WHITE PAPER. Static Load Balancers Implemented with Filters

Transcription

1 WHITE PAPER Static Load Balancers Implemented with Filters Rev. A, July 2014

2 2

3 Table of Contents Load Balancing of Monitoring Systems as a Key Strategy for Availability, Security and Compliance... 4 Where Load Balancing Fits In... 4 Net Optics solutions support both static and dynamic load balancing... 4 Basic Static Load Balancing... 5 Static Load Balancers Implemented with Filters... 5 Flow Coherency... 5 Summary

4 Load Balancing of Monitoring Systems as a Key Strategy for Availability, Security and Compliance In monitoring network traffic, the purpose of load balancing is to distribute traffic among a number of monitoring tools. This avoids overburdening and allows processing of more traffic than a single tool would support. In some cases, load balancing enables the expansion of network capacity at lower cost through more efficient use of existing monitoring tools. In light of increasing traffic loads, load balancing solutions have become critical to security and compliance monitoring. Today s organizations depend upon these intrusion-prevention systems (IPSs), data-loss prevention probes, next-generation firewalls and other monitoring resources to protect vital assets. Bypass-on-failure is no longer an acceptable approach. Rather, enterprises require N+M tool redundancy, link-fault detection, and fullyredundant systems; higher CAPEX is more than justified by the severe risks incurred by losing coverage for hours or even minutes. The main purpose of monitoring tools is protection, and overprovisioning can leave the network defenseless. Where Load Balancing Fits In Imagine the dramatic consequences of a traffic deluge overwhelming some portion of a network s monitoring tools and triggering slowdowns or failures. The main purpose of monitoring tools is protection, and overprovisioning can leave the network defenseless. Fortunately, the growing sophistication of Load Balancers allows them to sense and relieve overloaded monitoring tools by distributing traffic in a number of ways to even out the flow and support full functioning of the instrumentation layer. Multiple replicated tools, working in parallel, enable you to increase the throughput of your security and performance monitoring without incurring the CAPEX, integration costs, and learning curve of new, unfamiliar tools. Net Optics offers comprehensive load balancing functionality across multiple product lines, encompassing solutions for all topologies, including: Out-of-band including traffic recorders and intrusion detection systems (IDS) Inline such as IPSs and next-generation firewalls Tool sharing with traffic distributed among multiple independent links in a loadbalanced pool of inline tools Net Optics solutions support both static and dynamic load balancing Static load balancing refers to those load balancing algorithms that distribute traffic based strictly on a fixed set of rules relating to characteristics of the input traffic. Static load balancing does not feed back information about which tools are receiving more or less traffic in order to ensure that the balance is even as does dynamic load balancing. Rather, static load balancing algorithms the specific packet characteristics used to distribute the traffic are chosen to generate a random distribution of flows in order to produce a balance that is even on average. The Net Optics Director family of smart filtering appliances supports static load balancing. Director Pro Director xstream Pro and xbalancer support both static and dynamic load balancing. 4

5 Director Data Monitoring Switch is a smart filtering appliance that directs traffic of interest to monitoring, security and compliance tools. Director s static load balancing capability takes traffic from any network port or aggregated set of network ports and distributes it among anywhere from two to ten monitor ports. The load can be balanced by IP address, port, protocol, VLAN, and MAC address, or by any other packet header field or its combination. Director Pro Network Controller Switch is a smart filtering and load-balancing appliance built on Director switch architecture and offering the industry s highest port density. Each port on Director Pro can filter traffic independently of all other ports. As traffic enters the port, it can filter packets by Layer 2, Layer 3 or Layer 4 characteristics. Using a sophisticated DPI engine, it can also use Layer 7 data for load balancing by payload and policy keywords. Combining this capability and its high port density with load balancing and filtering results in unparalleled control of your monitoring traffic. Director xstream Data Monitoring Switch supports static load balancing that takes traffic from any network port or aggregated set of network ports and distributes it to two, three, four, or any number of available monitor ports. The load can be balanced by IP address, port, protocol, VLAN, and MAC address, or any other packet header field. Director xstream Pro Network Controller Switch also supports dynamic load balancing and filtering to maximize performance. xbalancer Load Balancer is a purpose-built hardware solution designed to share network monitoring devices across multiple links and solve oversubscription for 10G networks. Basic Static Load Balancing Static load balancing provides a very cost-effective method of sharing a load among multiple tools. Static load balancing provides a very cost-effective method of sharing a load among multiple tools. A very simple two-way static load balancer (load balancing to two tools) could use the rule, Send all packets with even-numbered IP source addresses to tool 1 and all packets with odd-numbered IP source addresses to tool 2. Static Load Balancers Implemented with Filters This load balancing algorithm can be extended to support more tools by examining more address bits. Net Optics implementation of static load balancing with filters provides high levels of flexibility to define different balancing criteria, and the load balancer can be configured in a near-infinite variety of ways to match the requirements of any application. When a user is actually setting up filters to implement static load balancers, algorithms may be extended to more complex cases Flow Coherency Static load balancing can be flow coherent ensuring that complete two-way conversations are directed to the same monitoring tool for flows defined by source/ destination IP address pairs, VLANs, or other header fields. Many monitoring load balancing applications are required to keep each flow of traffic together on a single tool. For example, in a call center VoIP call recording application, it is desirable to keep the entire telephone call, including both directions of traffic, confined to a single traffic recorder to avoid the necessity of piecing together segments from several recorders in order to play back a call. Flow coherency accomplishes that purpose. 5

6 Summary Net Optics static load balancing is a scalable, flexible approach that offers many options for achieving the right load balancing fit for your network. This application note has provided an overview of how load balancers can support the security and efficiency of your network. Our engineers are happy to work with you to develop static load balancers and other load balancing solutions to keep your monitoring infrastructure up to speed with your latest network upgrades. 6

7 7

8 WHITE PAPER Ixia Worldwide Headquarters Agoura Rd. Calabasas, CA (Toll Free North America) (Outside North America) (Fax) Ixia European Headquarters Ixia Technologies Europe Ltd Clarion House, Norreys Drive Maidenhead SL6 4FL United Kingdom Sales (Fax) Ixia Asia Pacific Headquarters 21 Serangoon North Avenue 5 #04-01 Singapore Sales Fax Rev. A, July 2014