Re: Loadbalancer without using a Firewall...

"Cihan Subasi \(Garanti Teknoloji\)" <[email protected]> Tue, 22 Dec 2009 17:53:12 +0200
Newsgroups gmane.comp.programming.load-balancing.general
Message-ID <792E0DB482E63448902E029F9ABAEE1C044B74880C@TEKMBXV1.fw.garanti.com.tr>
This is a multi-part message in MIME format.

--===============2107531696==
Content-Transfer-Encoding: 7bit
Content-Class: urn:content-classes:message
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_"

This is a multi-part message in MIME format.

--_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_
Content-Type: text/plain;
	charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

Here is my scenario,

IPS ---> LB -----> SW ->>> Servers ---> Firewall ---> DMZs and internet =
(but server has only one NIC)

I do LB SSLoffload and compression and tcp optimization on LB, so all my =
sources addresses (clients) are replaced by the LB ip address before =
reaching the servers, that guarantees that responses go through LB. =
Default gateway fo the servers is a firewall (on same L2 network as the =
LB), and on that firewall I have internet and DMZs (intranet, DB farm =
etc, each on a separate interface of the FW). So all the traffic =
starting from servers go through the firewall and firewall rules...So =
outbound traffic is controlled by FW and inbound to virtual servers (LB) =
is controlled by IPS and LB...

________________________________
From: [email protected] [mailto:[email protected]] On Behalf =
Of Dane Ruyle
Sent: Saturday, December 19, 2009 1:56 AM
To: Load Baalancing
Subject: Re: [load balancing] Loadbalancer without using a Firewall...

I run without a FW infront.  The LB's are only open on the ports you =
configure them for, they ignore everything else.   FW adds some latency =
too (although, that is probably hardly measurable).   If you terminate =
SSL on the LB, that's cool too.   Only port 80 is open to the back-end =
webservers.

Not sure what OS you use but here's what I'd do -

Internet to LB.  LB to switch.  Servers connect to switch.   Servers =
have dedicated NIC for internet traffic (this is also the server's =
default gateway).  Disable Netbios on this NIC, everything but TCP/IP =
and port 80.   Server's second NIC goes to seperate switch.  Assign =
static routes to access back-end servers...  The switch is either locked =
down by ACLs, or in the case of a Financial scenario, the switch should =
uplink to a FW separating the web servers from the back end servers.  =
Wheeee  Switches all over the place.  Then again, for financial maybe I =
would add a FW in front.  Looks better on diagrams and in meeetings =
where they kind of expect you to have one; legacy.   If it came down to =
2 company's - one had a FW in front and the other didn't, I bet the one =
with the FW would win.

Team the NICs, stack the switches if not using a chassis.

Some, if not all of the LBs can scan for malformed incoming traffic and =
drop it too.

That's my 2 cents.



________________________________
From: [email protected]
To: [email protected]
Date: Fri, 18 Dec 2009 16:13:51 +0200
Subject: [load balancing] Loadbalancer without using a Firewall...

Hi all,

I would like to know whether using only "a loadbalancer and an IPS" is =
compliant with audit standards as far as an financial ebank site is =
concerned. I have heard some portal sites use a loadbalancer without =
using a network firewall in front. And this setup is recommended with an =
IPS because a firewall is much more vulnerable to a DOS/DDOS and SYN =
attacks. I would appreciate your opinions about compliancy of this setup =
and pros/cons. Thanks


This message and attachments are confidential and intended solely for =
the individual(s) stated in this
message. If you received this message although you are not the =
addressee, you are responsible to keep the
message confidential. The sender has no responsibility for the accuracy =
or correctness of the
information in the message and its attachments. Our company shall have =
no liability for any changes
or late receiving, loss of integrity and confidentiality, viruses and =
any damages caused in
anyway to your computer system.


