Page History

...

• This feature would allow one firewall is placed in front of load balancing devices. The firewall would become the gateway of all incoming traffic, then redirect the load balancing traffic to the load balancer behind it. The load balancer in this case won't have direct access to the public network.
• Currently this feature would only support:
  • Juniper SRX as firewall service provider
  • F5 BIG-IP as load balancing service provider.
  • Only one instance of each external devices existed in one zone.
  • Only support "per zone"(shared) Source NAT for SRX
  • Only support "shared" load balancing policy for F5.
  • Only support Isolate network.
• Upgrade from previous version of SRX&F5 inline mode
  • We don't support for upgrading from 2.2.x inline mode.
• As a part of inline mode work, we also update the firewall support on SRX, please refer to: https://cwiki.apache.org/CLOUDSTACK/static-nat-port-forwarding-and-firewall-implementation-on-srx.html^{Image Added} for the latest information on firewall support on SRX.

Use cases

1. Configure F5 and SRX.
   1. Refer to Juniper SRX config information and F5 Device Installation Instructions.
2. Add SRX and F5 to CloudStack's one zone.
   1. Choose "per zone" source NAT when adding SRX.
   2. Uncheck "dedicated" when adding F5.
3. Enable these devices.
4. Create a network offering(e.g. named "SRX-F5-inline") using SRX as provider for Firewall, PortForwarding, SourceNat, StaticNat; using F5 for Load Balancing; using VirtualRouter for DNS, DHCP, user data. VPN is not supported in this combination.
   1. And SELECT INLINE mode option for network offering.
5. Start a new VM with the new network offering.
6. Add Firewall rule and load balancing rule as usual.

...