regarding an expected connection based on the network address translation. Preferably, when the data communications includes an encrypted session, an encrypted connection of the encrypted session is identified based on the control information and the balancing of the load maintains stickiness of said encrypted connection.