Detailed explanation of load balancing LoadBalance: also called F5, and introduction to real cases

When it comes to operation, maintenance and security, one word is almost inevitable - load balancing. When talking about load balancing, the first device that pops up in many people's minds is "F5". Interestingly, F5 is actually a company name (F5 Networks), but because its products are so famous, it has gradually become synonymous with load balancers, just like "Baidu Click" has become synonymous with search.

This article will explain it thoroughly: what exactly is F5, what is the difference between the fourth floor and the seventh floor, and how to match it in real scenes.

1. What exactly is load balancing solving?

The essence of load balancing is to allocate work tasks to multiple operating units - such as web servers, FTP servers, and enterprise key application servers, so that they can complete the work together.

From a technical perspective, it presents aVirtual server address. When a user comes to connect, it transfers the connection to the most appropriate real server through two-way network address translation (NAT). What users see is always the same entrance, with a group of machines behind it.

It solves three things:Afraid of downtime(single point of failure),Afraid of not being able to bear it(Performance bottleneck),Afraid of not being able to expand(Not scalable horizontally).

Two and four floors vs seven floors: the most common place to get confused

The core of the difference is just one sentence:Do you want to parse the application layer protocol?. This difference directly determines capability boundaries and performance.

Four-layer load balancing (transport layer)

• working level: OSI layer 4, TCP/UDP protocol
• forwarding basis: Source IP, destination IP, port number - no application data touched
• core competencies: Port forwarding, TCP connection multiplexing, Layer 4 health check (TCP handshake), basic DDoS protection
• Performance: The forwarding efficiency is extremely high, close to the hardware limit, and the delay is microseconds.
• Typical scenario: Database (MySQL/Redis), TCP service (game server, Netty service), cross-machine room link load
• Representative products: LVS, F5 (four-layer mode), HAProxy (four-layer mode), Nginx (stream module)

Seven-layer load balancing (application layer)

• working level：OSI layer 7, HTTP/HTTPS, DNS, FTP and other application protocols
• forwarding basis: URL, Cookie, HTTP header, request parameter, JSON content
• core competencies: Based on content routing, SSL offloading, caching, current limiting and fusing, WAF integration, session persistence, and grayscale publishing
• Performance: Rich in functions, but it requires parsing the application protocol and the delay is slightly higher (millisecond level), which can be compensated by cluster expansion.
• Typical scenario: Web application, microservice API, HTTPS service, grayscale publishing, API gateway
• Representative products: Nginx, HAProxy (seven-layer mode), F5 (seven-layer module), Kong, Spring Cloud Gateway

one sentence notation: The fourth layer looks at the "street sign" (IP and port) before forwarding, and the seventh layer needs to "unpack" (look at the content) before deciding where to send it. For performance, choose four layers, and for cost, choose seven layers.

3. What is the strength of F5 BIG-IP?

F5’s main product, BIG-IP LTM, is officially calledlocal traffic manager, capable of layer 4-7 load balancing. It is not just a forwarder, the list of functions is quite long: application switching, session switching, state monitoring, smart NAT, universal persistence, response error handling, IPv6 gateway, advanced routing, SSL acceleration, smart HTTP compression, TCP optimization, content buffering, cookie encryption, application attack filtering, DoS and SYN Flood protection, firewall packet filtering...

Pick a few of the most practical ones:

1. Multi-link load balancing and redundancy

Key businesses often need to connect to multiple ISP lines to ensure quality and eliminate single points of failure. There are two directions here:

• OUTBOUND traffic(Internal network accesses external network): BIG-IP LC intelligently distributes traffic to different Internet interfaces and performs source address NAT
• INBOUND flow(External network accessing the internal network): Bind the public network addresses of two ISPs, parse the DNS requests of the two ISPs, and respond intelligently based on the server health status and RTT time.

2. Server load balancing

Provide external services through VIP (virtual IP, consisting of IP address and TCP/UDP port), and continuously perform health checks from L4 to L7 on the target server. Once a faulty server is found, it is removed from the load balancing group. It can also cooperate with iRules to open TCP/UDP packets and perform rule processing based on content characteristics - such as directing traffic to different servers based on URLs.

3. System high availability

This is where the F5 shines most. In dual-machine redundancy modeMillisecond level switching(As fast as 200ms), claiming 99.999% availability. The principle is: when all sessions pass through the Active device, the session information will be synchronized to the Backup device through the synchronization data cable - so user access will not be interrupted during the switch. The watchdog chip in the device monitors the other party's power frequency through the heartbeat cable. When Active hangs up, it immediately notifies Backup to take over the Shared IP and VIP.

