Subject: RE: v6 host load balancing

From: Changming Liu <[email-masked]>
Date: Wed, 3 Mar 2004 04:29:10 -0800

Hi Dave,

As we talked this moning about this issue, we thought that it might be a
good idea to discuss this in the mailing list so that others can express
their opinion too. 

As one of the top 3 firewall/NAT/IDP vendors, our experience with load
sharing is very bad. It's only good for router-switch only environment.
For security gateways with any one of the functionalities as I mentioned
above, it will create some poblem here or there. This is because it
needs to see some consecutive packets, if not all, packets in the same
flow (some applications need to see it in both directions) in order to
do the correct ALG for NAT, deep packet inspection for idp, network
based Anti-Virus, which we also start to do. I completely agree with
your statement that "packet based randomized LS" is bad. For flow based
LS, we need to be vey careful about the definition of "the flow". Some
applications have different channels, such as control/signalling and
data, like FTP, VOIP (H323 or SIP), packets belong to all these channels
are better to belong to the same firewall, or some of the above
functionality may break because it needs to deal with dynamic ports in
either forward or backward directions.

The problem we have with the draft is the "MUST NOT" sent to the same
router statement. At very minimum, it should be "SHOULD" to just leave
an option for the host to turn it off if it deems necessary. 

Thanks for the chat on this topic this morning.

Changming Liu
Netsceen Technologies Inc.

-----Original Message---
From: Gregory M Lebovitz
To: [email-masked]
Cc: Changming Liu
Sent: 3/2/2004 9:32 PM
Subject: v6 host load balancing

Dave,
Was sitting in the v6 mtg yesterday, and quickly reviewed your doc on
LB. I 
see some use cases, particularly involving state-keeping gateways, like
FW 
and IPS devices, for which this is going to cause tremendous havoc.
Could 
my co-worker, changming and I get together with you for a bit and
discuss 
to see if we are accurate in our assessment?

perhaps as the pm break today (at ietf reg desk) or for bfast tomorrow?

Pls advise,
Gregory.

+++++++++++++++++++++++++
IETF-related email from
Gregory M. Lebovitz
Architect - CTO Office
NetScreen Technologies

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Wed, 3 Mar 2004 14:40:03 +0200 (EET)

On Wed, 3 Mar 2004, Changming Liu wrote:
> sharing is very bad. 

For what it's worth, I've also argued stronlgy host against load 
balancing.  I'm copying the major concern below.

==================
Date: Sun, 29 Feb 2004 07:44:38 +0200 (EET)
From: Pekka Savola <[email-masked]>
To: [email-masked]
Subject: draft-ietf-ipv6-host-load-sharing-01 comments

[...]
Fundamental objection
---------------------

The document assumes that it is always desirable to do
load-sharing with the equivalent routers.  I don't agree with this
assumption.

If the router's capacity is sufficient so that it can forward all the
traffic sent by its nodes, there is actually very little need for load
sharing.  On the contrary -- sharing load between routers produces
difficult-to-debug scenarios when some destinations (which are distributed
to some routers) fail in mysterious ways while others work just fine.

Due to that, I, as an operator, would not wish to enable load-sharing on
hosts except when I specifically require that kind of functionality.

So, I'd propose that this document does not describe that the hosts MUST
share the load, but rather describes how the hosts MUST behave if they wish
to share the load -- and if turned on by default, require that there 
MUST be a way to toggle load balancing off.  A difficult issue to settle
might be whether to recommend (and if so, how strongly) to enable
load-sharing by default.

=======================

---

From: Tim Chown <[email-masked]>
Date: Wed, 3 Mar 2004 13:31:49 +0000

I agree completely with Pekka.

Tim

---

From: Bob Hinden <[email-masked]>
Date: Wed, 03 Mar 2004 18:27:56 -0800

Pekka,

[No hats on, for this and the previous reply to Changming Liu]

>to some routers) fail in mysterious ways while others work just fine.

I have a different set of experience where customers provision two or more 
parallel router+firewalls and wish to divide the traffic between them.  The 
specifically do not want the other routers to be unused.  They have 
installed multiple routers so if one fails they want the others (using 
VRRP) to take over for the failure.  They have found that unless all of the 
routers are used for live traffic that there is too high a probability that 
the other routers won't function correctly.

>hosts except when I specifically require that kind of functionality.

I believe that the "Default Router Preferences and More-Specific Routes" 
mechanisms provides the means to give the default routers different 
preferences.  This will have the effect of keeping the load sharing from 
coming into play because the routers won't be seen as equivalent.  This 
will give you the control I think you are asking for with out having some 
mechanism to change the default behavior in the hosts.

>might be whether to recommend (and if so, how strongly) to enable

I disagree about what should be the default.  I think the default should be 
MUST, as I think it is useful in the general case.  As pointed out above 
the "Default Router Preferences and More-Specific Routes" mechanisms 
provides a simple mechanisms to cause the hosts to not see the routers as 
equivalent if one so desires.

Regards,
Bob

---

From: Tim Chown <[email-masked]>
Date: Thu, 4 Mar 2004 09:41:50 +0000

On Thu, Mar 04, 2004 at 12:01:51AM -0800, Suresh Satapati wrote:
> 
> Disagree. load-sharing or router preferences were/are never a general case
> IMO and hence i disagree with MUST.

I also think the security section of the draft needs a bit of deeper
analysis, e.g. for the rogue router-in-the-middle.   Also diagnosis of
problems may be harder.   I think the proposal is interesting, but not a 
MUST.
 
tim

---

From: Suresh Satapati <[email-masked]>
Date: Thu, 4 Mar 2004 00:01:51 -0800 (PST)

> >hosts except when I specifically require that kind of functionality.

Agree with Pekka.