Recommended Traffic Manager

The Global and Local Traffic Manager should be a Layer-4 Proxy/Load Balancer. Alternatively, it could also be a DNS Switch.

Layer-4 Proxy/Load Balancer

A Layer-4 proxy/load balancer operates at the transport layer, which means it handles traffic based on IP address and TCP/UDP ports. This type of load balancer is efficient for distributing traffic evenly across servers without inspecting the actual application data.

Examples

HAProxy: A reliable, high-performance TCP/HTTP load balancer.

Nginx: Can be configured to operate as a Layer-4 load balancer.

Configuration Example (HAProxy)

frontend tcp_in
    bind *:8443
    mode tcp
    default_backend esa_servers

backend esa_servers
    mode tcp
    balance first
    server esa1 192.168.1.2:8443 check
    server esa2 192.168.1.3:8443 check backup
    server esa2 192.168.1.4:8443 check backup

DNS Switch

A DNS switch changes the DNS records to direct traffic to different servers based on predefined rules. It can be used for simple load balancing or failover scenarios.

Examples

  • Amazon Route 53: AWS’s scalable DNS and domain name registration service.

Configuration Considerations for DNS Switch

  • TTL Settings: Keep TTL low for quicker propagation of changes.

  • Health Checks: Ensure the DNS provider supports health checks and automatic failover.

  • Geo-routing: Use geographical routing to minimize latency for users.

Ports Eligible for Load Balancer/Proxy with Active and DR Flows

PortService in ESAPurposeActive FlowDR Flow
8443Service DispatcherFor v9.1.0.0 Protectors to download policy from ESAProtector -> GTM -> LTM-1 -> ESA P1Protector -> GTM -> LTM-2 -> ESA S3
443Service DispatcherFor Web UIProtector -> GTM -> LTM-1 -> ESA P1Protector -> GTM -> LTM-2 -> ESA S3
25400RPPFor v10.0.0 Protectors to download package from ESAProtector -> GTM -> LTM-1 -> ESA P1Protector -> GTM -> LTM-2 -> ESA S3
9200InsightFor protectors to forward logs to Insight in all 3 ESAs directly in the site in round robin fashion without External SIEMProtector -> GTM -> LTM-1 -> ESA P1,ESA S1, ESA S2Protector -> GTM -> LTM-2 -> ESA S3, ESA S4, ESA S5
24224/24284TD-AgentFor protectors to forward logs to TD-Agent in all 3 ESAs in the site in round robin fashion with External SIEMProtector -> GTM -> LTM-1 -> ESA P1,ESA S1, ESA S2Protector -> GTM -> LTM-2 -> ESA S3, ESA S4, ESA S5
389LDAPFor LDAP and REST API Basic Authentication for DSG(s)Protector -> GTM -> LTM-1 -> ESA P1Protector -> GTM -> LTM-2 -> ESA S3

Last modified : July 30, 2025