Re: Loadbalancer without using a Firewall...
"Cihan Subasi \(Garanti Teknoloji\)" <[email protected]> Tue, 22 Dec 2009 17:53:12 +0200
| Newsgroups | gmane.comp.programming.load-balancing.general |
|---|---|
| Message-ID | <792E0DB482E63448902E029F9ABAEE1C044B74880C@TEKMBXV1.fw.garanti.com.tr> |
This is a multi-part message in MIME format. --===============2107531696== Content-Transfer-Encoding: 7bit Content-Class: urn:content-classes:message Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_" This is a multi-part message in MIME format. --_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Here is my scenario, IPS ---> LB -----> SW ->>> Servers ---> Firewall ---> DMZs and internet = (but server has only one NIC) I do LB SSLoffload and compression and tcp optimization on LB, so all my = sources addresses (clients) are replaced by the LB ip address before = reaching the servers, that guarantees that responses go through LB. = Default gateway fo the servers is a firewall (on same L2 network as the = LB), and on that firewall I have internet and DMZs (intranet, DB farm = etc, each on a separate interface of the FW). So all the traffic = starting from servers go through the firewall and firewall rules...So = outbound traffic is controlled by FW and inbound to virtual servers (LB) = is controlled by IPS and LB... ________________________________ From: [email protected] [mailto:[email protected]] On Behalf = Of Dane Ruyle Sent: Saturday, December 19, 2009 1:56 AM To: Load Baalancing Subject: Re: [load balancing] Loadbalancer without using a Firewall... I run without a FW infront. The LB's are only open on the ports you = configure them for, they ignore everything else. FW adds some latency = too (although, that is probably hardly measurable). If you terminate = SSL on the LB, that's cool too. Only port 80 is open to the back-end = webservers. Not sure what OS you use but here's what I'd do - Internet to LB. LB to switch. Servers connect to switch. Servers = have dedicated NIC for internet traffic (this is also the server's = default gateway). Disable Netbios on this NIC, everything but TCP/IP = and port 80. Server's second NIC goes to seperate switch. Assign = static routes to access back-end servers... The switch is either locked = down by ACLs, or in the case of a Financial scenario, the switch should = uplink to a FW separating the web servers from the back end servers. = Wheeee Switches all over the place. Then again, for financial maybe I = would add a FW in front. Looks better on diagrams and in meeetings = where they kind of expect you to have one; legacy. If it came down to = 2 company's - one had a FW in front and the other didn't, I bet the one = with the FW would win. Team the NICs, stack the switches if not using a chassis. Some, if not all of the LBs can scan for malformed incoming traffic and = drop it too. That's my 2 cents. ________________________________ From: [email protected] To: [email protected] Date: Fri, 18 Dec 2009 16:13:51 +0200 Subject: [load balancing] Loadbalancer without using a Firewall... Hi all, I would like to know whether using only "a loadbalancer and an IPS" is = compliant with audit standards as far as an financial ebank site is = concerned. I have heard some portal sites use a loadbalancer without = using a network firewall in front. And this setup is recommended with an = IPS because a firewall is much more vulnerable to a DOS/DDOS and SYN = attacks. I would appreciate your opinions about compliancy of this setup = and pros/cons. Thanks This message and attachments are confidential and intended solely for = the individual(s) stated in this message. If you received this message although you are not the = addressee, you are responsible to keep the message confidential. The sender has no responsibility for the accuracy = or correctness of the information in the message and its attachments. Our company shall have = no liability for any changes or late receiving, loss of integrity and confidentiality, viruses and = any damages caused in anyway to your computer system. Bu mesaj ve ekleri, mesajda gonderildigi belirtilen kisi/kisilere = ozeldir ve gizlidir. Bu mesajin muhatabi olmamaniza ragmen tarafiniza ulasmis olmasi halinde mesaj iceriginin = gizliligi ve bu gizlilik yukumlulugune uyulmasi zorunlulugu tarafiniz icin de soz konusudur. Mesaj ve eklerinde = yer alan bilgilerin dogrulugu ve guncelligi konusunda gonderenin ya da sirketimizin herhangi bir = sorumlulugu bulunmamaktadir. Sirketimiz mesajin ve bilgilerinin size degisiklige ugrayarak veya gec = ulasmasindan, butunlugunun ve gizliliginin korunamamasindan, virus icermesinden ve bilgisayar sisteminize = verebilecegi herhangi bir zarardan sorumlu tutulamaz. ________________________________ Hotmail: Trusted email with powerful SPAM protection. Sign up = now.