Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

Tip of the Week - Asymmetric connections in ClusterXL R80.20 and higher

For most types of connections, replies coming from servers are handled by the same cluster member that handles the client's side. But for some types of connections (VPN, static NAT), client and server sides can be handled by different members. Such connections are called asymmetric.

Sync (and Flush&Ack) makes sure that both members are aware of each asymmetric connection and its state at all times, so for "regular" stateful inspection asymmetric connections do not present a problem.

The challenge arises with connections that require DPI (IPS, APPI, etc) or even just a sequence number verification. Such connections have to be handled entirely by a single member, since it's not possible to sync their rapidly changing state at any reasonable rate.

When both sides of a connection are handled by the same member, it's said to be sticky to this member. In R80.20, we introduced a new mechanism called Cluster Correction Layer, which allows maintaining cluster stickiness in a muc

...;
TO READ THE FULL POST it's simple and free
1 Comment