Application Delivery Controller

Fortigate SLB - only HTTP 1.0 health probes in 2017? And more

  Thread closed by the administrator, not accepting new replies.
  • 1.  Fortigate SLB - only HTTP 1.0 health probes in 2017? And more

    Posted Sep 05, 2017 09:37 AM
    No replies, thread closed.

    Hi,

    We deploy some Fortigates in some remote (to us) continents and since we have those appliances soon on site, we were looking into making use of SLB on them, but what I discovered is that Fortigates are missing some crucial basic load balancing items, that today are considered standard:

    • HTTP 1.0 only probes

    Http probes are not usable, host header a mandatory feature in 2017

    • Response code check for range (200-499) or individual code (401) not possible

    Many times we have a response code 401 and there is no content to match, so probes with match content, cannot be used

    • no HTTPS probes

    most of the services will be HTTPS and we will not be able to do a health monitoring, except TCP, not acceptable in 2017

    • SSL Bridging but SSL Session ID stickiness

    Something not clear to me, have not seen a way to do https load balancing without SSL Decryption, all documentation points to that Fortigate will always need to decrypt all SSL. If as you say “SSL Bridging (no decryption) with SSL Session ID stickiness is possible”, please provide an example. TCP Load balancing will not work as no SSL Session ID stickiness.


    For us a modern platform should implement the above features in 2017, most of them are considered basics and even should be supported on Fortigate. Fortigate does a good job with many of the features, but becomes quite useless except for the most basic setups. And no we cannot affort to purchase FortiADC at those locations.

    By the way, since some of the platforms already support SSL Offloading, why not add real L7 load balancing, so that we can have different farms per path and how abou backup server farms?

    Why do we even care? Well now even in remote small locations the basic load balancing need has increased, some small setups with Exchange want to be able to properly load balance EAS / OWA. 

    Regards,

    Pat

     

    And yes, again, no we won‘t deploy any FortiADC for those use cases.