<http://clk.atdmt.com/GBL/go/177141665/direct/01/> --_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <STYLE><!-- .hmmessage P { margin:0px; padding:0px } body.hmmessage { font-size: 10pt; font-family:Verdana } --></STYLE> <META content=3D"MSHTML 6.00.6000.16945" name=3DGENERATOR></HEAD> <BODY class=3Dhmmessage><!--ppd1000036--> <DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT = face=3DArial=20 color=3D#0000ff>Here is my scenario,</FONT></SPAN></DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT = face=3DArial=20 color=3D#0000ff></FONT></SPAN> </DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT = face=3DArial=20 color=3D#0000ff>IPS ---> LB -----> SW ->>> Servers = ---> Firewall=20 ---> DMZs and internet (but server has only one = NIC)</FONT></SPAN></DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT = face=3DArial=20 color=3D#0000ff></FONT></SPAN> </DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT = face=3DArial=20 color=3D#0000ff>I do LB SSLoffload and compression and tcp optimization = on LB, so=20 all my sources addresses (clients) are replaced by the LB ip address = before=20 reaching the servers, that guarantees that responses go through LB. = Default=20 gateway fo the servers is a firewall (on same L2 network as the LB), and = on that=20 firewall I have internet and DMZs (intranet, DB farm etc, each on a = separate=20 interface of the FW). So all the traffic starting from servers go = through the=20 firewall and firewall rules...So outbound traffic is controlled by FW = and=20 inbound to virtual servers (LB) is controlled by IPS and=20 LB...</FONT></SPAN></DIV><BR> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft> <HR tabIndex=3D-1> <FONT face=3DTahoma><B>From:</B> [email protected]=20 [mailto:[email protected]] <B>On Behalf Of </B>Dane = Ruyle<BR><B>Sent:</B>=20 Saturday, December 19, 2009 1:56 AM<BR><B>To:</B> Load=20 Baalancing<BR><B>Subject:</B> Re: [load balancing] Loadbalancer without = using a=20 Firewall...<BR></FONT><BR></DIV> <DIV></DIV>I run without a FW infront. The LB's are only open on = the ports=20 you configure them for, they ignore everything else. FW = adds=20 some latency too (although, that is probably=20 hardly measurable). If you terminate SSL on the LB, = that's cool=20 too. Only port 80 is open to the back-end=20 webservers.<BR> <BR>Not sure what OS you use but here's what = I'd do=20 -<BR> <BR>Internet to LB. LB to switch. Servers connect = to=20 switch. Servers have dedicated NIC for internet traffic = (this is=20 also the server's default gateway). Disable Netbios on this NIC,=20 everything but TCP/IP and port 80. Server's second=20 NIC goes to seperate switch. Assign static routes to access = back-end=20 servers... The switch is either locked down by ACLs, or in = the case=20 of a Financial scenario, the switch should uplink to a FW separating the = web=20 servers from the back end servers. Wheeee Switches all = over the=20 place. Then again, for financial maybe I would add a FW in = front. =20 Looks better on diagrams and in meeetings where they kind of expect you = to have=20 one; legacy. If it came down to 2 company's - one had a FW = in front=20 and the other didn't, I bet the one with the FW would = win.<BR> <BR>Team the=20 NICs, stack the switches if not using a = chassis.<BR> <BR>Some, if=20 not all of the LBs can scan for malformed incoming traffic and = drop it=20 too.<BR> <BR>That's my 2 cents. <BR> <BR><BR> <BR> <HR id=3DstopSpelling> From: [email protected]<BR>To: [email protected]<BR>Date: Fri, 18 Dec = 2009=20 16:13:51 +0200<BR>Subject: [load balancing] Loadbalancer without using a = Firewall...<BR><BR> <DIV><FONT face=3DArial><SPAN class=3Decx112210814-18122009>Hi=20 all,</SPAN></FONT></DIV> <DIV><FONT face=3DArial><SPAN=20 class=3Decx112210814-18122009></SPAN></FONT> </DIV> <DIV><FONT face=3DArial><SPAN class=3Decx112210814-18122009>I would like = to know=20 whether using <STRONG><FONT color=3D#ff0000>only</FONT></STRONG> "a = loadbalancer=20 and an IPS" is compliant with audit standards as far as an financial = ebank site=20 is concerned. I have heard some portal sites use a loadbalancer without = using a=20 network firewall in front. And this setup is recommended with an IPS = because a=20 firewall is much more vulnerable to a DOS/DDOS and SYN attacks. I would=20 appreciate your opinions about compliancy of this setup and pros/cons.