It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Web Application Firewall

Multiport Link Aggregation and Network Interface Card (NIC) Configuration

  • Last updated on
In this article:


Multiport link aggregation, or link bonding, allows you to aggregate multiple physical network links into a single logical link. You can use link aggregation to achieve multi-gigabit capacity to services and servers.

Caution
  • Multiport link aggregation is an advanced feature; before completing this deployment, confirm that this configuration is necessary to meet the needs of your organization.
  • Multiport link aggregation is NOT supported in the Bridge mode deployment.

Use multiport link aggregation to:

  • Load balance multiple NICs;
  • Combine multiple network connections;
  • Incorporate redundancy in case one of the links fails;
  • Increase bandwidth beyond what is available through one port.

Management and Traffic Interface Capacity

The following table specifies the number of NIC interfaces and their capacity for each hardware and virtual machine model.

  • Note that the 106x models are not available as virtual machines.
  • There is no Bridge mode support for Virtual machine instances.

NIC Card

Speed/

Capacity

Models
 Hardware and Vx (*Excludes 106x models, which are not available as Vx)
 360460660760 (Vx Only)860861862960961964106010611064
Management Port100 Mbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps1 Gbps

Gigabit

Ethernet Ports

NA2x 1 G RJ45 with bypass2x 1 G RJ45 with bypass4x 1 G RJ458x 1 G RJ458x 1 G RJ45 with bypass8x 1 G SFP (MM)with bypass8x 1 G RJ458x 1 G RJ45 with bypass8x 1 G SFP (MM) with bypass16x 1 G RJ458x 1 G RJ45 with bypass8x 1 G Fiber with bypass
10 Gigabit Ethernet PortsNANANANANANANA2x 10 G RJ452x 10 G RJ45 with bypass2x 10 G SFP+ (MM) with bypass4x 10 G RJ454x 10 G RJ45 with bypass4x 10 G Fiber with bypass

Multi-Bridge Support

The Barracuda Web Application Firewall supports deployment of multi-bridge in models 860 and higher for the hardware form factor.

Information regarding various models and their supported number of bridge port pairs is listed here:

Hardware Model NumberNumber of Bridge Available
Not Applicable2 Bridges
8604 Bridges
9605 Bridges
10606 Bridges

Revision (Rev) B models and higher support multiport networking. For more information, see Hardware End of Sale/End of Life.

For information on how to configure Bridge mode, see Configuring Bridge-Path Mode.

In Bridge mode, the service IP address is the same as the server IP address. You can configure bypass traffic in Bridge mode. It ensures that the traffic is sent to the server even when the WAF unit fails for whatever reason (i.e., data path failure, power failure, etc.).

Older models have a single bridge, so it uses only a single network to serve the traffic. With the multi-bridge support, each bridge pair can support different networks. Use multi-bridge support if you want to segregate applications on different networks.

Link Aggregation Requirements

  • Physical links must be at least 1 Gbps operating in full duplex mode.
  • If you intend to use Dynamic Link Aggregation Control Protocol (IEEE 802.3ad), the corresponding switch must support it.
  • The configured speed of all ports of a bonded interface should be same or set to Automatic . You can configure this setting for each port by editing the port on the NETWORKS > Ports page.

Configuring Link Aggregation

To create a link bond, go to the NETWORKS > Ports page. Enter a bond name, assign the bond mode, and then select the ports. It is recommended that you select an even number of ports to bond.

Bond Modes

Three bond modes are supported:

  • Round Robin

    Round robin mode transmits packets in sequential order, from the first available network port through the last. This mode provides load balancing and fault tolerance.

    With round robin, outgoing traffic is spread across all ports in the bond. While round-robin distribution is the only mode that allows a single TCP/IP stream to use more than one network port worth of throughput, this mode also introduces the potential for out-of-order packets and re-transmitted segments.

    Example : Consider a bond configured with four ports (WAN1, WAN2, WAN3 and WAN4), in Round Robin mode. In this case, all packets for outgoing traffic during a connection will be routed through all the ports configured in the bond. If there are four TCP segments to be sent via the example bond, then each port will carry one segment.

  • Active Backup

    Only one port in the bond is active; a different port becomes active if, and only if, the active port fails. This mode provides fault tolerance only. All the packets are routed through the active port.

    Example   : Consider a bond configured with two ports (WAN1 and WAN2), in Active Backup mode. All outgoing traffic will be routed through the active port, WAN1, on the bond. The backup port, WAN2 ,becomes active if, and only if, the active port fails.

