Principle of operation
Client traffic with the server load balancer is processed as follows:
The client connects to the virtual server address. This address belongs to the firewall.
The firewall accepts the connection from the client and realizes that this connection is not addressed to itself, but to a group of servers.
The firewall selects one of the real servers to transfer traffic from the client.
Client traffic is sent to the real server.
Important notes:
Traffic is processed by flows (sessions) - related portions of transmitted information. If the client sent information for the first time, a new session record is created for the selected traffic route. Subsequently, traffic from this client to this virtual server will be sent along the same route until its session expires (if it does not transmit anything for a long time). Expired sessions are deleted.
For HTTP(S) and FTP servers there are additional functions associated with deep analysis of the content of these protocols.
The address of the virtual server must refer specifically to the virtual server. It should not be the address of a real server or other device, and should not be used for static address translation (NAT).
The addresses of real servers must be different from the virtual server address, gateway address and firewall interface address.
Consider an example. The client with the address 192.168.0.10 connects to the server with the address 192.168.200.1. The firewall that this traffic came to chooses a real server with the address 192.168.100.2 to work with this client. It changes the destination address in the packet from the user from 192.168.200.1 to 192.168.100.2 and sends the packet to the real server. When a response is received from the server, the firewall will change the sender's address in it from 192.168.100.2 to 192.168.200.1.
Additional features for HTTP and FTP protocols
When working with an FTP server, several connections are created - to control the transfer and the file transfer itself. It is important that these connections end up on the same server, otherwise errors are possible. To handle such situations, the firewall creates dynamic bindings for FTP servers after passing the first packet from the client. That is, after the client has created the first connection, the firewall can understand that subsequent connections to the same virtual server via FTP (with different port numbers) need to be redirected to the same real server as the first one. The Application Specific Packet Filtering (ASPF) module is used for this in-depth packet analysis. It can influence the choice of routes from clients to the Internet and to balanced servers.
From the HTTP protocol, we can use additional information to select a group of real servers - URL, Referrer, Host and Cookie. These are the HTTP header fields. Moreover, we can do an even more grandiose thing - force the firewall to decrypt HTTPS traffic between the client and the virtual web server, and send HTTP requests to real servers, which will reduce the load on them and allow the firewall to parse HTTP headers.
