Do You Even Load Balance?

#1

Post by darkhelmetlive » Mon, Jun 17, 2013, 11:34 PM UTC

Do You Even Load Balance?
verboselogging.com

Re: Do You Even Load Balance?

#2

Post by darkhelmetlive » Mon, Jun 17, 2013, 11:35 PM UTC

I was playing with load balancers this past weekend. Some code that came out of it: https://github.com/darkhelmet/balance

Re: Do You Even Load Balance?

#3

Post by bifrost » Mon, Jun 17, 2013, 11:43 PM UTC

Thats cool and all, but using your firewalls for loadbalancing is kinda.. uh... not so good. As demonstrated, even derptastic HAProxy is better than the loadbalancing stuff built into your FW... For about $50-100/each you can buy 10 year old loadbalancers via eBay that do a WAY better job of this. They're more accurate AND use less cpu/watts than HAProxy will as well.

Just something to consider...

Re: Do You Even Load Balance?

#4

Post by darkhelmetlive » Mon, Jun 17, 2013, 11:55 PM UTC

bifrost wrote: post #3

Thats cool and all, but using your firewalls for loadbalancing is kinda.. uh... not so good. As demonstrated, even derptastic HAProxy is better than the loadbalancing stuff built into your FW... For about $50-100/each you can buy 10 year old loadbalancers via eBay that do a WAY better job of this. They're more accurate AND use less cpu/watts than HAProxy will as well. Just something to consider...

Yeah, it was kind of a "hey it does it for free" sort of thing.

I mean, if it's never really a problem, why spend more time setting extra things up. That being said, I'd have no problem setting up and managing HAProxy if we wanted to do that.

The fw boxes are from these guys: http://www.watchguard.com/ They were X550e's this weekend we're installing XTM 515's

Re: Do You Even Load Balance?

#5

Post by bifrost » Tue, Jun 18, 2013, 5:23 AM UTC

darkhelmetlive wrote: post #4

bifrost wrote: post #3

Thats cool and all, but using your firewalls for loadbalancing is kinda.. uh... not so good. As demonstrated, even derptastic HAProxy is better than the loadbalancing stuff built into your FW... For about $50-100/each you can buy 10 year old loadbalancers via eBay that do a WAY better job of this. They're more accurate AND use less cpu/watts than HAProxy will as well. Just something to consider...

Yeah, it was kind of a "hey it does it for free" sort of thing. I mean, if it's never really a problem, why spend more time setting extra things up. That being said, I'd have no problem setting up and managing HAProxy if we wanted to do that. The fw boxes are from these guys: http://www.watchguard.com/ They were X550e's this weekend we're installing XTM 515's

Ahh ok, that explains why I've never seen that before.

I'm all for free, except when you're technically paying for it with licensing/etc.

I was totally serious about the $50-100 boxes being better than HAProxy, they're monumentally better at the basics. Where they don't do so hot is with SSL acceleration, but considering how fast AES-NI is, I don't bother doing that with loadbalancers anymore. Also fully HA and you don't have to deal with source/dest NAT issues if you're using DSR.