  • Dynamic Link Aggregation Control Protocol (LACP) / IEEE 802.3ad Dynamic Link Aggregation

    This mode creates aggregation groups that share the same speed and duplex settings, and utilizes all ports in the group according to the IEEE 802.3ad specification. This does not increase the bandwidth for a single conversation; it achieves high utilization only when carrying multiple simultaneous conversations.

    Verify that IEEE 802.3ad/LACP is enabled on the switch.

 

To create a bond between the interfaces, ensure that the:

  • Port configuration is same on the interfaces that are used to create a bond.
  • No network configuration such as Custom Virtual Interfaces/VLANs/NAT rules/ACLs should exist on the interfaces that are used to create a bond.

For example, consider you want to use WAN1 and WAN2 interfaces to create a bond. WAN1 and WAN2 interfaces should have same port configuration (such as Auto-Negotiation Status, Speed and Duplexity), and no network configuration should exist on the interfaces.  If any network configuration exists on the interfaces, it should be deleted before creating the bond.

Using a Bonded Interface

Once you create a bonded interface, it appears in the user interface and can be used in the same way as any physical interface. For example, you will find it in the Interfaces list when you add a service on the BASIC > Services page.

Example - Creating Two Bonded Links

To create two bonded links, one for the service, and one for the servers:

  1. On the NETWORKS > Ports page:
    1. Create WANbond0 with WAN1, WAN2 and WAN3 interfaces.
    2. Create LANbond1 with LAN1, LAN2 and LAN3 interfaces.
    3. If Dynamic Link Aggregation is selected as the mode, verify that IEEE 802.3ad is enabled on the switches.
  2. On the NETWORKS > Interfaces page:
    1. Add a custom virtual interface that associates the network address of the services subnet with WANbond0.
    2. Add a custom virtual interface that associates the network address of the real server subnet with LANbond1.
  3. Create a service on the WANbond0 interface on the BASIC > Services page.
High Availability

If you are clustering two Barracuda Web Application Firewall systems, make sure that each system has similar cabling. If failover occurs, the link bonds are created on the newly-active system using the corresponding ports. For example, if port WAN2 and port WAN3 form a bond on the active system, on failover, the newly-active system will attempt to use these same ports for the bond.

Network Interface Configuration

Network Interface Card (NIC) is a hardware unit designed to allow computers to communicate over a computer network. This NIC card, when installed on the Barracuda Web Application Firewall, negotiates communication with a switch/router with the right combination of duplexity and speed so they can communicate with one another in both directions.

There are two ways to set the NIC configurations, either manual or automatic. In manual mode, if the speed and duplexity of the card mismatches that of the switch/router, then the negotiations may fail. If Auto-Negotiation Status is set to On the NIC card will automatically match its settings to that of the switch/router to start communication. This is the recommended setting. Click Edit in the Action column, next to the desired interface, to set Auto-Negotiation Status to On

NIC is configured with predefined values by default for all the three interface ports LAN, WAN and MGMT. To edit the NIC configuration, in the Network Interface section, click Edit next to the interface name. The Edit NIC Advanced  Configuration window appears, modify the settings if required and click Save.

Creating bonds using WAN Port

From the release 9.2 onwards, the Barracuda Web Application Firewall supports configuring bonds using WAN ports. This mode of configuration allows you to create and delete bonds with WAN on standalone units only. For clustered units, it is possible to edit bonds that are in cluster. Refer to the Using a Bonded Interface section to know more about how to create bonded links.

Notes:

  • If you are configuring “High Availabity” when WAN is part of the bond, ensure that you select the MGMT checkbox for Transmit Heartbeat On parameter on the primary unit.
  • When the WAF units are in cluster and are configured with a bond, it is always recommended that you disjoin the units when you want to create a bond with WAN.
  • If the box is accessed using the system IP, and if WAN is added in the bond, the connectivity is lost until the Interface IP gets assigned to the Bond interface (from WAN interface). Therefore, It is recommended to have access to the box through MGMT to retain the connectivity.
  • If you want to add WAN interface to a bond then ensure that it is done as a first config. This config is applicable for those WAFs which have more than 3 interfaces.
  • When WAN port is added to the bond, all the system configs (system_ip, sys-vlan, system-gateway) are moved from WAN to the Bond Interface. The same is retained back when the bond is deleted to WAN interface.