picoNet Clustering and Load Balancing

As of version 3.0 (all systems shipped from Jan 2004) picoNet have built-in clustering and load balancing that removes the need for third party clustering solutions. Clustering ensures the high availability of the security engines, thus allowing uninterrupted operations during system maintenance and updates.

• Scale up the VPN performance of a firewall solution and the throughput of an IPS solution
• Eliminate the risk of downtime
• Cluster up to 4 nodes to function as a single security engine

picoNet's built-in load balancing capabilities allows security engines to dynamically balance connections between cluster nodes, transparently transfering connections to available nodes in case a node becomes overloaded or fails. The way the load balancing is designed allows using engine nodes with different hardware in the cluster.

The clustering and load balancing technologies in picoNet's NetFilter security engine are the same ones that power Lightspeed's other HA products (picoMail and picoWeb)

Benefits

• Always available business critical services
• Easy way to scale up
• Customer satisfaction
• Save money

picoNet's Incremental Firewall Clustering Eases Setup of Clustered Environments

Incremental Firewall Clustering (IFC) is a new mode of operation introduced with picoNet 3.0. IFC technology eliminates complex configuration requirements for clustered firewalls, enabling security administrators to effectively 'drop' a firewall cluster into their existing network infrastructure. While picoNet's built-in load balancing capability has always eliminated the need for external load-balancing devices, this new version improves operational efficiencies by easing coordination between security and network administrators.  You can start with just one node, and add more nodes as and when network workload's necessitate more firewall capacity.

In IFC mode, the primary cluster node receives all the traffic send to a given IP address. Since this is the standard mode of operation for a switch, special configuration of the network is not needed. The active engine forwards the traffic to the other nodes for processing.

Move to a high availability clustered firewall scheme without any additional reconfiguring of existing switches or routers. Drop-In Firewall Clustering neatly sidesteps the typical configuration difficulties encountered when setting up a firewall cluster.

Clustering picoNet Firewall Using Unicast or Multicast MAC Addresses

If it is not possible to use Incremental Firewall Clustering, picoNet engines can be clustered also using unicast MAC addresses, multicast MAC address assosiated with a unicast IP address, or using Multicast MAC address in combination with IGMP.