Where should I locate F5 Load Balancer in Network Segmentation?

Question

I segmented my network and locate some important servers behind of firewall. So, I restricted traffic LAN (no segmentation between LAN clients, LAN servers) to/from important servers. These servers are cluster and they are in same VLAN. I configured my firewall as controlling traffic VLANs', not traffic in same VLAN. Now I have an F5 Load Balancer for balancing application traffic which will come from LAN. SSH and RDP wont be in F5. I am not sure where I locate it. I think I have 3 choices;

1. Locate it to LAN. In this case, all LAN segment can access it, because no segmentation. But traffic of F5 to important servers will be controlled via Firewall.
2. Locate it to VLAN of important servers, behind firewall. In this case, access to F5 from LAN will be controlled, but not between F5 and important servers, because they are in same VLAN.
3. Locate it different VLAN behind firewall. In this case traffic from LAN to F5 and F5 to important servers will be controlled via Firewall.

I wonder what is best practice for this scenario? What may be risks for the choices? Your comments are significant.

Answer 1

As @Zac67 already mentioned, there's not one best practice here. There are a few things to consider here:

• what function does the firewall have? Does it just do stateless inspection? Or is it a stateful firewall? If so and if you put the load balancer behind the firewall, is the firewall able to handle enough concurrent sessions?
• is the firewall doing NAT? If so, if you put the load balancer behind the firewall, you could see all requests coming from the same IP address. That may be problematic in logs (if you want to see the visitor's original IP address) and may affect the way traffic is load balanced between nodes.
• what modules are licensed on the load balancer? F5 has modules available for doing firewalling. So putting the firewall in front of the F5 may not give any benefits from a security perspective.
• what traffic flows are you expecting. Your description is a bit unclear. If I was in your shoes I'd draw up some more detailed diagrams of possible topologies in which you'd draw traffic flows. It may be that your firewall is needed in a specific position to enable traffic between some network segments.

Answer 2

I don't think there's a best practice - it depends on your goals and the setup details.

If you consider the load balancer to be part of the service(s), it should be located right in front of the server cluster.

Most often, load balancers use source NAT (for routing continuity) in addition to destination NAT, so if the client IP address is significant to the firewall, you'll need to put the LB between firewall and servers as well. With the load balancer between the clients and the firewall, the latter wouldn't be able to see the real client IP addresses.