Load Balancing Explained: Algorithms & Architecture

Persistence ensures that a client's connections are always directed to the same backend server, which is necessary for applications that store session information on individual servers. Common persistence methods include source IP persistence (based on client IP address) and cookie persistence (based on application-generated cookies). SSL/TLS termination involves the Big-IP decrypting encrypted traffic to access Layer 7 content. Without termination, the Big-IP only sees encrypted data and cannot make intelligent routing decisions. With termination, the Big-IP can inspect headers, cookies, and other application data.

This section addresses two critical production requirements for load balancers: session persistence and SSL/TLS termination. Session stickiness (session affinity) ensures user sessions remain on the same backend instance throughout interactions, essential for applications like e-commerce where login state must persist across multiple requests. The instructor demonstrates enabling stickiness with cookie-based session tracking lasting a configurable duration (e.g., 2 minutes). The section then covers SSL/TLS termination—the practice of decrypting traffic at the load balancer (which faces the internet) rather than backend instances. This centralizes certificate management and improves performance. The instructor demonstrates configuring SSL listeners using ACM certificates, importing existing certificates, or requesting new ones, with traffic then communicating with backend instances via plain HTTP. These features collectively enable secure, session-aware, and efficient load-balanced web applications suitable for production environments.

Session cookies enable persistence across different servers in load-balanced environments and across network changes. The invalidate() method removes session cookies, logging users out. Real implementations generate random session tokens rather than storing passwords, with servers maintaining token-to-user mappings. Sessions should have expiration times to prevent unauthorized access if devices are compromised, requiring re-authentication even with correct credentials if sessions are considered expired.

Session persistence ensures client sessions remain on the same server, preventing session inconsistency. Two methods exist: IP-based and session ID-based. IP-based persistence can cause traffic imbalance when multiple clients share IPs (NAT scenarios), making session ID-based persistence more reliable. For HTTPS traffic, LBs must terminate SSL/TLS to inspect requests and insert cookies. The LB decrypts HTTPS traffic, processes it (adding/removing cookies), then re-encrypts before forwarding to the web server. This enables LBs to perform session management and security functions on encrypted traffic.

Failover ensures user sessions transfer to other servers when the original server fails, preserving session data like shopping cart contents. SSL termination configures encryption at the load balancer level rather than individual servers, reducing costs while securing external communications. Inside the private network, unencrypted HTTP communication suffices. Session stickiness ensures users remain connected to the same backend server during their session, preventing data loss. Alternatively, session replication across all servers allows any server to handle user requests. Organizations choose between these strategies based on performance, complexity, and data consistency requirements.

Failover is a high availability feature providing unit-level redundancy where one unit (ASA 16) serves as the active unit handling all traffic while another unit (ASA 23) serves as the standby unit. When the active unit experiences a failure, traffic automatically hands over to the standby unit. Before configuration, identify which interface will serve as the failover link and which as the failover state link. The failover link enables communication between units, while the state link allows the active unit to transfer connection information (routing tables, TCP connections) to the standby unit. Configure failover on the active unit using 'failover lan unit primary' followed by 'failover lan interface' and 'physical interface' commands. On the standby unit, use 'failover lan unit secondary' with the same physical interface and a different IP address. The active unit automatically replicates its configuration to the standby unit. Enable interface monitoring using 'monitor-interface' and configure standby IP addresses. In some environments, layer 2 issues may require assigning a state mark to the interface.

High Availability (HA) ensures network security continuity during device failure. Organizations configure multiple FortiGate devices in HA pairs: Active-Passive (one handles traffic, one is backup) or Active-Active (both handle traffic simultaneously). If the Active device fails, the Passive device automatically takes over. HA configurations include control links for heartbeat communication and data links for traffic forwarding. This ensures security services remain available during hardware failures or maintenance.

Newtanks HCI provides multiple high availability mechanisms to ensure business continuity. High Availability (HA) automatically restarts VMs on healthy nodes when a node fails, retrieving missing data from replicas and completing data locality and replication sets. Controller Virtual Machines (CVMs) are themselves VMs that can fail, with automatic failover to other healthy CVMs ensuring I/O processing continues without interruption. The system provides multiple availability configurations based on RF levels: RF2 requires minimum 3 nodes and tolerates single node failure, while RF3 requires minimum 5 nodes and tolerates simultaneous failure of two nodes or two racks. These mechanisms ensure data protection and service continuity across various failure scenarios.

High availability ensures continuous service availability through failover mechanisms. Failover operates at a lower OSI layer than load balancing, where clients point to a single server using a specific IP address. If that server fails, the setup automatically redirects clients to another server without client knowledge. This is achieved using Virtual IP (VIP) and Virtual Router Redundancy Protocol (VRRP), where master and backup nodes share the same virtual IP address. Nodes negotiate leadership through heartbeat communication, and when the master fails, the backup automatically takes over the virtual IP address.

After network configuration, Config Sync and Failover Network must be configured. Config Sync uses a dedicated IP to synchronize configuration between devices. Failover Network uses unicast IPs for health checks - if active device fails to respond, standby takes over. Using two IPs (management and HA) prevents split-brain scenarios. Mirroring ensures configuration and connection state is replicated between devices, so any changes on active are automatically replicated to standby.

Global Server Load Balancing (GSLB) is a technology that distributes network traffic across multiple geographic sites using DNS-based routing, enabling organizations to achieve multi-site redundancy, scalability, and disaster recovery capabilities while working with existing DNS infrastructure; it can operate concurrently with local load balancing and optimization features to provide comprehensive traffic management solutions.

Global Server Load Balancing (GSLB) enables organizations to provide diverse, redundant global entry points for applications using a single DNS hostname. In GSLB, each data center has its own unicast IP address, and DNS records are delegated to a GSLB solution (like F5 DNS). The GSLB system actively monitors data center health and application status, then uses incoming DNS request information along with predefined rules to determine the most appropriate DNS response for each client. This approach provides resiliency because the GSLB will not serve addresses of offline sites, and offers detailed control over traffic routing decisions.

Global Server Load Balancing (GSLB) is DNS-based technology routing users to closest or best-performing data centers. It enables disaster recovery by providing alternate access locations during failures, load sharing across data centers to manage bandwidth costs, performance optimization by positioning users closest to content, and legal compliance through geographic resource presentation. GSLB does not route connections directly but directs DNS resolution to appropriate servers based on proximity or performance criteria. Design considerations include application proximity (which network carries the load based on where application data resides), persistence requirements for user interactions like shopping carts or security keys, and user data replication across sites for disaster recovery scenarios. Proximity methods include static proximity (using predefined databases) and dynamic proximity (using measured RTT/round-trip time). Metrics exchange protocol synchronizes data across GSLB sites using TCP port 3011 or 3039 for secure communication.

Global Server Load Balancing (GSLB) enables traffic routing to the optimal application instance across geographically distributed data centers by resolving a single FQDN to the best available virtual IP based on health status and load balancing algorithms like round robin, active-active deployment, or geolocation policies.

Global Server Load Balancing (GSLB) is a network technology that distributes incoming network traffic across multiple servers located in different geographic locations to ensure high availability, optimal performance, and efficient resource utilization for users worldwide.