How to gain SSL load balancing!!!

Question

I have to deploy my ASP.NET application into two seperated IIS servers. My application works over HTTPS/TLS. My ASP code has to handle client SSL certificate and it means I can't use simple forward load balancers, because I will never get such certificate from nginx or Apache Load Balancer.

As I understand there is no common (open-source or free) solution for load balancing in Microsoft world and especially for SSL.

I heard about simple DNS balancing, where my domain name would be bound to several ISS servers, and every new client (session) would get IP of one server,and such way I would get simple balancing and SSL support.

Now, I am just at the begging of deployment and it is really interesting to know your opinion of such balancing, or may be to get some recommendations.

Thanks!

Answer 1

DNS based load balancing should take you a long way. Click here for an article on the subject. For an overview of load balancing in the IIS/ASP world, go here.

Windows Network Load balancing may be a solution for you, here you'll find lots of information about it.

Answer 2

We use Cisco Local Directors, and they seem to handle it fine.

I haven't played with pure software solutions for load balancing, but balance might work fine. I've only used it for purely 1:1 port forwarding.

The advantage of using a balance/LD approach over DNS balancing is that you can easily then use it to take servers out of the pool (for upgrades, deployments, debugging, etc).

Answer 3

As for me, I can't find another solutions for HTTPS beside DNS balancing. I just have no choice.

???

Answer 4

Depending on how much money is in your budget there are plenty of solutions out there.

You can use Windows Network Load Balancing on Windows Server for no extra cost. It is reasonably simple to setup and won't get in the way of the client certificate.

Answer 5

Windows NLB is definitely your solution - it sits in the network stack on each of your IIS servers and distributes TCP requests among the member servers. NLB works with SSL traffic, since it distributes via TCP Ports, not the contents of the traffic.

You will need to install the same SSL certs on each server, but other then that, the configuration is trivial.

Answer 6

I've successfully been using keepalived on Linux. It's a simple tool that administers http://linuxvirtualserver.org load balancer in a way that you could have fail over load balancing machines and multiple servers.