What is Firewall Load Balancing (FWLB)?
Firewall Load Balancing is a deployment architecture where multiple firewall systems are placed behind Server Load Balancers. Network traffic through the firewall systems is load balanced to the group of firewalls providing a scalable and highly available security infrastructure.
Security firewalls are mission critical for any network infrastructure. A robust security infrastructure requires a reliable, highly-available and scalable firewall infrastructure. Business activities are severely hindered or halted altogether when Internet connectivity fails. Firewall infrastructures are crucial to ensure business continuity.
Best-in-class firewall architectures include some form of load balancing solution. This article will describe a cluster of firewall systems load balanced behind Application Delivery Controller (ADC) network load balancing systems.
Key Takeaways
- Firewall load balancing (FWLB) places multiple firewalls behind server load balancers, distributing network traffic across a group of firewalls for a scalable and highly available security infrastructure
- Firewalls are mission critical and when they fail, business operations can halt entirely, making a reliable and redundant firewall setup essential for business continuity
- The firewall sandwich configuration places a group of firewalls between two load balancing systems, distributing both internet and internal network traffic across the firewall group
- Scalability is a key benefit since firewalls require significant compute resources to inspect every packet and additional firewalls can be added dynamically in a load-balanced set-up without disrupting existing systems
- Reliability and manageability round out the benefits as failed firewalls are replaced automatically without outages, and individual firewalls can be taken offline for updates or policy changes without affecting users
Firewall Load Balancing Solution
An array of firewall systems which are configured in a load balanced configuration are sandwiched between Server Load Balancing systems. Traffic from the Internet is directed to one firewall within a group of firewalls. Traffic from the organization’s internet work is distributed in a similar fashion.
Server Load Balancing systems track network sessions. New network connections are load balanced to the least loaded firewall. Traffic from established sessions are routed to the same firewall to maintain packet inspection and ongoing security analysis.
Firewall Load Balancing with Sonicwall Firewalls
Learn how to implement SSL Deep Packet Inspection (DPI) inside a Firewall Load Balancing (FWLB) sandwich to improve availability, scalability and visibility across the IT infrastructure.
Firewall Load Balancing Benefits
Scalability
Firewalls are required to transfer ever increasing amounts of traffic between insecure networks. Each packet passing through each firewall has to be inspected, analyzed, compared to network control policies and security rules and often modified. Firewall systems are basically computer systems, and the complex processing requires compute resources for CPU, memory and network data transfers. Firewalls have a limit on the amount of network traffic that can be supported.
Adding additional firewall systems is required. In a load balanced configuration, additional firewalls can be added dynamically to increase capacity. Firewall capacity can be added live without affecting the existing firewall systems.
Reliability
Load balancing for application servers is common to provide highly-available application infrastructures. This same technique works for firewall systems. When multiple firewalls are load balanced, any single firewall failure does not cause serious outages. User sessions which were served by the failed firewall are routed to other firewall systems and user sessions are re-established.
Manageability
Firewall maintenance is difficult in non-load balanced environments. Changing security policies on live systems can easily cause unforeseen issues and outages. Systems behind an ADC load balancer can be removed from service without user disruption, and either upgraded, replaced or updated with new security policies. These systems can be tested by operations before returning to an operational state.
Related terms
- Application Delivery Controllers (ADC)
- Application Load Balancing
- Firewall Scale-Out
- Firewall Clusters
Related Resources
- Learn more about A10’s load balancing solutions and application delivery controller products.
FAQs
The three main benefits are scalability (additional firewalls can be added dynamically without disruption), reliability (if one firewall fails, traffic is rerouted to the remaining firewalls without serious outages), and manageability (firewalls can be taken offline for maintenance or policy updates without affecting users).
Firewalls have a limit on how much traffic they can handle, since every packet must be inspected, analyzed, and compared to security policies. As traffic grows, a single firewall can become a bottleneck. Load balancing distributes that traffic across multiple firewalls, allowing capacity to scale dynamically without disruption.
A firewall inspects and filters network traffic based on security rules to protect the network. A load balancer distributes traffic across multiple servers or security devices to ensure availability and performance. In a firewall load balancing setup, both work together, with the load balancer distributing traffic across a group of firewalls.
When multiple firewalls are load balanced, a single firewall failure does not cause a network outage. User sessions that were being handled by the failed firewall are automatically rerouted to the remaining firewalls and re-established, ensuring business continuity without service interruption.
In a non-load-balanced environment, making changes to firewall security policies on live systems can cause unexpected outages. With firewall load balancing, individual firewalls can be removed from service without affecting users, updated or upgraded, tested by operations teams, and then returned to service without any disruption to the network.