=20 Thanks</SPAN></FONT></DIV><BR> <TABLE class=3DecxMsoNormalTable cellPadding=3D0 border=3D0> <TBODY> <TR> <TD=20 style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: 0.75pt; BACKGROUND: = white; PADDING-BOTTOM: 0.75pt; PADDING-TOP: 0.75pt"> <P class=3DecxMsoNormal><SPAN style=3D"COLOR: black"><FONT = face=3DArial=20 size=3D2>This message and attachments are confidential and = intended solely=20 for the individual(s) stated in this<BR>message. If you received = this=20 message although you are not the addressee, you are responsible to = keep=20 the<BR>message confidential. The sender has no responsibility for = the=20 accuracy or correctness of the<BR>information in the message and = its=20 attachments. Our company shall have no liability for any = changes<BR>or=20 late receiving, loss of integrity and confidentiality, viruses and = any=20 damages caused in<BR>anyway to your computer=20 system.</FONT></SPAN></P></TD></TR></TBODY></TABLE> <P class=3DecxMsoNormal><SPAN style=3D"DISPLAY: none"><FONT face=3DArial = size=3D2></FONT></SPAN></P> <TABLE class=3DecxMsoNormalTable cellPadding=3D0 border=3D0> <TBODY> <TR> <TD=20 style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: 0.75pt; BACKGROUND: = white; PADDING-BOTTOM: 0.75pt; PADDING-TOP: 0.75pt"> <P class=3DecxMsoNormal><FONT face=3DArial><FONT size=3D2><SPAN=20 style=3D"COLOR: black">Bu mesaj ve ekleri, mesajda gonderildigi = belirtilen=20 kisi/kisilere ozeldir ve gizlidir. Bu mesajin = muhatabi<BR>olmamaniza=20 ragmen tarafiniza ulasmis olmasi halinde mesaj iceriginin = gizliligi ve bu=20 gizlilik yukumlulugune<BR>uyulmasi zorunlulugu tarafiniz icin de = soz=20 konusudur. Mesaj ve eklerinde yer alan bilgilerin dogrulugu=20 ve<BR>guncelligi konusunda gonderenin ya da sirketimizin herhangi = bir=20 sorumlulugu bulunmamaktadir. Sirketimiz<BR>mesajin ve bilgilerinin = size=20 degisiklige ugrayarak veya gec ulasmasindan, butunlugunun ve=20 gizliliginin<BR>korunamamasindan, virus icermesinden ve bilgisayar = sisteminize verebilecegi herhangi bir zarardan<BR>sorumlu=20 tutulamaz.</SPAN></FONT></FONT></P></TD></TR></TBODY></TABLE><BR> <HR> Hotmail: Trusted email with powerful SPAM protection. <A=20 href=3D"http://clk.atdmt.com/GBL/go/177141665/direct/01/" = target=3D_new>Sign up=20 now.</A> <BR><TABLE class=3DMsoNormalTable cellPadding=3D0 = border=3D0><TBODY><TR><TD style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: = 0.75pt; BACKGROUND: white; PADDING-BOTTOM: 0.75pt; PADDING-TOP: = 0.75pt"><P class=3DMsoNormal><SPAN style=3D"COLOR: black"><FONT = face=3DArial size=3D2>This message and attachments are confidential and = intended solely for the individual(s) stated in this<BR>message. If you = received this message although you are not the addressee, you are = responsible to keep the<BR>message confidential. The sender has no = responsibility for the accuracy or correctness of the<BR>information in = the message and its attachments. Our company shall have no liability for = any changes<BR>or late receiving, loss of integrity and confidentiality, = viruses and any damages caused in<BR>anyway to your computer = system.</FONT></SPAN></P></TD></TR></TBODY></TABLE><P = class=3DMsoNormal><SPAN style=3D"DISPLAY: none"><?xml:namespace prefix = =3D o /><o:p><FONT face=3DArial size=3D2></FONT></o:p></SPAN></P><TABLE = class=3DMsoNormalTable cellPadding=3D0 border=3D0><TBODY><TR><TD = style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: 0.75pt; BACKGROUND: white; = PADDING-BOTTOM: 0.75pt; PADDING-TOP: 0.75pt"><P class=3DMsoNormal><FONT = face=3DArial><FONT size=3D2><SPAN style=3D"COLOR: black">Bu mesaj ve = ekleri, mesajda gonderildigi belirtilen kisi/kisilere ozeldir ve = gizlidir. Bu mesajin muhatabi<BR>olmamaniza ragmen tarafiniza ulasmis = olmasi halinde mesaj iceriginin gizliligi ve bu gizlilik = yukumlulugune<BR>uyulmasi zorunlulugu tarafiniz icin de soz konusudur. = Mesaj ve eklerinde yer alan bilgilerin dogrulugu ve<BR>guncelligi = konusunda gonderenin ya da sirketimizin herhangi bir sorumlulugu = bulunmamaktadir. Sirketimiz<BR>mesajin ve bilgilerinin size degisiklige = ugrayarak veya gec ulasmasindan, butunlugunun ve = gizliliginin<BR>korunamamasindan, virus icermesinden ve bilgisayar = sisteminize verebilecegi herhangi bir zarardan<BR>sorumlu = tutulamaz.</SPAN><o:p></o:p></FONT></FONT></P></TD></TR></TBODY></TABLE><= /BODY></HTML> --_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_-- --===============2107531696== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ lb-l mailing list [email protected] http://vegan.net/mailman/listinfo/lb-l Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki --===============2107531696==--