Mental model
Cisco objective 4.9 says “Explain how firewall, DNS, load balancers, and reverse proxy in application deployment”. A browser request to your app crosses several network middle-boxes before touching application code. Knowing what each does lets you troubleshoot and secure the path.
Request flow
Browser → DNS → Firewall → Load Balancer / Reverse Proxy → App
- DNS: browser resolves
www.example.comto an IP. - Firewall: packet reaches your network edge; firewall allows or drops.
- Load Balancer / Reverse Proxy: entry point hands off to one of N backend app instances.
- App: your actual service.
Each middle-box has a job. Here they are.
Firewall
Filters traffic based on IP, port, protocol, state, and optionally application identity.
- L3/L4 firewall: source IP + port + dest IP + port. Fast; stateful (allow return traffic for an established connection).
- Next-gen firewall (Cisco Secure Firewall): adds application identification, URL filtering, intrusion prevention.
In an app deployment:
- Perimeter firewall at the edge: lets 80/443 in from the internet; blocks everything else.
- Internal firewall between tiers: web tier can hit app tier, app tier can hit DB tier, but web cannot hit DB directly.
- Host firewall (iptables, nftables) on the server itself.
DNS
Resolves names to IPs so humans do not type 93.184.216.34.
In an app deployment:
- Public DNS (
www.example.com→ IP of your load balancer). - Private / split-horizon DNS inside your network (service discovery:
api.internal→ the current app pod). - Round-robin DNS returns different IPs to spread basic load (crude but works).
- Weighted / geo DNS sends users to the nearest region.
Common fail: DNS TTL too high → changes take an hour to propagate. Lower TTL before a planned cut-over.
Load balancer
Spreads traffic across N backend instances. Health-checks each; stops sending to a dead one.
- L4 LB balances on IP + port; does not look at the payload. Fast.
- L7 LB balances on HTTP headers / URL / cookie. Slower per request but more useful.
- Algorithms: round-robin, least-connections, source-IP-hash, weighted.
- Products: Cisco Catalyst Load Balancer (software), F5 BIG-IP (hardware/VM), nginx, HAProxy, AWS ALB / ELB, Azure Load Balancer.
Benefits:
- Scale: add a backend, LB starts sending to it.
- Resilience: one backend dies, traffic goes to the others.
- Zero-downtime deploy: drain a backend, upgrade it, add it back.
Reverse proxy
Sits in front of one or more backends and makes decisions about each request.
- TLS termination: reverse proxy holds the HTTPS cert; backends can speak plain HTTP (inside the trusted network).
- Path-based routing:
/api/*→ API backend;/*→ web backend. - Header-based routing:
Host: shop.example.com→ shop backend. - Caching: cache GET responses so backends do less work.
- Rate limiting: block abusive clients.
- Common products: nginx, HAProxy, Envoy, Cisco Secure Workload (microseg + traffic policy).
A reverse proxy and a load balancer are different concepts but almost always deployed together. nginx can do both. F5 BIG-IP can do both. Envoy can do both.
Side by side
| Device | Primary job | Where it decides | Typical product |
|---|---|---|---|
| Firewall | Allow or drop | IP / port / state / app | Cisco Secure Firewall, iptables |
| DNS | Name → IP | Query against a zone | BIND, Route 53, Cloudflare |
| Load Balancer | Spread traffic across N backends | IP+port (L4) or HTTP header (L7) | nginx, HAProxy, F5, AWS ALB |
| Reverse Proxy | Terminate TLS, route by path, cache, rate-limit | HTTP headers / path | nginx, Envoy, Varnish |
When things go wrong
- “Site is down” but you can SSH to the server → check firewall and LB.
- “Site is slow but working” → check reverse proxy cache hit ratio; check LB spreading.
- “Only some users get errors” → DNS is sending them to a bad backend; LB sticky-session is sending them to a dead instance.
- “TLS cert expired” → it is on the reverse proxy; renew it there.
FAQ
Can one box be firewall + LB + reverse proxy? Yes. Many next-gen firewalls (NGFW) do all three; many L7 LBs also do WAF (web app firewall). Separating them in a diagram is clarity, not necessarily three boxes.
What is a WAF? Web Application Firewall. L7 filter that understands HTTP, blocks SQL injection and XSS at the request layer. Lives beside / inside a reverse proxy.
Where does CDN fit in? A CDN (Cloudflare, Akamai, AWS CloudFront) is a globally distributed reverse-proxy with caching at the network edge. Browser request hits the nearest CDN POP, which serves cached content or forwards to your origin.
My app is “just” a container; do I need all four? In production, yes — even if it is one container. The CDN or LB in front handles TLS, DDoS, scaling.