Design

Can I use dynamic DSL or cable links without static IP with my Elfiq Link Balancer?

Yes, for outgoing traffic only; this is a good way to use very low cost links to increase bandwidth and unload corporate links.

Can a server or device co-exist with the outside port of the Elfiq Link LB?

Yes. Ensure that your LinkLB does not answer any ARP request on the outside for that server or device IP address. For example, if you have an ACL ARP that covers a full subnet, you must use the acl arp command with pass action for this IP address (acl arp +ip 1 +ServerIP/32 +pass).

I have a link with only one static IP address, a router and a temporary private network in front of my Link LB. The DNS requests on this link are not handled by the IDNS module.

Since the IDNS entry must have a public IP address and the DNS request is routed to the Link LB with a private address, the GMAC association with the network is not done. To solve this problem, simply add a subnet to this GMAC for the public IP with the gmac net command.

NOTE: Elfiq recommends that the Link LB is installed directly after the internet routers and that all other devices (servers, vpn concentrators, firewalls) are connected to a switch on the inside port.

Incoming FTP sessions are not able to pass through the Link LB.

The only FTP traffic that is supported by the Link LB in the incoming direction is passive FTP. If you are trying to pass active FTP traffic through the Link LB, please switch the connection type to passive FTP. Also, to properly pass passive FTP through your Link LB (in incoming or outgoing), you need to enable the protofix ftp command in the configuration of your VFI. This will ensure that passive FTP traffic is properly handled and able to be balanced. Note: Both passive and active FTP are supported in outgoing mode.

I have a shared internet gateway, do I have special verifications before installing my Link LB?

You must ensure not to pollute the ARP entries with the acl arp command.

Some Wi-Fi links are also configured in a shared mode.

Can I use the same switch(es) in a failover scenario for the inside, outside and management zones?

Elfiq strongly recommends that your management ports be located on completely isolated switch(es) for security and ensure that both your LinkLB units will not enter master mode in case of a switch failure.

When I run the sh gmac command part of the traffic is not accounted and the counters show zero traffic.

This is normally because some of your internet infrastructure is redundant. If you have routers configured in HSRP the packets received from the router will have the source MAC of the physical interface of the router, but your GMAC is defined with the virtual MAC. To solve this problem use the gmac disc command with the real IP address of both routers to find the MAC address of each physical interface. Then add these MAC to your GMAC with the gmac alias command.