I have been tasked to build out an Azure Public load balancer with two Big IP F5 device's (in HA) to handle web requests to an Azure ASE (Isolated Web App's)
In researching the pro's and con's I've developed a list of items pertaining to DSR (Direct Server Response). Looking at the list of pro's and con's, it's seems this may be the wrong solution considering management of the client traffic at the application
layer is much needed.
I would like to hear from others with options, comments or experiences utilizing / setting up this technology within the Azure environment.
Is this list of pro's and con's accurate with the purposed solution?
Client---->ALB---->F5's---->ASE
Thank you
DSR Pros and Cons
Pros
•
very fast load-balancing mode
•
load-balancer network bandwidth is not a bottleneck anymore
•
total output bandwidth is the sum of each backend bandwidth
•
DSR is well-suited, and always has been, to UDP-based streaming applications such as audio and video delivered via RTSP.
•
less intrusive than the layer 4 load-balancing NAT mode
•
Full transparency: The servers see a connection directly from the client IP and reply to the client through the normal default gateway.
•
No infrastructure changes required: The load balancer can be on the same subnet as the backend servers.
•
Lightning fast: Only the destination MAC address of the packets is changed and multiple return gateways can be utilized for true multi-gigabit throughput.
Cons
•
the service VIP must be configured on a loopback interface on each backend and must not answer to ARP requests
•
no layer 7 advanced features are available *********
•
Backend server must respond to both its own IP (for health checks) and the virtual IP (for load balanced traffic)
•
Port translation or cookie insertion cannot be implemented.
•
The backend server must not reply to ARP requests for the VIP (otherwise it will steal all the traffic from the load balancer)
•
Prior to Windows Server 2008 some odd routing behavior could occur in <2% of Windows Server installation.
•
In some situations either the application or the operating system cannot be modified to utilize Direct Routing.
•
Persistence is limited to source IP or destination IP (no cookie persistence)
•
SSL offloading on the load balancer is not going work as they need to see both inbound and outbound traffic.
•
There might be some ARP issues with some operating systems
Additional disadvantages:
•Protocol sanitation can't be performed.
•This means vulnerabilities introduced due to manipulation of lax enforcement of RFCs and protocol specifications can't be addressed.
•Application acceleration can't be applied.
•Even the simplest of acceleration techniques, e.g. compression, can't be applied because the traffic is bypassing the load-balancer (a.k.a. application delivery
controller).
•Implementing caching solutions become more complex.
•With a DSR configuration the routing that makes it so easy to implement requires that caching solutions be deployed elsewhere, such as via WCCP on the router. This requires additional configuration and changes to the routing infrastructure, and introduces
another point of failure as well as an additional hop, increasing latency.
•Error/Exception/SOAP fault handling can't be implemented.
•In order to address failures in applications such as missing files (404) and SOAP Faults (500) it is necessary for the load-balancer to inspect outbound messages. •Using a DSR configuration this ability is lost, which means errors are passed directly back
to the user without the ability to retry a request, write an entry in the log, or notify an administrator.
•Data Leak Prevention can't be accomplished.
•Without the ability to inspect outbound messages, you can't prevent sensitive data (SSN, credit card numbers) from leaving the building.
•Connection Optimization functionality is lost.
•TCP multiplexing can't be accomplished in a DSR configuration because it relies on separating client connections from server connections. This reduces the efficiency of your servers and minimizes the value added to your network by a load balancer.
•DSR restricts the ability of the load-balancer (application delivery controller) to perform additional functions that improve the security, performance, and availability of the applications it is delivering.
When use this architecture?
•
where response time matters
•
where no intelligence is required
•
when output capacity of the load-balancer could be the bottleneck