Recommended Traffic Manager
The Global and Local Traffic Manager should be a Layer-4 Proxy/Load Balancer. Alternatively, it could also be a DNS Switch.
Layer-4 Proxy/Load Balancer
A Layer-4 proxy/load balancer operates at the transport layer, which means it handles traffic based on IP address and TCP/UDP ports. This type of load balancer is efficient for distributing traffic evenly across servers without inspecting the actual application data.
Examples
HAProxy: A reliable, high-performance TCP/HTTP load balancer.
Nginx: Can be configured to operate as a Layer-4 load balancer.
Configuration Example (HAProxy)
frontend tcp_in
bind *:8443
mode tcp
default_backend esa_servers
backend esa_servers
mode tcp
balance first
server esa1 192.168.1.2:8443 check
server esa2 192.168.1.3:8443 check backup
server esa2 192.168.1.4:8443 check backup
DNS Switch
A DNS switch changes the DNS records to direct traffic to different servers based on predefined rules. It can be used for simple load balancing or failover scenarios.
Examples
- Amazon Route 53: AWS’s scalable DNS and domain name registration service.
Configuration Considerations for DNS Switch
TTL Settings: Keep TTL low for quicker propagation of changes.
Health Checks: Ensure the DNS provider supports health checks and automatic failover.
Geo-routing: Use geographical routing to minimize latency for users.
Ports Eligible for Load Balancer/Proxy with Active and DR Flows
| Port | Service in ESA | Purpose | Active Flow | DR Flow |
|---|---|---|---|---|
| 8443 | Service Dispatcher | For v9.1.0.0 Protectors to download policy from ESA | Protector -> GTM -> LTM-1 -> ESA P1 | Protector -> GTM -> LTM-2 -> ESA S3 |
| 443 | Service Dispatcher | For Web UI | Protector -> GTM -> LTM-1 -> ESA P1 | Protector -> GTM -> LTM-2 -> ESA S3 |
| 25400 | RPP | For v10.0.0 Protectors to download package from ESA | Protector -> GTM -> LTM-1 -> ESA P1 | Protector -> GTM -> LTM-2 -> ESA S3 |
| 9200 | Insight | For protectors to forward logs to Insight in all 3 ESAs directly in the site in round robin fashion without External SIEM | Protector -> GTM -> LTM-1 -> ESA P1,ESA S1, ESA S2 | Protector -> GTM -> LTM-2 -> ESA S3, ESA S4, ESA S5 |
| 24224/24284 | TD-Agent | For protectors to forward logs to TD-Agent in all 3 ESAs in the site in round robin fashion with External SIEM | Protector -> GTM -> LTM-1 -> ESA P1,ESA S1, ESA S2 | Protector -> GTM -> LTM-2 -> ESA S3, ESA S4, ESA S5 |
| 389 | LDAP | For LDAP and REST API Basic Authentication for DSG(s) | Protector -> GTM -> LTM-1 -> ESA P1 | Protector -> GTM -> LTM-2 -> ESA S3 |
Feedback
Was this page helpful?