I know that there are setups based on KeepaliveD and EBS but the company I work in is a Cisco customer and therefore we have to use physical loadbalancers.

I plan to use the physical loadbalancer without ssl offloading and simply have it balance traffic based on leastconn algorithm to two haproxy instances I will set up (based on v1.7.9). These haproxy instances will be identical twins (configurationwise) and do the ssl offloading and client certificate based authentication. The need for the latter is the reason why I will not use the physical loadbalancer with ssl because it has a (confirmed) implementation bug.

My conceptual problem is that I have no clue how to configure stickyness on the physical loadbalancer. My assumption is that in order not to do the client certificate handling too often I should create a session in which haproxy demands the certificate once, binds it to a session and uses the certificate information for future connections (as long as the sessions does not time out)

Do I have to configure session stickyness on the physical loadbalancer ? Or is it possible to sync the gathered certificate information between the haproxy instances (I know this works for stick-tables) ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.