When you can no longer upgrade to a higher capacity firewall, or add additional Service Processing Cards (SPC), the only other choice is to scale horizontally. Here’s a proof of concept for doing just that.
The traditional approach of putting dedicated firewalls within a given physical location in order to provide security services is indeed capable of scaling, but it comes at a cost. Furthermore, within large-scale data center networks, the traditional approach to securing data using firewall clusters isn’t often suitable because the data has grown to proportions that no single firewall cluster is capable of handling.
Day One: Scaling Beyond a Single Juniper SRX in the Data Center elegantly addresses the problem and provides unique insight into how to provide security to outbound traffic at levels that can scale to meet the needs of even the largest networks. Follow along with this proof of concept and get the configuration for doing so at the end.
“Scaling network security infrastructure can be a very challenging endeavor. This book cites potential solutions to these challenges and offers an elegant architecture, one that allows large scale and to add capacity rapidly with minimal effort.” Daniel Sullivan, Senior Security Engineer, Zynga
IT’S DAY ONE AND YOU HAVE A JOB TO DO, SO LEARN HOW TO:
• Understand the concept of scaling traffic beyond a single Juniper SRX firewall.
• Articulate the difference between ECMP and Filter-based Forwarding (FBF).
• Understand the use cases that drive the requirements for ECMP or FBF.
• Perform per-flow load balancing in the master instance while preserving the per-prefix load balancing within routing instances.
• Configure static routes and qualified next-hops that use BFD for liveness detection.
• Understand how hash calculations in the Forwarding Information Base (FIB) can impact your network.
About the Author: Douglas Richard Hanks Jr. is a Senior Systems Engineer with Juniper Networks. He is certified in Juniper Networks as JNCIE-ENT #213 and JNCIE-SP #875. Douglas’ interests are network engineering and architecture for both Enterprise and Service Provider routing and switching.
Juniper Networks Books are singularly focused on network productivity and efficiency.
The traditional approach of putting dedicated firewalls within a given physical location in order to provide security services is indeed capable of scaling, but it comes at a cost. Furthermore, within large-scale data center networks, the traditional approach to securing data using firewall clusters isn’t often suitable because the data has grown to proportions that no single firewall cluster is capable of handling.
Day One: Scaling Beyond a Single Juniper SRX in the Data Center elegantly addresses the problem and provides unique insight into how to provide security to outbound traffic at levels that can scale to meet the needs of even the largest networks. Follow along with this proof of concept and get the configuration for doing so at the end.
“Scaling network security infrastructure can be a very challenging endeavor. This book cites potential solutions to these challenges and offers an elegant architecture, one that allows large scale and to add capacity rapidly with minimal effort.” Daniel Sullivan, Senior Security Engineer, Zynga
IT’S DAY ONE AND YOU HAVE A JOB TO DO, SO LEARN HOW TO:
• Understand the concept of scaling traffic beyond a single Juniper SRX firewall.
• Articulate the difference between ECMP and Filter-based Forwarding (FBF).
• Understand the use cases that drive the requirements for ECMP or FBF.
• Perform per-flow load balancing in the master instance while preserving the per-prefix load balancing within routing instances.
• Configure static routes and qualified next-hops that use BFD for liveness detection.
• Understand how hash calculations in the Forwarding Information Base (FIB) can impact your network.
About the Author: Douglas Richard Hanks Jr. is a Senior Systems Engineer with Juniper Networks. He is certified in Juniper Networks as JNCIE-ENT #213 and JNCIE-SP #875. Douglas’ interests are network engineering and architecture for both Enterprise and Service Provider routing and switching.
Juniper Networks Books are singularly focused on network productivity and efficiency.