4. Security

BIG-IP adopts firewall design principles.Deny by default. It can tear down idle connections to prevent DoS, perform source route tracing to prevent IP spoofing, and reject SYN without ACK to prevent SYN attacks. Its Dynamic Reaping feature can effectively delete idle connections in DoS attacks, andThe connection cut-off rate will increase as the amount of attacks increases.——This is quite cruel. Delay Binding technology provides comprehensive SYN Flood protection for back-end servers.

5. SSL acceleration

Each BIG-IP has an SSL hardware acceleration chip and comes with a 100 TPS license, so there is no need to pay separately. If you need to expand the capacity later, just upgrade the license.

4. F5 or Nginx? Selection comparison

This is the most commonly asked question in practical work. The two are not competitive, but more complementary.

F5 BIG-IP (hardware)

• Deployment form: dedicated hardware equipment (including customized chips)
• Performance: Millions of TCP connections, microsecond forwarding delay
• Function: All-round - Layer 4 + Layer 7, SSL offloading, DDoS protection, WAF, VPN, link load
• Reliability: Hardware redundancy (dual-machine hot standby), 99.999% availability
• Cost: high (hundreds of thousands to millions), requiring maintenance by professional engineers
• Scalability: relies on hardware upgrades, low flexibility
• Operation and maintenance: complex, requiring familiarity with the dedicated configuration interface and CLI

Nginx (software)

• Deployment form: software, running on a general server or cloud host
• Performance: 100,000-level TCP connections, millisecond-level latency, cluster expansion possible
• Function: lightweight and efficient - seven layers as the core, supporting four layers, SSL offloading, caching, current limiting, reverse proxy
• Reliability: Need to manually configure dual-machine hot backup (Keepalived), relying on server hardware stability
• Cost: Open source is free, and Nginx Plus is also cheaper
• Scalability: Supports cluster deployment, and the cloud environment can be flexibly expanded
• Operation and maintenance: simple, the configuration file is easy to read, and back-end engineers can get started quickly

Select the type of intersection and just follow these steps:

• Highly concurrent TCP services (games, securities) + extreme availability → F5 fourth floor
• Core business entrance + security requirements (WAF/DDoS) → F5 seventh floor
• Microservice API gateway + cloud environment deployment → Nginx seven layers
• Database/Redis load + high cost performance → Nginx four layers
• Small and medium-sized business + rapid iteration → Nginx (fourth layer/seventh layer)
• Enterprise Data Center + Multi-Link → F5 is used as the entrance, and Nginx is used as the internal service load.

The last combination is very common among large manufacturers in practice - F5 guards the country and Nginx manages the inside.

5. Practical case: How complicated is the F5 configuration?

The first reaction of many people when they get F5 is:This is completely different from the idea of ​​switching, and there is no way to start.. Its configuration logic is another system.

scene: Two web servers provide external services, the IP is 192.168.192.10-20/24, and load balancing is required through port 80 of the external network address 192.168.27.100.

The simplest load balancing only requires three parameters, and the relationship is layer-by-layer:

• Node: The most basic definition, each server is a Node
• Pool (resource pool): A group of Nodes that receive and process traffic, such as a web server cluster
• Virtual Server: External entrance, associated to Pool

Data flow direction: Customer request → Virtual Server → Pool → Node.

Practical steps (BIG-IP management interface):

• Step 1: Activate the device. Get F5 and activate it first. The wizard is very simple, but rememberIt must be connected to the Internet, and it is best to complete it before putting it on the shelves.——This is the experience of stepping on pitfalls
• Step 2: Log in. Open the browser https://management IP, the default username and password are admin
• Step 3: Designate VLAN. Network → VLANs, create a VLAN and add the interface (select Untagged)
• Step 4: Assign IP. Networks → Self IPs, define addresses for each VLAN
• Step 5: Configure routing. Networks → Routes, set default gateway or static route
• Step 6: Configure Pool. Local Traffic → Virtual Servers → Pools, set name, health check (such as TCP), load algorithm (such as observed-member observation method), real server IP and port
• Step 7: Configure Virtual Server. Local Traffic → Virtual Servers, associate the above Pool, select the polling method (commonly used RoundRobin)
• Step 8: Configure Monitor. Local Traffic → Monitors, check server health status and associate Pool
• Step 9: Match Redundant, do dual-machine redundancy

6. Several key parameters of Virtual Server

The core of F5 is Virtual Server. If you don’t pay attention to several parameters, problems will occur.