Bu mesaj ve ekleri, mesajda gonderildigi belirtilen kisi/kisilere =
ozeldir ve gizlidir. Bu mesajin muhatabi
olmamaniza ragmen tarafiniza ulasmis olmasi halinde mesaj iceriginin =
gizliligi ve bu gizlilik yukumlulugune
uyulmasi zorunlulugu tarafiniz icin de soz konusudur. Mesaj ve eklerinde =
yer alan bilgilerin dogrulugu ve
guncelligi konusunda gonderenin ya da sirketimizin herhangi bir =
sorumlulugu bulunmamaktadir. Sirketimiz
mesajin ve bilgilerinin size degisiklige ugrayarak veya gec =
ulasmasindan, butunlugunun ve gizliliginin
korunamamasindan, virus icermesinden ve bilgisayar sisteminize =
verebilecegi herhangi bir zarardan
sorumlu tutulamaz.


________________________________
Hotmail: Trusted email with powerful SPAM protection. Sign up =
now.<http://clk.atdmt.com/GBL/go/177141665/direct/01/>



--_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<STYLE><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></STYLE>

<META content=3D"MSHTML 6.00.6000.16945" name=3DGENERATOR></HEAD>
<BODY class=3Dhmmessage><!--ppd1000036-->
<DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT =
face=3DArial=20
color=3D#0000ff>Here is my scenario,</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT =
face=3DArial=20
color=3D#0000ff></FONT></SPAN>&nbsp;</DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT =
face=3DArial=20
color=3D#0000ff>IPS ---&gt; LB -----&gt; SW -&gt;&gt;&gt; Servers =
---&gt; Firewall=20
---&gt; DMZs and internet (but server has only one =
NIC)</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT =
face=3DArial=20
color=3D#0000ff></FONT></SPAN>&nbsp;</DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D014174815-22122009><FONT =
face=3DArial=20
color=3D#0000ff>I do LB SSLoffload and compression and tcp optimization =
on LB, so=20
all my sources addresses (clients) are replaced by the LB ip address =
before=20
reaching the servers, that guarantees that responses go through LB. =
Default=20
gateway fo the servers is a firewall (on same L2 network as the LB), and =
on that=20
firewall I have internet and DMZs (intranet, DB farm etc, each on a =
separate=20
interface of the FW). So all the traffic starting from servers go =
through the=20
firewall and firewall rules...So outbound traffic is controlled by FW =
and=20
inbound to virtual servers (LB) is controlled by IPS and=20
LB...</FONT></SPAN></DIV><BR>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft>
<HR tabIndex=3D-1>
<FONT face=3DTahoma><B>From:</B> [email protected]=20
[mailto:[email protected]] <B>On Behalf Of </B>Dane =
Ruyle<BR><B>Sent:</B>=20
Saturday, December 19, 2009 1:56 AM<BR><B>To:</B> Load=20
Baalancing<BR><B>Subject:</B> Re: [load balancing] Loadbalancer without =
using a=20
Firewall...<BR></FONT><BR></DIV>
<DIV></DIV>I run without a FW infront.&nbsp; The LB's are only open on =
the ports=20
you configure them for, they ignore everything&nbsp;else.&nbsp;&nbsp; FW =
adds=20
some latency too (although, that is probably=20
hardly&nbsp;measurable).&nbsp;&nbsp; If you terminate SSL on the LB, =
that's cool=20
too.&nbsp;&nbsp; Only port 80 is open to the back-end=20
webservers.<BR>&nbsp;<BR>Not sure what OS you&nbsp;use but here's what =
I'd do=20
-<BR>&nbsp;<BR>Internet to LB.&nbsp; LB to switch.&nbsp; Servers connect =
to=20
switch.&nbsp;&nbsp; Servers have dedicated NIC for internet traffic =
(this is=20
also the server's default gateway).&nbsp; Disable Netbios on this NIC,=20
everything but TCP/IP&nbsp;and port 80.&nbsp;&nbsp; Server's second=20
NIC&nbsp;goes to seperate switch.&nbsp; Assign static routes to access =
back-end=20
servers...&nbsp; The switch is either locked down by ACLs, or&nbsp;in =
the case=20
of a Financial scenario, the switch should uplink to a FW separating the =
web=20
servers from the back end servers.&nbsp;&nbsp;Wheeee &nbsp;Switches all =
over the=20
place.&nbsp; Then again, for financial maybe I would add a FW in =
front.&nbsp;=20
Looks better on diagrams and in meeetings where they kind of expect you =
to have=20
one; legacy.&nbsp;&nbsp; If it came down to 2 company's - one had a FW =
in front=20
and the other didn't, I bet the one with the FW would =
win.<BR>&nbsp;<BR>Team the=20
NICs, stack the switches if&nbsp;not&nbsp;using a =
chassis.<BR>&nbsp;<BR>Some, if=20
not all of the LBs can scan&nbsp;for&nbsp;malformed incoming traffic and =
drop it=20
too.<BR>&nbsp;<BR>That's my 2 cents. <BR>&nbsp;<BR><BR>&nbsp;<BR>
<HR id=3DstopSpelling>
From: [email protected]<BR>To: [email protected]<BR>Date: Fri, 18 Dec =
2009=20
16:13:51 +0200<BR>Subject: [load balancing] Loadbalancer without using a =

