Deploying Alteon VE on AWS for hybrid load balancing

Radware Alteon Virtual Edition (VE) brings application delivery control, SSL offload, health monitoring and traffic management to an AWS environment. It is useful when workloads span an existing data centre, private VMware cluster and public cloud, while application teams still need one consistent load-balancing platform.

A successful deployment depends less on launching an EC2 instance and more on designing the surrounding network. Subnet placement, route propagation, security groups, licensing, return paths and management access all affect whether the virtual ADC behaves predictably under production traffic.

Australian organisations often place customer-facing services in the Sydney AWS Region, with Melbourne increasingly relevant for resilience and data residency planning. The same design principles apply to an office in Brisbane, a colocation facility in Melbourne or a corporate data centre connected through Direct Connect.

Design area	Practical AWS choice	Main consideration
Licensing	AWS Marketplace subscription or BYOL	Confirm throughput and feature entitlement
Network mode	One-arm or two-arm	Match the design to routing and inspection needs
Management	Dedicated management subnet	Restrict access through VPN, bastion or SSM
Hybrid connectivity	Site-to-Site VPN or Direct Connect	Ensure symmetric return traffic
High availability	Multi-AZ pair or DNS-based failover	Plan address movement and state handling
Application exposure	Elastic IP, Route 53 or upstream service	Select the right health-check and failover model

Select the right Alteon VE architecture

Start by deciding whether the virtual appliance will use a one-arm, routed design or a two-arm, inline design. In a one-arm model, client and server traffic can share an interface while routing and security policy remain relatively simple. A two-arm design separates client-side and server-side networks and provides stronger traffic-flow control, but it requires more subnets, routes and operational discipline.

For many AWS deployments, separate management, client and server subnets are preferable. Keep the management interface reachable only through a private path, such as a site-to-site VPN, Direct Connect, jump host or carefully controlled Systems Manager workflow. Do not expose the Alteon management portal directly to the public internet.

The target application architecture matters as well. If the back-end servers remain in a VMware environment, Alteon must reach them through the Transit Gateway, virtual private gateway or a suitable routed appliance. Document the complete path before deployment, including which device owns the default gateway and where return traffic leaves the VPC.

Prepare the AWS networking

Create the VPC and subnets across at least two Availability Zones when the service requires resilience. Allocate distinct CIDR ranges for management, external or client-facing traffic, and internal application traffic. Avoid overlapping ranges with the on-premises network, especially when an Australian business has several acquired sites connected through a shared WAN.

Attach the relevant route tables to each subnet and verify propagation from the Transit Gateway or virtual private gateway. In a two-arm design, the server-side route table must know how to reach the application network, while the on-premises routers need a route back to the client or load-balancer address range.

AWS source and destination checks can interfere with appliances that forward traffic. Disable this setting on interfaces used for routing or forwarding, then validate the result with packet captures and flow logs. Security groups should permit only required listener ports, health probes, management protocols and return traffic. Network ACLs should reinforce the design without becoming a second, undocumented firewall policy.

Launch and license the virtual appliance

Obtain the supported Alteon VE image from AWS Marketplace or deploy the appropriate BYOL AMI supplied by Radware. Check the release notes against the selected EC2 instance type, network interface limits, EBS requirements and expected throughput. A small instance may be suitable for a lab, but production sizing should account for concurrent connections, TLS handshakes, compression and peak requests per second.

During launch, place the primary interface in the management subnet and attach additional ENIs for the data paths. Apply meaningful interface and instance tags, select an encrypted EBS volume, and restrict the management security group to approved administration networks. Set the initial credentials and complete the licensing workflow before exposing a listener to application traffic.

The licensing model affects scaling. A subscription licence can simplify procurement and replacement, while BYOL may suit organisations with existing Radware entitlements. Record the licence ID, support details and renewal dates in the same operational system used for AWS accounts and infrastructure certificates.

Configure virtual services and health checks

After the instance is reachable, configure VLANs, IP interfaces, default routes and any required static routes in Alteon. Create a real-server group for the application nodes, then define a virtual server with the correct protocol, port, persistence policy and load-balancing method. Round robin is a reasonable starting point, but least connections or response-time methods may better suit uneven workloads.

Health checks should test application readiness rather than merely confirming that TCP port 443 is open. A check for a known HTTP path can detect failed dependencies, stale deployments or a web service that is listening but not functioning. Set sensible intervals and failure thresholds so a short event does not remove every node from service.

Terminate TLS on Alteon only when certificate ownership, cipher policy and compliance requirements support it. Import certificates through the protected management channel, use a suitable intermediate chain, and establish a renewal process. For workloads that span a local data centre and AWS, verify that session persistence does not pin users to an unavailable site.

Connect the hybrid application path

Hybrid load balancing becomes complicated when the client enters through AWS but the selected server sits on premises, or when a local listener sends traffic to an AWS pool. The critical requirement is a symmetric and observable return path. If the response bypasses Alteon, the client may receive a reset or an invalid TCP sequence even though the server appears healthy.

Use BGP where appropriate across Direct Connect or a Transit Gateway design, and add explicit static routes when the environment is small and stable. Confirm that firewalls, VMware distributed switches and WAN routers allow the virtual service addresses and health-check source addresses. In Australia, carrier circuits and managed WAN hand-offs can involve separate providers, so document which team owns each routing boundary.

Traffic modelling should include normal business peaks, software releases and sudden public demand. Online gaming workloads are one useful example of bursty traffic patterns; a short traffic modelling guide can provide context for thinking about variable request volume, although the production test itself should use representative application transactions.

Operate, monitor and fail over

Export Alteon statistics and AWS metrics into the existing monitoring platform. Track interface errors, CPU, memory, SSL transactions, connection counts, pool health and latency. VPC Flow Logs can show rejected traffic, while CloudWatch alarms can identify an unhealthy instance or an unexpected change in throughput.

For high availability, deploy a pair across Availability Zones where the Alteon design and licence support it. Decide how management, configuration synchronisation, floating addresses and failover detection will work before placing both devices into service. In some designs, Route 53 health checks or an upstream Network Load Balancer provide the external failover layer, while the Alteon pair manages application distribution behind it.

Test failure deliberately: stop a back-end node, detach a route, block a health-check port, lose the VPN and terminate an EC2 appliance in a controlled window. Record recovery time and client impact. A runbook should include licence recovery, certificate replacement, configuration restore, AWS console steps and escalation contacts, giving the operations team a practical path through an outage rather than relying on tribal knowledge.