What high availability combinations are supported by the Alert Logic Web Application Firewall?

The Alert Logic® Web Application Firewall (WAF) is normally deployed as a pair of appliances, one acting as a master syncing automatically to the redundant appliance and configured for automatic failover to the second appliance. In Amazon Web Services (AWS), there are two additional options:

1. A redundant pair of appliances can use a load balancer to send traffic to multiple appliances simultaneously while only one acts as a master and syncs in configs.
2. An auto-scaling appliance has a single master that backs itself up in AWS and manages configs for a group of workers that can auto-scale as needed.

The Alert Logic WAF and web application intrusion detection system can be configured for High Availability as either active-passive or active-active pairs.

In an active-passive setup, one appliance serves all requests, while the passive appliance drops the requests. In an active-active setup, both appliances serve requests.

Different load-balancing modes are available depending on the environment's requirements:

• IP-Load mode uses a multicast MAC address. A switch sends incoming traffic toward both notes.
• IP-Stealth mode never sends packets with its virtual MAC address as the source.
• IP-Unicast mode can be safely used in scenarios where a hub is used, as it is not necessary for a multicast MAC address.