[BBLISA] Load balancers

Aaron Macks upelluri at gmail.com
Wed Mar 13 09:51:37 EDT 2013


I'd just add a strong recommendation AGAINST Cisco ACE products.  Their
actual load-balancing is fine, but everything else about them
(replication, UI, API, logging) is terrible.  To what Nahum said, in a
master-slave failover configuration, the configs are synced, but SSL
certs are not, so frequently the slave is not identical, and a failover
event fails
A

On 3/13/13 9:41 AM, Nahum Shalman wrote:
> I second the idea of having replicated LDAP servers. If all clients can
> be configured to know about multiple servers, that's the way to go.
> 
> But if not, we could expand the conversation with a brief tangent on how
> to make a single IP address survive the failure of a single server:
> 
> VRRP or CARP or whatever other implementation is in fashion these days
> could be used to make both LDAP servers work to ensure that one of them
> is managing a particular IP address for the clients that can't be
> configured to use multiple servers.
> 
> So with two LDAP servers:
> Server A, IP 10.0.0.1
> Server B, IP 10.0.0.2
> You could also define IP address 10.0.0.3 that always is answered by
> only one of those servers (the "master"), and if the master goes down,
> the backup will take over the IP.
> 
> Or... You could have two load balancers at 10.0.4 and 10.0.0.5 be the
> machines that use VRRP to manage 10.0.0.3 so that traffic to that
> floating IP will always be balanced across both backend servers, and if
> the master load balancer goes down, the IP will move over to the backup.
> 
> But this adds complexity, and more complexity means more places where I
> find I can screw things up, so once again, I recommend the replicated
> LDAP servers rather than mess with load balancers and VRRP.
> (If you have a master and backup load balancer, Murphy's law would seem
> to dictate that when the master load balancer goes down you will
> discover that the backup load balancer was misconfigured...)
> 
> -Nahum
> 
> 
> 
> On Tue, Mar 12, 2013 at 10:44 PM, Paul Beltrani <spamgrinder at gmail.com
> <mailto:spamgrinder at gmail.com>> wrote:
> 
>     Keep in mind that, unless you're careful,  fronting an
>     authentication service with a load balancer may simply push the
>     problem further out, i.e your load balancer becomes the central
>     point of failure. Which is more work making your authentication
>     service highly available or setting up highly available load
>     balancing service ?
> 
>     At my previous job I specified a a replicated OpenLDAP
>     infrastructure to provide authentication services for the production
>     Linux environment.  The clients were likewise configured to take
>     advantage of multiple servers.  I could have fronted the
>     authentication service with a load balancer but chose not to. The
>     trade-off was between a simpler implementation and quicker fault
>     recovery.  As that environment could handle the the small timeout
>     some clients would experience should a server fail, I went with the
>     simpler implementation.
> 
>     I appreciate this may not be appropriate for your environment.  Just
>     suggesting an option.
> 
> 
>       - Paul Beltrani
> 
> 
> 
> 
>     On Tue, Mar 12, 2013 at 1:44 AM, Rob Taylor <rgt at wi.mit.edu
>     <mailto:rgt at wi.mit.edu>> wrote:
> 
>         Hi Matt. Thanks for the reply.
> 
>         The authentication is ldaps.
> 
>         We are only looking to use the load balancer for internal use, no
>         external use is planned. (I'm not a fan of devices straddling
>         boundaries
>         like that anyway). I think we would use it more for service
>         redundancy
>         than for actual load distribution most of the time.
>         Most of the services that we might use it for are not heavily
>         used, (not
>         a ton of connections per second or anything).
> 
>         rgt
> 
> 
>         On 3/11/13 11:02 PM, Matt Finnigan wrote:
>         > Generic answers to this are only going to be of minor help for
>         you.
>         > Knowing more about your specific use cases (particularly, what
>         protocols
>         > you're using for authentication) will help a lot.
>         >
>         > Also, we don't know your architecture. Unless you have a flat
>         network, a
>         > single load-balancer for authentication (typically on the back
>         end)
>         > won't help you with web load-balancing (typically on the front
>         end) -
>         > unless your LB has a lot of interfaces and you're OK with it
>         straddling
>         > your DMZ and internal networks. And, like I said, without
>         knowing what
>         > protocols you need, a web LB might not be the right fit for
>         your auth needs.
>         >
>         > On Mon, Mar 11, 2013 at 10:53 PM, Rob Taylor <rgt at wi.mit.edu
>         <mailto:rgt at wi.mit.edu>
>         > <mailto:rgt at wi.mit.edu <mailto:rgt at wi.mit.edu>>> wrote:
>         >
>         >     Hi Guys. We have some applications here that either can't
>         or can't
>         >     easily support connections to redundant servers for
>         authentication,
>         >     and another application that has been known to beat the
>         tar out of
>         >     the single authentication server it uses.
>         >     I was asked to look into it and some talk had came up
>         about looking
>         >     into a load balancer for distributing the load, or at
>         least making
>         >     it so that the less capable clients can failover to
>         another server.
>         >     I'm sure we would find other uses for it besides this,
>         like web
>         >     redirection during server outages/maintenance, and possibly
>         >     distributing logins to cluster login nodes.
>         >
>         >     Right now, our needs are pretty meager. I've started
>         looking at a
>         >     some software ones, like balanceNG, HAproxy, to see what
>         they can do.
>         >     I've also downloaded a demo of stingray, which used to be
>         known as Zeus.
>         >     Coyote point also makes a very inexpensive starter
>         hardware model,
>         >     $2k list.
>         >     I've got cisco gear in house, but none that seem to
>         support SLB or I
>         >     would have looked at that as well.
>         >
>         >     Load balancers are a technology that I've never really had
>         a chance
>         >     to play with, so I don't really know what to look for and
>         what to avoid.
>         >     Can anyone out there provide any insight on products that
>         they have
>         >     used, what they have used them for and their experiences?
>         >
>         >     Thanks.
>         >
>         >     rgt
>         >
>         >     Whitehead Network/System Administrator
>         >
>         >     _______________________________________________
>         >     bblisa mailing list
>         >     bblisa at bblisa.org <mailto:bblisa at bblisa.org>
>         <mailto:bblisa at bblisa.org <mailto:bblisa at bblisa.org>>
>         >     http://www.bblisa.org/mailman/listinfo/bblisa
>         >
>         >
> 
>         _______________________________________________
>         bblisa mailing list
>         bblisa at bblisa.org <mailto:bblisa at bblisa.org>
>         http://www.bblisa.org/mailman/listinfo/bblisa
> 
> 
> 
>     _______________________________________________
>     bblisa mailing list
>     bblisa at bblisa.org <mailto:bblisa at bblisa.org>
>     http://www.bblisa.org/mailman/listinfo/bblisa
> 
> 
> 
> 
> _______________________________________________
> bblisa mailing list
> bblisa at bblisa.org
> http://www.bblisa.org/mailman/listinfo/bblisa
> 

-- 
_______________________________________________________
Aaron Macks(aaronm at wiglaf.org) [http://www.wiglaf.org/~aaronm ]
My sheep has seven gall bladders, that makes me the King of the Universe!



More information about the bblisa mailing list