Cost-Effective N:1 Firewall Array Via Subnet-Levcl Load Balancing by SDN/OpenFlow Switches

Christian I. Quispe, Cesar Santivanez

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

1 Scopus citations


Enterprise networks' firewalls are rarely set up in a shared-protection (N:1) configuration, preferring instead the more costly active-stand by (1+1) configuration. This is due to, in part, to the high cost associated with software-based per-flow load balancing at high traffic loads. In this work, we propose the use of SDN/OpenFlow switches as a low-cost hardware-based alternative for subnet-level load balancing, for use in a N:1 firewall array. Our design guarantees that the N:1 system exhibits the same performance of a 1+1 system but at a much lower cost. In particular, the design provides lossless firewall handover of subnets in response to traffic bursts. A prototype of the system has been implemented in Python over the base of the Floodlight OpenFlow Controller and tested in our SDN Test-Bed using the ISPDSL II traffic traces, evaluating the behavior during traffic peaks. Initial results show that the system successfully migrate subnet traffic without packet losses, call blockings, or TCAM exhaustion.
Original languageSpanish
Title of host publication2018 IEEE ANDESCON, ANDESCON 2018 - Conference Proceedings
StatePublished - 5 Dec 2018
Externally publishedYes

Cite this