Binding types of traffic to specific interfaces

How the appliance routes requests on specific interfaces

By default, the appliance binds all types of traffic to all interfaces. You can, however, bind specific types of traffic to specific interfaces to balance the load across interfaces or to provide an additional level of security. Any time you bind traffic to a particular interface, the appliance sends or accepts that type of traffic only on that interface.

How the appliance typically accepts requests

Typically, the appliance accepts client requests through any interface and IP address, including any interface and IP address for an Internet link. You can add a level of security by restricting the IP addresses and, therefore, the interfaces on which the appliance accepts client requests.

Note
Interfaces can have more than one IP address.

Changing appliance behavior

Using the Listen Addresses option, you can limit the appliance IP addresses on which the appliance listens for client requests. If a TCP or UDP IP address is specified in this option, the appliance listens only on that IP address. If the Listen Addresses box is left blank, the appliance listens on all of its TCP or UDP interfaces.

Option location

The Listen Addresses option is on the Network - General page (Setup tab > Network > General).

Determining whether you should use this option

Consider the following when determining whether to use this option:

Only the IP addresses associated with the interfaces of this appliance can be listed in this option.
You must enter a full IP address, not a network address or a subnet address.
Each interface for an IP address listed in this option must be configured as up; otherwise, the appliance will not listen on it.
You cannot use this option if this appliance is part of a takeover pair.

Example of how Listen Addresses can be used

You can use the Listen Addresses option to allow client traffic from your internal network and deny traffic from the Internet

If your appliance is inside your firewall and your firewall does not block access from all clients external to your organization, you can specify in the Listen Addresses option only the IP addresses of the interfaces to your organization's internal networks. Because the IP address for the interface to the Internet is not listed in the Listen Addresses option, the appliance will not listen on that interface. Therefore, clients on the Internet cannot access your appliance.

Implication of source IP address on incoming traffic

Typically, all requests from the appliance are sent out using a single-source IP address, even if multiple interfaces are configured. Because the appliance has only one default gateway, outbound requests usually are sent through a single interface. The routing table determines the interface on which the request is sent out.

The source address of the outbound request determines which interface the origin server replies to and, therefore, is the IP address to which the server sends the requested object.

If the appliance has multiple interfaces, you can configure their IP addresses as outbound IP addresses so that traffic can be shared across the interfaces. Because the outbound traffic is spread over multiple IP addresses, incoming packets in reply to the request are directed to the appropriate interface based on the source IP address and, therefore, balanced over the interfaces.

Load balancing server-to appliance traffic

You can use the Load Balancing Interfaces option to specify all interfaces through which the appliance communicates when initiating outgoing connections. Each interface listed participates in the load balancing of outbound traffic by splitting traffic across outbound links. The end result is that the incoming traffic is split over appliance interfaces.

If no IP addresses are listed in the Load Balancing Interfaces option, the appliance originates all outgoing requests from its primary interface.

Note
You cannot use the Load Balancing Interfaces option if your appliance is part of a takeover pair.

Option location

The Load Balancing Interfaces option is on the Network - General page (Setup tab > Network > General).

Who should use this option

This technique is useful for organizations that need to balance responses from servers across multiple lines. It is not useful for organizations that need to balance requests to servers across multiple lines. If you need to balance requests to servers across multiple lines, you must use another method, such as policy routing on the default gateway.