About transparent proxying with an L4 or L7 switch

Comparing L4 and L7 switch features

Switches typically include multiple methods for handling traffic. When this guide refers to L4 or L7 switches, it refers to a feature on a switch that can support transparent proxying, that is, operate on the L4 or L7 layer of the OSI model. The layer in the OSI model at which a switch operates determines the capabilities of the switch. Switch names vary by vendor.

About an L4 switch

An L4 switch operates at Layer 4 in the OSI model--the Transport layer. L4 switches base their switching decisions on information in the TCP header, and TCP is a protocol that resides at Layer 4 in the OSI seven-layer model. These switches examine only the port number and determine, based on the port number, where to redirect the traffic.

About an L7 switch

An L7 switch operates at Layer 7 of the OSI model--the Application layer. Because these switches operate at Layer 7, they can understand URLs and can understand much more about the traffic than an L4 switch can.

An L7 switch has a more sophisticated partitioning capability than an L4 switch. Therefore, an L7 switch can understand much more of the traffic than an L4 switch can. It can, for example, partition HTTP client traffic based on the requested URL, which can be useful in influencing the traffic that the switch redirects to the NetCache appliances. See Request distribution with an L4 or L7 switch for more information.

Features common to L4 and L7 switches

Both L4 and L7 switches provide the following features:

Some L4 and L7 switches can switch more than a gigabyte of data.
By default, they partition traffic based on the destination IP address.
They can be configured to send traffic directly to the origin server if a NetCache appliance fails.

Performance comparison between L4 and L7 switches

The performance of L4 and L7 switches is similar. However, the L7 switch examines TCP/IP packets more closely than an L4 switch does. Therefore, the response time of the L7 switch is slightly slower than that of an L4 switch.

Number of L4 or L7 switches needed

The number of L4 or L7 switches that you need depends on factors such as the following:

The number of NetCache appliances and routers that must be connected to a switch
The type of switch
Whether you want to deploy a switch failover pair so that one switch can take over for the other if the other switch is unavailable

Switch location

The following table discusses issues related to switch location.

Switch location in relation to...	Comments
NetCache appliances	L4 and L7 switches use MAC address rewriting as the method for redirecting packets. Therefore, your L4 and L7 switches must be on the same subnet as the NetCache appliances to which the switch is to redirect packets. For maximum efficiency, Network Appliance recommends directly connecting the switch to each NetCache appliance.
Clients	The switch must be located so that it can view all network traffic for the clients that it is expected to serve.

Switch location in relation to...

Comments

NetCache appliances

L4 and L7 switches use MAC address rewriting as the method for redirecting packets. Therefore, your L4 and L7 switches must be on the same subnet as the NetCache appliances to which the switch is to redirect packets.

For maximum efficiency, Network Appliance recommends directly connecting the switch to each NetCache appliance.

Clients

The switch must be located so that it can view all network traffic for the clients that it is expected to serve.

Desirable switch features

For information about sizing specific switches, see the switch vendor's documentation. Appendix B, Requirements for Transparent Proxying, provides a list of key features to look for when buying switches.

Avoiding traffic loops when using an L4 or L7 switch

If you have more than one network interface and you are deploying transparent proxying with an L4 or L7 switch, make sure that the port through which outgoing NetCache traffic is sent is not configured as a transparent port. If outgoing NetCache traffic is sent back through an incoming cache port on the switch, the switch diverts the traffic back to NetCache, creating a traffic loop. If this occurs, no DNS, HTTP, FTP, NNTP, MMS, or RTSP requests are serviced.