9

We've got a webserver farm currently hosting 2 applications - both applications are running on all servers. We want to split this so we have a dedicated server farm for each app (we have good reasons for this).

We'd hoped to have a single load-balancer in front of all of the servers, which would route traffic to the correct farm based on hostname, but we want to maintain SSL to the webservers.

It seems the routers we're being offered don't do this. I appreciate that without SNI this is impossible, but we expect SNI indicators on virtually all of our traffic.

Now I'm a programmer, not a network guy, but when a new SSL connection request comes in, can't the router examine the SNI header, and route to the correct farm. I'm assuming the incoming SSL connection is identified by {source IP:source port}, so couldn't it remember this for subsequent incoming packets (if SNI is only present in the first packet)?

As far as I can tell Haproxy does this, but it seems like hardware load balancers don't. Is there any reason for this, or is this something we should push for?

(For the last guard using IE on XP who don't include SNI, we'd want to send traffic to the old farm, and we'd manage proxying to the new farm when necessary).

10

According to their website, F5 load balancers have support for SNI :

https://devcentral.f5.com/articles/ssl-profiles-part-7-server-name-indication

You can even make iRules based on SNI.

Disclaimer :

  • I haven't verified what they claim on their website
  • I don't work for F5, and I haven't used any in production for 3+ years.
  • Thanks for your reply. I might well be wrong on this but I think that page is talking about web servers rather than routing SSL traffic. It talks about using SNI to select the correct certificate, so I think it's at the end of an SSL connection, rather than in the middle. – potomato Aug 23 '16 at 14:59
  • 1
    AFAIK, this page talks about routing SSL traffic "..., the BIG-IP allows you to assign multiple SSL profiles to a virtual server for supporting the use of the TLS SNI feature. The TLS SNI feature is not available in previous BIG-IP versions, so you'll want to upgrade if you are not on v11.1.0 or higher! To support this feature, a virtual server must be assigned a default SSL profile for fallback as well as one SSL profile per HTTPS site. The fallback SSL profile is used when the server name does not match the client request or when the browser does not support the SNI extensions. " – bgtvfr Aug 23 '16 at 15:38
  • "virtual servers" are the way big ip route http/https traffic to backend servers (=apache, tomcat, websphere...) – bgtvfr Aug 23 '16 at 15:39
  • Most of the big players (cisco, big-IP) do this as mentioned above. I'm not sure why the other answer was marked as the answer. – Jim B Aug 23 '16 at 18:04
  • @JimB I marked the other as the answer because I'm a programmer trying to negotiate network hardware capabilities! I've looked at the article further and still can't work out if a device is choosing to forward traffic to different physical servers based on SNI extension (as we need). This looks relevant though: devcentral.f5.com/questions/… – potomato Aug 23 '16 at 21:36
9

can't the router examine the SNI header,

A router usually works only at OSI layer 3, i.e. does not inspect the contents of the packet but only the target IP. For routing based on SNI an understanding of TCP and TLS would be necessary which is both more complex and way more expensive (regarding performance) then just routing based on IP address. And this is also usually not called routing any more then.

Haproxy does this .. hardware load balancers don't.

You are mixing router (layer 3), hardware load balancer (layer 4 and maybe higher) and Haproxy (software load balancer). A hardware load balancer is nothing more than an appliance with some software load balancer on it and maybe also some hardware acceleration for specific actions. There is nothing which inherently make balancing (not routing) based on SNI information impossible on a hardware load balancer and like another answer suggests there are products which support this. But of course it needs to be implemented and it costs performance - they deeper you look at the traffic the slower it gets.

  • Ok so technically possible but not a good idea for performance reasons, which is why it isn't done. Thanks. – potomato Aug 23 '16 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.