Radware Alteon

What is Radware Alteon?

Radware Alteon is an Application Delivery Controller (ADC) - a device for managing application traffic: load balancing, SSL offloading, acceleration. It ensures high availability and performance of applications.

Main functions:

• Load Balancing - distributing traffic among servers
• SSL Offloading - offloading servers from cryptography
• GSLB - Global Server Load Balancing for multi-DC
• Application Acceleration - compression, caching, TCP optimization

From a security standpoint it is worth noting that such a device sits exactly where the internet ends and the application begins — and that traffic is decrypted at this point. We cover the consequences further down.

What problem does it solve?

flowchart LR
    subgraph Without ADC
        A[Users] --> B[Single server]
        B --> C[Overload]
        C --> D[Failure = no access]
    end

    subgraph With Alteon
        E[Users] --> F[Alteon ADC]
        F --> G[Server 1]
        F --> H[Server 2]
        F --> I[Server N]
        G --> J[HA + Performance]
    end

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#dc2626,stroke:#b91c1c,color:#fff
    style C fill:#dc2626,stroke:#b91c1c,color:#fff
    style D fill:#dc2626,stroke:#b91c1c,color:#fff
    style E fill:#6366f1,stroke:#4f46e5,color:#fff
    style F fill:#f59e0b,stroke:#d97706,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#22c55e,stroke:#16a34a,color:#fff
    style J fill:#22c55e,stroke:#16a34a,color:#fff

Typical problems:

• Single-server application = single point of failure
• Servers overloaded with SSL handshake
• Slow applications (no compression, TCP optimization)
• Multi-DC without automatic failover
• No visibility into application traffic

How does Alteon work?

flowchart TD
    A[Client Request] --> B[Alteon VIP]
    B --> C[SSL Termination]
    C --> D[L7 Inspection]
    D --> E{Load Balance Algorithm}
    E --> F[Server 1]
    E --> G[Server 2]
    E --> H[Server 3]

    I[Health Checks] --> F
    I --> G
    I --> H

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#f59e0b,stroke:#d97706,color:#fff
    style C fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style D fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style E fill:#f59e0b,stroke:#d97706,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff

Key Features

Load Balancing Algorithms

Algorithm	Description	Use Case
Round Robin	Even distribution	Equal servers
Weighted Round Robin	With weights	Different server power
Least Connections	Fewest connections	Long-lived connections
Response Time	Fastest server	Performance-critical
Hash (IP/URL)	Sticky sessions	Stateful apps

SSL Offloading

Offloading servers from cryptography:

flowchart LR
    A[Client] -->|HTTPS| B[Alteon]
    B -->|HTTP| C[Server 1]
    B -->|HTTP| D[Server 2]

    E[SSL Termination<br>on Alteon] --> F[Servers focus<br>on application]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#f59e0b,stroke:#d97706,color:#fff
    style C fill:#22c55e,stroke:#16a34a,color:#fff
    style D fill:#22c55e,stroke:#16a34a,color:#fff

Benefits:

• Servers don’t perform SSL handshake
• Centralized certificate management
• Hardware acceleration for TLS
• Traffic inspection (WAF, IDS)

GSLB - Multi-DC

flowchart TD
    A[User DNS Query] --> B[Alteon GSLB]
    B --> C{Site Health?}
    C -->|DC1 healthy| D[Return DC1 IP]
    C -->|DC1 down| E[Return DC2 IP]

    D --> F[Data Center 1]
    E --> G[Data Center 2]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#f59e0b,stroke:#d97706,color:#fff
    style C fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff

For whom?

Alteon vs Competition

Aspect	Alteon	F5 BIG-IP	Citrix ADC	HAProxy
Form factor	HW/VM/Container	HW/VM/Cloud	HW/VM/Cloud	Software
SSL performance	Excellent	Excellent	Good	Software-based
GSLB	Native	Native	Native	None
WAF integration	AppWall	ASM	Built-in	None
DDoS integration	DefensePro	Silverline	Limited	None
Price	Mid-Premium	Premium	Mid-Premium	Free/Support

Alteon advantage:

• Native integration with DefensePro and AppWall
• Competitive pricing vs F5
• Unified management (APSolute Vision)
• Strong SSL hardware acceleration

Deployment Options

Specifications

Parameter	Value
Throughput	1 Gbps - 320 Gbps
SSL TPS	Up to 1.5M TPS
L4 connections	256M concurrent
L7 requests	10M+ RPS
Deployment	Hardware, Virtual, Cloud, Container
HA	Active-Active, Active-Standby
Management	APSolute Vision, REST API

The point where traffic meets the internet

A traffic distribution device sits exactly where the internet ends and the application begins. That makes it both a natural control point and a component whose failure or compromise affects everything behind it.

• Encryption termination. At this point traffic is decrypted and private keys are stored on the device. Administrative access to it is equivalent to access to the communications of every application behind it.
• Traffic visibility. Since traffic is in the clear here, this is also the best place for inspection and detecting application-level abuse.
• Resilience to volumetric overload. Distributing traffic raises availability but does not replace protection against a denial-of-service attack exceeding link capacity.
• Protocol configuration. Protocol versions and cipher suites set at deployment can remain unchanged for years, long after they stopped being recommended.

We test the configuration of this boundary and application resilience through penetration testing.

How does Alteon help before you deploy a fix for a critical flaw?

Alteon sits at the point where internet traffic is decrypted before it is passed to the servers, which makes it a natural place to protect applications. Its WAF function is provided by AppWall integrated with Alteon. This matters in the days between the disclosure of a critical flaw and the deployment of the fix, when the team is testing the new version and looking for every system with the vulnerable component. The PHP2Shell flaws in PHP (CVE-2026-109618 and CVE-2026-109619), which CISA added to its KEV catalog in October 2026 as actively exploited, are an example.

A WAF rule acting as a virtual patch limits known ways of exploiting the flaw before the traffic reaches the application. Virtual patching does not replace updating — it buys time to test and deploy the fixes.

We describe how to determine which systems are exposed and what to do in the first days in the article PHP2Shell and Node2Shell: virtual patching before you deploy the fixes. Our vulnerability management service helps you set the order of updates by risk.

FAQ

How is it different from nginx/HAProxy? Alteon is an enterprise ADC with hardware SSL acceleration, GSLB, advanced health checks, unified management. nginx/HAProxy are software LB for simpler use cases.

How does HA work? Active-Active or Active-Standby. Automatic failover with session persistence (state sync between units).

What is VIP? Virtual IP - address that clients see. Alteon redirects traffic from VIP to backend server pool.

Can I use with DefensePro? Yes. DefensePro before Alteon for DDoS protection, or Alteon with AppWall for WAF.

How is it licensed? Per throughput or per feature. You can start with base and add modules.

Does nFlo deploy Alteon? Yes. On-prem and cloud deployments, LB configuration, SSL offloading, GSLB, security stack integration.