Cisco IOS Load Balancing for Blue Coat SGOS

A reg­u­lar ques­tion for Blue Coat is how to achieve high avail­ab­il­ity. One of the answers is use a load bal­an­cer, and most net­works already have a load bal­an­cer but don’t know about it.

The IOS Server Load Balancing (SLB) is good for most cases requir­ing load bal­an­cing and for load bal­an­cing two ProxySG makes an excel­lent solu­tion for small and medium networks.

Using Cisco IOS Load Balancer

This fea­ture seems to unknown to most net­work engin­eers. Cisco’s IOS has a SLB func­tion in cer­tain IOS images in IOS Modular Routers and Catalyst switches. I have used the fea­ture in the C6500 Supervisor sev­eral times and have been very happy with the results.

It doesn’t have a lot of the fea­tures that Cisco ACE or an F5 LTM load bal­an­cers will have but TCP or IP load bal­an­cing it works perfectly.

Performance

The IOS SLB fea­ture in the C6500 per­forms well in excess of 500 Megabits per second in my exper­i­ence on a Supervisor 720 at about 30% CPU util­isa­tion. This sug­gests that peak per­form­ance could be much higher. On a Supervisor II I have seen up to 200 Mbps at about 25% aver­age CPU, again imply­ing a much higher max­imum or peak rate.

Diagram

Configuration

Here is what the IOS con­fig­ur­a­tion looks like:

interface Vlan  11
ip address 192.168.1.254 255.255.255.0

interface Vlan 12
ip address 192.168.2.254 255.255.255.0

ip slb serverfarm SOPROXY
nat server
real 192.168.1.1
faildetect numconns 2
retry 15
inservice
!
real 192.168.1.2
faildetect numconns 2
retry 15
inservice
!
ip slb vserver SOWPAD
virtual 192.168.2.10 tcp www
serverfarm SOPROXY
idle 10
delay 5
inservice

And that is it. This is a simple load bal­an­cing con­fig­ur­a­tion for IP con­nec­tions. It will detect the fail­ure of Proxy server when a cer­tain num­ber of TCP SYNs fail to achieve a con­nec­tion and auto­mat­ic­ally dir­ect con­nec­tions to the other server(note: bad when installing and test­ing, but works fine in real life).

Protocol and Application Issues

You should note that the HTTP Protocol does not require state to be pre­served, its a state­less pro­tocol, and the Bluecoat ProxySG uses NTLM trans­par­ent authen­tic­a­tion so that when the user switch from one proxy to the other there is no loss of ser­vice. Hypothetically, the cach­ing on the ProxySG may not be optimal since the con­tent may not have been pre­vi­ously reques­ted through this unit, but this remains trans­par­ent to the user as the con­tent is auto­mat­ic­ally refreshed.

You can always weight the real serv­ers or you can con­fig­ure a ‘backup server’ con­fig­ur­a­tion to address this use case.

Lots of Options

You can find the full con­fig­ur­a­tion details at the Cisco web site where this is doc­u­mented in a lot of detail. This con­fig­ur­a­tion is very simple since it uses in-​​line ser­vice detec­tion. But I wanted to show you how easy it is to use IOS SLB. You don’t need to buy an F5 LTM or Cisco Application Control Engine for load bal­an­cing, about half the time some IOS Server Load Balancing is more than enough.

Go and do it.

Please rate this post:

(5 votes, average: 9.60 out of 10)

 Loading ...