topic Re: PIX/ASA - OSPF Load Balancing in Network Security

PIX/ASA - OSPF Load Balancing

lxcollin1 — Fri, 21 Feb 2020 09:02:12 GMT

Hello,

I have read the the PIX will load balance an equal cost route via OSPF. Will it send packets via per-packet, or is there a different method of distibuting traffic to the equal cost next-hop?

Thanks!!

Lee

Re: PIX/ASA - OSPF Load Balancing

hemendoz — Sat, 08 Jul 2006 06:06:37 GMT

Hello Lee,

PIX 6.3 Now supports Load Balancing using OSPF only (up to 3 default routes)

The PIX can receive upto 3 default routes (all same metric) to 3 different gateways, and

will load balance on a per destination basis. Currently, there is no way from the PIX to

determine which gateway a packet will be sent to. One cannot currently use static routes

to do load balancing.

The hashing algorithm used is not simple, therefore it is very difficult to determine what

route (next hop) a packet will take given an IP Source and Destination pair. Basically,

the PIX takes the source and destination IPs (two 32-bit numbers) and hashes them into a

single 16-bit number. Then, the 16-bit number (0x0000 - 0xFFFF) is divided into thirds.

The first 1/3 goes to Gateway 1, the next 1/3 goes to Gateway 2, and the final 1/3 goes to

Gateway 3.

Hope this helps! If so, please rate.

Thanks

Re: PIX/ASA - OSPF Load Balancing

hemendoz — Sat, 08 Jul 2006 06:08:29 GMT

Hello Lee,

PIX 6.3 Now supports Load Balancing using OSPF only (up to 3 default routes)

The PIX can receive upto 3 default routes (all same metric) to 3 different gateways, and

will load balance on a per destination basis. Currently, there is no way from the PIX to

determine which gateway a packet will be sent to. One cannot currently use static routes

to do load balancing.

The hashing algorithm used is not simple, therefore it is very difficult to determine what

route (next hop) a packet will take given an IP Source and Destination pair. Basically,

the PIX takes the source and destination IPs (two 32-bit numbers) and hashes them into a

single 16-bit number. Then, the 16-bit number (0x0000 - 0xFFFF) is divided into thirds.

The first 1/3 goes to Gateway 1, the next 1/3 goes to Gateway 2, and the final 1/3 goes to

Gateway 3.

Hope this helps! If so, please rate.

Thanks

Re: PIX/ASA - OSPF Load Balancing

lxcollin1 — Sat, 08 Jul 2006 06:21:53 GMT

Thanks Hemendoz! This is exactly what I'm looking for!

Re: PIX/ASA - OSPF Load Balancing

lxcollin1 — Sat, 08 Jul 2006 06:25:17 GMT

Hemendoz,

Out of curiosity, is this hashing algorithm the same method that CEF uses for per-destination determination?

Thanks!

Re: PIX/ASA - OSPF Load Balancing

hemendoz — Sat, 08 Jul 2006 06:52:56 GMT

Hello,

I'm sorry. I don't have that visibility into the code so I can't answer that question.