Firewall...<BR><BR>
<DIV><FONT face=3DArial><SPAN class=3Decx112210814-18122009>Hi=20
all,</SPAN></FONT></DIV>
<DIV><FONT face=3DArial><SPAN=20
class=3Decx112210814-18122009></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial><SPAN class=3Decx112210814-18122009>I would like =
to know=20
whether using <STRONG><FONT color=3D#ff0000>only</FONT></STRONG> "a =
loadbalancer=20
and an IPS" is compliant with audit standards as far as an financial =
ebank site=20
is concerned. I have heard some portal sites use a loadbalancer without =
using a=20
network firewall in front. And this setup is recommended with an IPS =
because a=20
firewall is much more vulnerable to a DOS/DDOS and SYN attacks. I would=20
appreciate your opinions about compliancy of this setup and pros/cons.=20
Thanks</SPAN></FONT></DIV><BR>
<TABLE class=3DecxMsoNormalTable cellPadding=3D0 border=3D0>
  <TBODY>
  <TR>
    <TD=20
    style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: 0.75pt; BACKGROUND: =
white; PADDING-BOTTOM: 0.75pt; PADDING-TOP: 0.75pt">
      <P class=3DecxMsoNormal><SPAN style=3D"COLOR: black"><FONT =
face=3DArial=20
      size=3D2>This message and attachments are confidential and =
intended solely=20
      for the individual(s) stated in this<BR>message. If you received =
this=20
      message although you are not the addressee, you are responsible to =
keep=20
      the<BR>message confidential. The sender has no responsibility for =
the=20
      accuracy or correctness of the<BR>information in the message and =
its=20
      attachments. Our company shall have no liability for any =
changes<BR>or=20
      late receiving, loss of integrity and confidentiality, viruses and =
any=20
      damages caused in<BR>anyway to your computer=20
  system.</FONT></SPAN></P></TD></TR></TBODY></TABLE>
<P class=3DecxMsoNormal><SPAN style=3D"DISPLAY: none"><FONT face=3DArial =

size=3D2></FONT></SPAN></P>
<TABLE class=3DecxMsoNormalTable cellPadding=3D0 border=3D0>
  <TBODY>
  <TR>
    <TD=20
    style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: 0.75pt; BACKGROUND: =
white; PADDING-BOTTOM: 0.75pt; PADDING-TOP: 0.75pt">
      <P class=3DecxMsoNormal><FONT face=3DArial><FONT size=3D2><SPAN=20
      style=3D"COLOR: black">Bu mesaj ve ekleri, mesajda gonderildigi =
belirtilen=20
      kisi/kisilere ozeldir ve gizlidir. Bu mesajin =
muhatabi<BR>olmamaniza=20
      ragmen tarafiniza ulasmis olmasi halinde mesaj iceriginin =
gizliligi ve bu=20
      gizlilik yukumlulugune<BR>uyulmasi zorunlulugu tarafiniz icin de =
soz=20
      konusudur. Mesaj ve eklerinde yer alan bilgilerin dogrulugu=20
      ve<BR>guncelligi konusunda gonderenin ya da sirketimizin herhangi =
bir=20
      sorumlulugu bulunmamaktadir. Sirketimiz<BR>mesajin ve bilgilerinin =
size=20
      degisiklige ugrayarak veya gec ulasmasindan, butunlugunun ve=20
      gizliliginin<BR>korunamamasindan, virus icermesinden ve bilgisayar =

