Server load balancing requires Fireware XTM with a Pro upgrade, and is not supported on Firebox T10, XTM 2 Series, and XTM 3 Series devices.
The server load balancing feature in Fireware XTM is designed to help you increase the scalability and performance of a high-traffic network with multiple servers. With server load balancing, you can enable the XTM device to control the number of sessions initiated to as many as 10 servers for each firewall policy you configure. The XTM device controls the load based on the number of sessions in use on each server. The XTM device does not measure or compare the bandwidth that is used by each server.
You configure server load balancing as an SNAT action. The XTM device can balance connections among your servers with two different algorithms. When you configure server load balancing, you must choose the algorithm for the XTM device to apply.
If you select this option, the XTM device distributes incoming sessions among the servers you specify in the policy in round-robin order. The first connection is sent to the first server specified in your policy. The next connection is sent to the next server in your policy, and so on.
If you select this option, the XTM device sends each new session to the server in the list that currently has the lowest number of open connections to the device. The XTM device cannot tell how many connections the server has open on other interfaces.
You can add any number of servers to a server load balancing action. You can also add a weight to each server to make sure that your most powerful servers are given the heaviest load. The weight refers to the proportion of load that the XTM device sends to a server. By default, each server has a weight of 1. If you assign a weight of 2 to a server, you double the number of sessions that the XTM device sends to that server, compared to a server with a weight of 1.
You can optionally configure a source IP address in a server load balancing action. If you do not configure a source IP address in the server load balancing action, the XTM device does not modify the sender, or source IP address, of traffic sent to these devices. While the traffic is sent directly from the XTM device, each device that is part of your server load balancing configuration sees the original source IP address of the network traffic.
When you configure server load balancing, it is important to know:
Before you can configure a policy to use server load balancing, you must define the server load balancing details in an SNAT action. After you define a server load balancing SNAT action, you can use it in one or more policies.
When you add a server load balancing SNAT action, you can choose to specify a source IP address in the action. Then, when traffic that matches the parameters in your server load balancing SNAT action passes through the policies that manage the traffic on your XTM device, the source IP address is changed to the IP address that you specify. The same source IP address is used for all servers in the server load balancing action.
You can also enable port address translation (PAT) in a server load balancing SNAT action. When you enable PAT, you can change the packet destination to specify a different internal host and a different port.
When you define the parameters for the SNAT action, sticky connections are always enabled. A sticky connection is a connection that continues to use the same server for a defined period of time. Stickiness makes sure that all packets between a source and destination IP address pair are sent to the same server for the time period you specify. By default, the XTM device uses the default sticky connection setting of 8 hours. You can change the setting to a different number of hours. When a new connection from the same client is received, the expiration time of the connection is extended.
To add a server load balancing SNAT action:
For example, you can have the XTM device apply server load balancing for this action to packets received on only one external IP address. Or, you can have the XTM device apply server load balancing for packets received on any external IP address if you select the Any-External alias.
If you use a server load balancing SNAT action in a policy that allows traffic that does not have ports (traffic other than TCP or UDP), the internal port setting is not used for that traffic.
To edit an SNAT action:
To remove an SNAT action:
Configure Static NAT