LVS + HA Proxy for L4 to L7 load balancing

Question

Currently we are using HA proxy for our load balancing needs. We are planning to integrate LVS with HA proxy to create a load balancing solution that can take care of L4 to L7 load balancing and HA.

The reasons behind going for LVS are

1. Better L4 support for long standing TCP sessions
2. Direct server return (not possible in HA proxy)
3. Fail over for existing connections when an active load balancer goes down.

Right now, with HA Proxy, the back up load balancer only takes care of load balancing the new sessions to the back end servers and the existing connections that were serviced byt he active load balancer are lost. We are hoping that since LVS operates in kernel space, it can do fail over even for the existing sessions.

Has some one here used both LVS and HA Proxy in combination?

If so, could you please provide some pointers on integrating both - should all the packets be picked up by LVS and then the L7 requests be sent to HA Proxy?

Answer 1

I have rolled out a hybrid IPVS/HAProxy setup. HAProxy was used to do some fairly heavy L7 decision-making, which made it necessary to scale it out at relatively low traffic volumes. Putting IPVS in front gave the ability to do scale-out of the HAProxy nodes, as well as remove the need to manage failover at that layer. It worked fine, for the specific use-case I needed.

I wouldn't recommend this setup for your stated situation. By having both in the mix, you'll remove the reasons for going for IPVS in the first place, because as long as HAProxy is in the stack somewhere, it'll behave the same as it does now. Any problems HAProxy is having with long-lived TCP connections will still exist (because the TCP connections are still going through a HAProxy instance), you'll only be able to do DSR from the HAProxy box out to the Internet, and when a HAProxy box goes down, you'll still lose all the connections that were going through that instance.

If you don't need the specific features that HAProxy gives you (L7 intelligence), then just use IPVS (for the benefits you stated you want). If you do need the specific features that HAProxy gives you, then use it instead of IPVS. Yes, it's a trade-off. You'll need to decide which is more important, and which set of missing features you can more easily engineer around (for instance, by moving some intelligence to the backend, or doing a better job of dealing with dropped connections and re-establishing without user-visible impact).

Only if you need the features of HAProxy, and you need to scale out HAProxy because you have a situation in which a single HAProxy box won't work but a single IPVS DSR box will, should you then use both in combination.