VS Type, three common types:

• Performance L4: Pure layer four forwarding, TMM is only responsible for connection allocation, does not change TCP parameters, and the connection between client and server is 1:1. The forwarding rate is fast and is commonly used in enterprises. To reduce the impact on applications,If you can choose, choose this first.
• Standard VS: Client and server TCP connections are completely independent. Used when seven-layer functions are required (Cookie session retention, Session ID retention, Header retention, transaction-based long connection splitting, SYN attack protection). Pay attention to a feature:Its port is always open to the outside world——Even if all the back-end Nodes are down, the VIP's port 80 can still be telneted, but the web page cannot be opened. Keep this in mind when troubleshooting
• Forwarding IP: Used for internal and external network connections, there is no Pool Member, and forwarding depends on local routing. By default, F5 does not have routing function. You need to build a VS with all 0s to enable routing function.

Timeout to align(This is a real trap). If TCP Profile is configured on VS, UDP connections will not be accepted. Pay more attention to the Idle Timeout value in tcp——Must cooperate with the server. If the F5 is set to 150 seconds and the IIS server is set to 300 seconds, a lot of errors will occur. The time must be negotiated by both parties.

Address/Port Translation: The default is enabled. When the VS IP is different from the real machine IP, Address Translation must be turned on; when the VS port 8080 corresponds to the real address port 80, Port Translation must be turned on.

SNAT AutoMap: From which VLAN the request goes out, the SNAT source address is the Self IP on this VLAN. When there are multiple Self IPs on a VLAN, they will be used in polling.

7. Why you must understand “session persistence”

This is the most easily overlooked and most trouble-prone concept in load balancing.

In systems such as e-commerce and online authentication, a customer needs to go through multiple interactions to complete a transaction. These interactionsclosely related——When the server processes the second step, it often needs to know the result of the first step. This requires all these interactionsMust be done by the same server, cannot be distributed across different machines by the load balancer.

This is the meaning of session persistence (Persistence). F5 is implemented through Connectivity. Optional modes include:

• Source address remains: Bind by client source IP
• Cookies persist: F5 automatically inserts session cookies, most commonly used in the seventh layer
• SSL Session ID persistence:Reuse SSL session
• session persistence table:Supports multiple timeouts and matching rules

What are the consequences of mismatching? The user added items to the shopping cart, but when he refreshed, the items were gone - because the request was sent to another server. This kind of online fault is very difficult to troubleshoot.

8. Several practical details that cannot be avoided

Finally, I pick a few pitfalls that others have stepped on and give a direct conclusion:

• Choose the right level for health checks: Only look at the TCP handshake. If the server port is alive but the application is down, it will still be forwarded. To check the application layer, use the HTTP type Monitor to detect interfaces such as /actuator/health.
• Firewall needs to be made a "sandwich": A single firewall can often only achieve 30% of the line speed throughput. To improve it, multiple firewalls must be stacked. However, the firewall requires data to enter and exit at the same time, otherwise the connection will be rejected - F5's firewall load balancing solution can solve this problem and achieve the continuity of transparent devices
• SSL offloading is the biggest CPU saver: Let F5 handle the HTTPS handshake and encryption and decryption, and the back-end Java application only handles HTTP, significantly improving performance.
• Do a stress test before connecting to the production environment: Although the fourth layer is fast, if you enable session persistence on the fourth layer VS, it is equivalent to introducing a state, and the performance expectation needs to be recalculated.
• Keep an eye on three monitoring indicators: Pool status, virtual server throughput, node health status
• troubleshooting commands:tmsh show ltm pool <pool-name> to see the pool status, tmsh show ltm virtual <vs-name> to see the virtual server status

write at the end

Load balancing looks like a "forwarding device", but in fact it stands at the most critical position of the entire architecture - all traffic must pass through it. If it is matched well, users will not feel its existence; if it is matched poorly, users will get calls in the middle of the night.

Under the current wave of cloud native, software solutions such as LVS, Nginx, and HAProxy are completely sufficient in small and medium-sized scenarios, with obvious cost advantages. However, when it comes to the core entrances of finance, securities, and large-scale e-commerce, the value of hardware load balancing in terms of stability, millisecond-level switching, and one-stop security capabilities cannot be replaced in the short term.

As for the name "F5", the process of changing from a company to a category speaks for itself - when a product is used as a verb, it has already won the market.

Look at street signs on the fourth floor, and unpack packages on the seventh floor; choose the fourth floor for performance, and choose the seventh floor for flower activities.

Reference: F5 BIG-IP LTM official information, "Network Operation and Management" F5 load balancing case, four-layer/seven-layer load balancing technology comparison