Forum Discussion

teoiovine's avatar
teoiovine
Icon for Cirrus rankCirrus
Jan 30, 2017

Load balancing outbound web browsing

Hello! I'm having a hard time trying to nail this down to the best possible configuration, so I will explain the current scenario and what do I need to achieve, and we will see if we can do something.

1. Current Scenario
 Client uses a BIG-IP system (cluster, not sure if relevant) for Link-Controller (Has some Wide-IPs) and load
balancing outgoing internet traffic (internal users browsing internet, not for publicating services). This
browsing is the main concern.

 Client has 5 ISP links. Let's call them ISP1, ISP2 (10Mbps), ISP3, ISP4 (50Mbps) and ISP5 (100Mbps).

 For this purpose, the client has 2 Forwarding VS, one particularly for HTTPS, and the other one for all the
rest of the traffic. He, as well, created some pools (and nodes) containing the ISP links. For example, 
POOL_ISP1_ISP2 contains both ISP1 and ISP2, POOL_Default contains the five ISP links.

 POOL_Default is the default pool which the users use for internet browsing. However, the client
wants to force specific services towards specific link(s). For example, he wants all of the Skype traffic
to be balanced to ISP2 and ISP3. For this, he uses two simple iRules that compares the destination IP
to a list of IPs and if they match, then the iRule forces a pool. If there was no match, then it selects
the default pool. The other iRule is identical, but it is for HTTPS, and adds a line for persistence.
2. Objective
 The change that the client wants to be done is simply, but we had some problems when using what I would
call "common sense".

 What he wants is that the users use only ISP3, ISP4 (which were 50Mbps each) and ISP5 (100Mbps) for 
outgoing traffic (unless explictly told in the iRule). He wants as well to use a dynamic load balancing
method for this particular pool (I suggested weighted least connections).

 For this, what I did was to create a new pool consisting only of ISP3, 4 and 5, put it as the default pool
of the iRule and set the load balancing method of the pool to weighted least connections.
3. Problems encountered
 When we executed, no service was lost, but, according to my client, navigation felt noticeably slower.

 Doing some test, we traced the next hops of the ISPs from an internal user, and we found that the trace,
instead of hoping directly to the next hop, was going over the internet and back. For example, when
tracing ISP1, the trace would hop through the internal network, and when reaching the BIG-IP, one would
guess it would hop to the ISP1, but it hopped to ISP2, hopped over internet and back to ISP1.

 We, then, thougth it was because we were forcing to use a pool in the iRule and, because of this, the
system was just balancing and not routing.

 However, this extra hops in a trace does not justify the perceived slower performance. Note I don't have
numbers to back it up, but we tried with high quality videos and downloads, and they felt faster when we
DIDN'T use the pool in the iRule.
4. Conclusions and questions
 For now, the system is simply routing traffic towards the internet when not matching in the iRule.
This, of course, is suboptimal, because we want to load balance to use the most of the links.

 So, the questions would be:
    Was this expected behaviour?

    What should we do in order to correctly achieve the objectives?

    And a more open question, Is the way in we load balance traffic the recommended to balance outgoing
   towards ISPs?

Thank you very much for your time, and please let me know if I'm unclear about anything.

1 Reply

  • wont dont you consider a POOL that uses priority group activation so that ISP1 /ISP2 are equal priority and load shared and ISP3 can only be used if both pool members representing ISP1/ISP2 are down. you will also need to use persistence i think if you want the same users source IP to use the same ISP or outgoing connections. if you can use either link for outbound then persistence would not be needed.

     

    what TCP profile do you have set for the Virtual server? are you using window scaling, SACK, delayed ACK's? is Nagle enabled?