Hardware load balancer for http and https

Question

I am looking for a hardware load balancer for an online shop with a lot of traffic. In peaks there will be 2000 concurrent clients. Please don't come up with software solutions like ha_proxy, mod_proxy (reverse), pound or whatever. I am aware of the fact that such a load balancer can be easily set up with Open Source software but I would like to have a professional solution which comes with the according support. (And I know that in most of them Open Source software is used ;-) )

The setup is straight forward.

             Firewall
                 |
             Load Balancer
    -----------------------------------
    |          |           |          |
Webserver1 Webserver2 Webserver3 WebserverN

Like already mentioned there is an online shop installed on some webservers served my HTTP and HTTPS (payment etc).

What I am looking for is a ready-to-use loadbalancer which should support the following:

• HA-Setup (Failover)
• HTTP and HTTPS (It must be assured that a client stays on the same server when switching from HTTP to HTTPS)
• At least capable of 1 Gbit/s

I did a short google researh and of course found some vendors like:

loadbalancer.org

jetNEXUS

Radware

Unfortunately I can't find any tests or recommendations. Would be great if some of you guys can post their experience.

Regards,

Peter

Answer 1

The appliance load balancer market basically works like this:

F5 BIG-IP and Citrix Netscaler vie for "best"
Cisco has a product that does this because they have a product that does everything.
Tons of companies come in nipping at the above's heels.
- A10 Networks
- Loadbalancer.org
- Kemp
- Radware
- Barracuda
- Foundry
- Brocade

Also worth special mention is Zeus. Technically they're a software product you can run on your own hardware, but they'll also sell you the servers if you really want to think of it as an appliance.

Personally I've used A10, F5, Citrix, and Cisco in production on sites with more traffic than you're spec'ing (and with more budget) and really any of them will do. A10's the cheapest, which given your relatively tight budget makes them my recommendation here.

Answer 2

You might take a look at Citrix's NetScaler which seems to meet the requirements that you spelled out.

Answer 3

I've worked in F5 shops and have been reasonably happy with them. I wasn't a part of the decision-making process on any of these, but have taken part in the continuing maintenance. They're reasonably straight-forward to design/implement/maintain.

-Waldo

Answer 4

You can look at the Barracuda Load Balancers, and Also at the WebApp Firewall if you are looking for more security for your SSL connections.

has great deals on them.

You can also look at F5, i have never used them but they are good devices.

Answer 5

I have had excellent results with the Brocade ServerIron ADX series. They're particularly nice because the interface is similar to Cisco IOS, and you can have 2 of them in a High-Availability configuration if you want (though personally, I've never had one go down). Another player (actually the biggest Enterprise-class player) is F5 Networks. I bet they're considerable overkill for you though.

I'd take a look at the Brocade ServerIron ADX 1008 or 1016 - either should be more than adequate for your needs, but all the specs are up on the site.

Answer 6

We are using cisco gear for hardware load balancing. Currently we are using the CSS-11000 but are shortly migrating that to an ACE. They handle ridiculous amounts of traffic and do SSL acceleration. If you are already using cisco gear and have people familiar with that these would be a good compliment to that environment.

Travis mentioned the barracuda solution. I have not use the barracuda load balancers, but we do have their spam firewalls. I can tell you from a usability and support standpoint that we have had very good experience with barracuda.

In the past, I have looked into Coyote point for some virtualization balancing and I know they have web load balancers too, so it might be worth looking into.

Answer 7

A device that can terminate the HTTPS session is really nice. Our F5 does that. It takes the SSL load off of the servers themselves, which means they can scale a lot farther before we need to add to the load-balance pool.

We also have some load-balanced servers doing their own SSL terminating, just using the same SSL certificate. In that case, the F5 is just a simple load balancer. That also works great.

Answer 8

I've been working with F5 BigIP 6400-E in the past and was very satisfied with them. However, back then they were around 60k EUR each.

For a smaller Project I've been working with a pair of Kemp LoadMaster 2200. They cost 1750 EUR per Appliance, provide 4 GigE Ports, do Layer 7 balancing at 950Mbps, do 25.000 new http connections per second and 50.000 concurrent connected ones and provide SSL offloading at 200 TPS.

The next bigger model, LM-2500 is around 4790 EUR and provides 1000 SSL TPS, 100.000 concurrent L7 sessions, 2 Mio. concurrent L4 sessions, etc.

If you get two you can combine them to act as a HA cluster.

They are not as sophisticated as the F5 (for instance they dont support active/active HA, only active/passive). But for the price they provide a whole lot of functionality and so far run absolutely reliable. The WebUI looks pretty ugly though :-)

Answer 9

You are going need a much larger budget (you have $15k for 2 units you said?) for a hardware accelerator solution. I would suggest pursuing a budget of round $25-30k per unit for this type of solution. 15k might get you one unit, but would probably not include the SSL hardware acceleration you are looking for.

F5 is the market leader in this segment and Cisco also has a pretty nice solution in their ACE platform. I've worked with both and I would go with F5 from an ease of use perspective. As is normal, the Cisco solution is good but the UI leaves something to be desired.

Answer 10

Another product that I've had a little experience with is Stonegate, but we were using their lower-end router solution for SMBs (really, just SBs) with multiple small locations connected via VPN. It's been a few years, but as I remember they offer load-balancing and fault-tolerance. They do require a good bit of configuration to get started, but they were a powerful solution at a low cost. I remember spending a lot of time configuring protocol and port ACLs...

-Waldo

Answer 11

f you are just looking to balance the server with 1 internet line you can look at Kemp Technologies (server load balancers)

If you are planning to have multiple internet lines you can look at Fiberlogic Optiqroute, their units can have from 2-10 WAN ports (to connect different lines) and the unit will balance servers connected in the LAN. Link and Server LB with HA. They can do Round Robin or best possible line. Their throughput will go to up to 800 Mpbs with something like 3.6 million concurrent NAT

Answer 12

I've worked a lot with loadbalancers from loadbalancer.org and have only positive experience

they are at a fair price they are very easy to configure !! they supply you with great statistics and you have root access for troubleshooting