Load balancing effect on ssh/https connections

[steve-woolley]

We have a RV016 load balancing between two broadband WAN connections. On protocols that are sensitive to a change in IP address such as ssh and https, if the client connection goes inactive for a short time (sometimes as short as 10 seconds), the RV016 often changes WAN connection as part of its "load balancing" feature. Most protocols do not even notice, but the more sensitive protocols do and often lock a session or timeout the session which is not a good thing.

We have been able to bind these sensitive protcolols to a particular WAN port but (in our minds) this is not an "ideal" situation. In fact I would consider this to be a broken "load balancing" solution and should be fixed.

Does anyone have any "permanent fixes" or ideas on this?

Thanks!

[jasbryan]

Steve,

The load balancing inside all RV0xx models are a weighted round robin. With round robin the only option is to bind sensitive  protocols out one wan or the other. Administration Guidepg 66. This isn't broken; but was designed this way. Now their are other routers that has policy based load balancing which maybe you are looking to go that route.These routers will be consider enterprise small business solutions.

Jasbryan

[azerbinati]

Hello,

sorry but i disagree with you, load balancing in RV0Xxx models IS BROKEN because there is NO WAY to balance traffic without problems. HTTP session get broken, voip session get broken, every kind of protocol that has session get broken all the time.. this way, if you have to bind manally every service to one WAN this is not to be all load balancer at all.

If only the router remember whitch WAN was used to connect a client to a server, we would get a what we expected.

id. build a single cache table (IP source, IP dest, WAN used). You get i nice round robin load balancer that will not break any protocol (maybe some single sign on may get confused.. but this will not be our fault! )

Hope to see this improvement next firmware..

[giuliano0]

Hello, sorry Jasbryan, I actually wanted to give a high rating to Antonio's post as I too think that a load balancer that is not capable of detecting a session with any reasonable reliability is not going to work as a load balancer. What would happen in your configuration example when the particular WAN chosen goes down? Does the system apply the same binding to another WAN until the original one comes back up, will it ignore the bining and so break any new sessions of the same protocol or will it simply fail (no connection)?

[Tom Watts]

If you have load balance employed with a protocol bind to WAN 1, in the event WAN 1 fails, all traffic will flow to WAN 2 regardless of the binding.

-Tom
Please rate helpful posts

[giuliano0]

Sorry Tom, but I wrote (edited for clarity): "What would happen [..] when the particular WAN chosen goes down? Does the system apply the same binding to ***another WAN*** until the original one comes back up, will it ignore the bining and so break any new sessions of the same protocol or will it simply fail (no connection)?"

I did not write "the other WAN". That is, I am considering the case, quite common, of more than two WANs.

Proper load balancing is described here:

http://help.mysonicwall.com/sw/eng/305/ui2/23100/Network/WAN_Failover_Load_Balancing.htm

"About Source and Destination IP Address Binding

When you establish a connection with a WAN, you can create multiple interfaces, dividing up the task load over these interfaces. There are both Primary and Secondary WAN interfaces. This task distribution model maintains high performance, ensuring that one interface does not become an impasse to the point where it blocks traffic from passing. This process is WAN Load Balancing.

While WAN Load Balancing addresses performance challenges, it can create other problems, including losing track of sessions. Session confusion can occur because some applications fail to adequately track multiple user sessions load-balanced on multiple interfaces. These applications treat incoming packets as originating from different users because they use IP addresses to differentiate user sessions instead of application-layer user identification tags.

To ensure that you have proper connectivity in all applications, SonicWALL provides a feature called Source and Destination IP Addresses Binding, a solution that maintains a consistent mapping of traffic flows with a single outbound WAN interface."

and their appliances are no more expensive than Cisco multi WAN ones...

[Tom Watts]

Hi Giulano, If you have a protocol bind to any WAN, the protocol bind will move over to the working WAN in the event of a failure. When the failed WAN recovers, the protocol bind should take effect to the WAN which has the bind specifically applied.

The reason asking, this Sonicwall excerpt only describes the concept of what protocol bind is. It does not describe the process in the event of failure, which you're asking about in regards to a Cisco router. So I am not sure what is your point with this Sonicwall excerpt.

[SamirD]

This 'problem' as you describe it is more related to the way servers are tracking their logins vs the load balancing of the router.  Even my website email server kicked me off until I set up some static entries for it.  Everything else load balances perfectly.  Load balancing is the core strength of this router and it does it quite well.

[viruspc14]

Hello from Greece!

Finally did you have any solution for that? I have the same problem with RV042.

Thanks