      sisteminize verebilecegi herhangi bir zarardan<BR>sorumlu=20
      tutulamaz.</SPAN></FONT></FONT></P></TD></TR></TBODY></TABLE><BR>
<HR>
Hotmail: Trusted email with powerful SPAM protection. <A=20
href=3D"http://clk.atdmt.com/GBL/go/177141665/direct/01/" =
target=3D_new>Sign up=20
now.</A> <BR><TABLE class=3DMsoNormalTable cellPadding=3D0 =
border=3D0><TBODY><TR><TD style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: =
0.75pt; BACKGROUND: white; PADDING-BOTTOM: 0.75pt; PADDING-TOP: =
0.75pt"><P class=3DMsoNormal><SPAN style=3D"COLOR: black"><FONT =
face=3DArial size=3D2>This message and attachments are confidential and =
intended solely for the individual(s) stated in this<BR>message. If you =
received this message although you are not the addressee, you are =
responsible to keep the<BR>message confidential. The sender has no =
responsibility for the accuracy or correctness of the<BR>information in =
the message and its attachments. Our company shall have no liability for =
any changes<BR>or late receiving, loss of integrity and confidentiality, =
viruses and any damages caused in<BR>anyway to your computer =
system.</FONT></SPAN></P></TD></TR></TBODY></TABLE><P =
class=3DMsoNormal><SPAN style=3D"DISPLAY: none"><?xml:namespace prefix =
=3D o /><o:p><FONT face=3DArial size=3D2></FONT></o:p></SPAN></P><TABLE =
class=3DMsoNormalTable cellPadding=3D0 border=3D0><TBODY><TR><TD =
style=3D"PADDING-RIGHT: 0.75pt; PADDING-LEFT: 0.75pt; BACKGROUND: white; =
PADDING-BOTTOM: 0.75pt; PADDING-TOP: 0.75pt"><P class=3DMsoNormal><FONT =
face=3DArial><FONT size=3D2><SPAN style=3D"COLOR: black">Bu mesaj ve =
ekleri, mesajda gonderildigi belirtilen kisi/kisilere ozeldir ve =
gizlidir. Bu mesajin muhatabi<BR>olmamaniza ragmen tarafiniza ulasmis =
olmasi halinde mesaj iceriginin gizliligi ve bu gizlilik =
yukumlulugune<BR>uyulmasi zorunlulugu tarafiniz icin de soz konusudur. =
Mesaj ve eklerinde yer alan bilgilerin dogrulugu ve<BR>guncelligi =
konusunda gonderenin ya da sirketimizin herhangi bir sorumlulugu =
bulunmamaktadir. Sirketimiz<BR>mesajin ve bilgilerinin size degisiklige =
ugrayarak veya gec ulasmasindan, butunlugunun ve =
gizliliginin<BR>korunamamasindan, virus icermesinden ve bilgisayar =
sisteminize verebilecegi herhangi bir zarardan<BR>sorumlu =
tutulamaz.</SPAN><o:p></o:p></FONT></FONT></P></TD></TR></TBODY></TABLE><=
/BODY></HTML>

--_000_792E0DB482E63448902E029F9ABAEE1C044B74880CTEKMBXV1fwgar_--

--===============2107531696==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki

--===============2107531696==--