On 02/04/2013 12:22 PM, Phil Mayers wrote:
On 04/02/13 15:13, Matthew Huff wrote:
We have a pair of Cisco ACE-20 blades in our core 6500 data center
switches. Since Cisco has EOL the ACE blades and we are retiring our
6500s (moving to Nexus 5000), we are looking for a replacement load
balancing hardware. This is for high-availability rather than
scalability. Our throughput needs are very low so we are looking at
the bottom end of vendors appliances.
We are looking at F5, Foundry (Brocade), and Citrix Netscaler. Anyone
else go through this and have recommendations/horror stories/info
they would like to share? Thanks.
We had ACE-20, and went through this decision process. We decided on
upgrading to ACE-30 in the existing 6500 chassis, and plan on simply
retaining this in layer-2 when we eventually move the routing to other
devices.
We toyed with F5, A10 and some others, but eventually decided to stick
with Cisco. The main reason was that we run the ACE in bridged mode
without source NAT (except in a few special cases) and the ACEs handle
this well due to their relatively high throughput. It was also basically
a drop-in replacement, so was fairly easy in terms of planning and
manpower.
Many LBs seem to be designed / prefer to run in one-armed scenarios and
have relatively low packet-shifting performance (we were advised by F5
to consider their 2x 1Gb port model, for example). This means you either:
1. run *all* your traffic through a thin pipe, including non-SLB
traffic (e.g. backups, replication, etc.) - not an option for us.
2. put SLB backends on different subnets - would have required
significant work to move to.
3. use source NAT - would have required X-Forwarded-For: setup for
HTTP, and no real options for non-HTTP traffic.
However - I can say from our investigations that, had we been willing to
move to a different setup (probably source NAT) the F5 seems like a
really nice product. I particularly like the HTTP stuff it can do to
make your website magically "HTTP caching friendly", which is good if
you have some crappy web infrastructure that doesn't handle Expires: or
ETag: well. They also have some really neat stuff with GSSAPI/Kerberos
S4U, letting clients user non-kerberos auth (e.g. SSL certs) and
backends "see" Kerberos.
That said, I'm reasonably happy with the ACE-30, including their IPv6
functionality.
The Foundry/Brocade ServerIron's/ADX line work's quite well in a L2 or
L3 environment without NAT or being in-line. Enabling DSR (direct server
return, in an L2 environment) means the LB doesn't have to be within the
path of the normal switching/routing and their ADX line has support for
true multi-10Gb throughputs. DSR also means you're not burning up the
"Application Throughput" limits of the device on other traffic patterns.
Stability is stellar when it comes to these units, I've some of my
ServerIron 4G's online for over 1,200 days (1,277 and counting) without
blinking.
Each vendor has it's strengths and weaknesses and whereas I'm quite
pleased with the Foundry/Brocade models the only area I would say they
need work in a robust API interface to help automate changes. However
they have made recent improvements in their multi-tendency support.
Regards,
Chris
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
