We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

How to Configure Scaling Policies for a NextGen Firewall Auto Scaling Cluster

  • Last updated on

Scaling policies are required for the firewall cluster to adjust the capacity in response to changes in demand. Define CloudWatch alarms for the high and low thresholds. Use the custom metrics collected from the firewall cluster or the default EC2 system metrics. Add scaling policies to the Auto Scaling group that trigger a scaling action when the health check is in alarm state. 

Custom Metrics

The firewall published the following custom metrics in the Barracuda/NGF namespace:

Custom VPN Metrics
  • Client to Site VPN tunnels        
  • SSL VPN clients
  • Site to Site VPN tunnels up
  • Site to Site VPN tunnels down
Custom System Metrics
  • load
  • Used memory
  • Protected IPs
Custom Firewall Metrics
  • Forwarding Firewall Sessions bps
  • Forwarding Firewall Sessions packets
  • Bytes in
  • Bytes out
  • Bytes total
  • Packets in
  • Packets out
  • Packets total
  • Connections dropped
  • IPS Hits
  • Forwarding Connections new
  • Forwarding Connections total
  • Connections new
  • Connections total
  • Connections blocked
  • Connections failed

Step 1. Create CloudWatch Alarm

Create two CloudWatch alarms, one for the high and one for the low alarm threshold.

  1. Log into the AWS console.
  2. Click Services and select CloudWatch.
  3. In the left menu, click Alarms.
  4. Click Create Alarm.
  5. From the Browse Metrics drop-down list, select Barracuda/NGF.
  6. From the Filter Results drop-down list, select AutoScalingGroupName.
  7. Select the check box for the metric.
  8. Click Next.
  9. Enter a Name.
  10. Configure the Alarm Threshold:
    • Logic operator – Select >= when defining an alarm to scale out, <= when defining and alarm to scale in.
    • Alarm threshold – Depending on the instance and metric type, enter the threshold. If unsure, use CloudWatch to monitor your cluster under load to determine the correct value to match your workload.
    • Period – Enter the time period the threshold must be exceeded for alarm to be triggered.
  11.  In the Alarms section, click delete to not receive a notification when the alarm is triggered. Alternatively, select an SNS topic that is configured to send notification emails when the alarm is triggered.
  12. From the Period drop-down list, select the number of minutes.
  13. From the Statistics drop-down list, select  Average or Sum depending on the metric.
  14. Click Create Alarm.

The alarm is in the INSUFFICIENT state until there is enough data for the alarm. As soon as enough data is available, the alarm state changes to OK or Alarm.


Step 2. Add Scaling Policy to Scale Out

  1. Log into the AWS console.
  2. Click Services and select EC2.
  3. In the left menu, click Auto Scaling Groups. 
  4. Select the NextGen Firewall Auto Scaling group.
  5. In the lower half, click the Scaling Policies tab.
  6. Click Add policy.
  7. Enter a Name.
  8. From the Execute policy when drop-down list, select the matching CloudWatch alarm created in Step 1.
  9. Configure the action:
    • Action – Select add to scale out, or Remove to scale in. Click set to use an explicit number of instances. 
    • Number of instances – Depending on the action, enter the number of instances to scale (add / remove) or the number of instances to scale to (set).
  10. (optional) Click add steps to define a more granular scaling policy that takes into account by how much the threshold is exceeded.
  11. In the Instances need text box, enter the number of seconds to wait before the next scaling action.
  12. Click Create.

Repeat this for both Scale In and Scale Out policies. Use CloudWatch dashboard widgets to visualize the alarm thresholds


Last updated on