One-Arm CSS Cesign Consideration

[yves.haemmerli]

We currently have a "in-line" CSS design where the CSS has two interfaces to the network. Traffic is entering through one interface and leaves the CSS on the other. For diverse reasons, I would like to modify the design and use the "one-arm" design where the traffic is entering and leaving the box on the same interface. The expected traffic is important.

Is there any recommendation to NOT use this design because of possible congestion conditions ?

Yves Haemmerli

[jsommerfeld]

Hi Yves,

From performance point of view the one-arm design is for sure less efficient as you run the traffic only over one interface. Additionally, the CSS seems to perform better if by using two interfaces. But the most problematic issue is, that the load balancer masquerades all the traffic to the servers and depresses the knowledge about source IP addresses of requests.If this is no problem for you and all this issues are not relevant, just run it. It works fine.

Jochanan

[AdnanShahid]

Hi Jochanan,

Is there any way so that I can allow the servers to see the source IP address.

I have some web servers that needs to know which IP or Clients or Domain User is accessing it. So that the server can authenticate the user. Currently I have no other option than to connect the server via One Arm.. but problem is in the authentication. If you know any solution for this please let me know.

BR//

Adnan