WSAs load balancing

[galin.gospodinov]

Hello community, 

we have two WSAs which will work in transparent mode with PBR from Palo Alto. I made HA group with both of them. Is it a possible scenario if we redirect traffic to VRRP address or to both of them ? Do we need external load balancer in this deployment ? I am a little bit confused. 

Thank you!

[Martin Kyrc]

Hi,
you have several possibilities how to solve/design redundancy for WSA (SWA):

1. use CARP ("vrrp"). this solution is supported by WSA. you can "send" traffic to "vip" address by PBR (or any other "proxy routing" like manual settings or auto-proxy script on client's side). for this case is only active-backup scenario possible.
2. use load-balancer and then send traffic to "vip" address by PBR (similar story like step 1). in this case you can use 'active-active' scenario.
3. you can use also WCCP protocol (on L3 device in your network) and then you can use both WSA devices in the same type (a.k.a. active-active).

for your case is step 1 the correct design.

both WSAs are appliances or there is one (or both) virtual? when almost one is virtual, be careful about network settings on vmware side - there is required some "special" setings, because CARP protocol use multicast.

is this answer useful for you?

[galin.gospodinov]

We have two appliances. Should this VRRP address should work, when we are using them in transparent mode(using PBR).
I thing this VRRP address add balancing only when the WSA is in explicit mode.

[Martin Kyrc]

Yes, sure. I forgot write it. When you are using "transparent" redirection (PBR or WCCP) for the clients, then WSA (web proxy in general) must be in transparent mode (not in explicit mode). In this case CARP/VRRP is not possible to use, but you can use load-balancer instead.

One disadvantage of PBR is, that solution has no failure detection (ok, you can use load-balancer and there configure failure detection based on monitoring real WSA servers). Better solution without load-balancer here is to use WCCP, where failure detection is possible.

best practises for web proxy in transparent mode:
- use WCCP if there is L3/FW device that supports this protocol,
- use load-balancer if exists in your network (buying a load-balancer for this purpose is an expensive solution)

[Ken Stieers]

Palo Altos have failure detection...
Look at the docs for how to do failover for 2 ISPs... Same thing, just only routing some ports to the WSA(s)
But it only works if the WSA is dead... if the IP is still reachable, the firewall may still see it as up, and not redirect traffic.


________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.