pfsync carp and traffic on pfsync interface.

K

kisscool-fr

Hi !

I'm planning to build a set of two redundant firewalls. Just received some refurbished Dell PowerEdges.

I have a question about the amount of traffic that will pass through the pfsync interface.

If i have one gigabit link to the internal lan, one gigabit link to the DMZ and one fastethernet link to the internet, will a simple fastethernet link between the two firewalls suffice or does i have to put aonther gigabit link ?

Or maybe said differently, what is the percent of traffic that will pass through the pfsync interface compared to normal traffic ?

Thanks
 
The pfsync interface only carries updates to the state tables for synchronisation purposes, a few (k)bytes per synch. I'd be surprised if it were more than 10 MB per hour on a busy firewall, actually.
 
Ah, sounds interesting.

What about the traffic when the hosts update their state tables after a failure ?

I've found an article here where the guy says that the traffic on the pfsync iface can be equal to the normal traffic.

There is essentially no limit to how many pfsync+carp hosts can participate in a cluster. Except for the bulk update at bootup, the traffic generated by the pfsync protocol scales linearly with the amount of regular traffic passing through the firewall cluster, and besides brief periods when a new master is being selected, only one host in a carp group is advertising at any given time.
Click to expand...

My english is not good at all, so maybe i understand it bad.
 
That bit of text is specifically about firewall clusters: the more machines you have in the cluster, the more state tables need to be updated, so the more traffic will pass the pfsync interfaces to achieve proper replication between hosts.

If you're running two firewalls with one pfsync interface connecting them, you'd really have to work very hard and have very interactive services (like a bunch of busy ftp/http/bittorrent servers with a lot of short-lived connections, tcp-setups and tcp-teardowns every single second) to achieve even so much as a megabit/sec of pfsync traffic.

I couldn't even imagine that with two or three busy firewalls. Maybe with a dozen or more. So if you have FastEthernet NICs for the pfsync interfaces, that will most likely be enough for almost every setup. By the time you will need GigE interfaces for pfsync, you're probably the owner of quite a large data center or a successful porn cluster ...
 
Thanks DD.

It's best than what i thought.

I can easily make it more complex than the base idea. I can mix carp, pfsync, lagg (2 lagg with 2 GigE ifaces per lagg) and vlans.

There is really what to play with :D. I just hope it will work without problems.
 
You must log in or register to reply here.
Back
Top