Beforehand, we introduced the general public preview launch of Gateway Load Balancer (GWLB), a brand new SKU of Azure Load Balancer focused for clear NVA (community digital equipment) insertion supported by a rising listing of NVA suppliers. Right this moment, inserting NVAs within the path of visitors is a rising want for purchasers as their workloads scale. Widespread use circumstances of NVAs we’ve seen are:
- Permitting or blocking particular IPs utilizing digital firewalls.
- Defending purposes from DDoS assaults.
- Analyzing or visualizing visitors patterns.
And GWLB now presents the next advantages for NVA situations:
- Supply IP preservation.
- Stream symmetry.
- Light-weight NVA administration at scale.
- Auto-scaling with Azure Digital Machines Scale Units (VMSS).
With GWLB, bump-in-the-wire service chaining turns into simple so as to add on to new or present architectures in Azure. This implies clients can simply “chain” a brand new GWLB useful resource to each Commonplace Public Load Balancers and particular person digital machines with Commonplace Public IPs, masking situations involving each extremely accessible, zonally resilient deployments and less complicated workloads.
Determine 1: GWLB will be related to a number of client assets, together with each Commonplace Public Load Balancers and Digital Machines with Commonplace Public IPs. When GWLB is chained to the front-end configuration or VM NIC IP configuration, unfiltered visitors from the web will first be directed to the GWLB after which attain the configured NVAs. The NVAs will then examine the visitors and ship the filtered visitors to the ultimate vacation spot, the patron software hosted on both the load balancer or digital machine.
What’s new with Gateway Load Balancer
GWLB borrows a majority of the identical ideas because the Commonplace Load Balancers that clients are conversant in right this moment. You’ll have a lot of the similar parts akin to frontend IPs, load balancing guidelines, backend swimming pools, well being probes, and metrics, however you’ll additionally see a brand new part distinctive to GWLB—VXLAN tunnel interfaces.
VXLAN is an encapsulation protocol utilized by GWLB. This permits visitors packets to be encapsulated and decapsulated with VXLAN headers as they traverse the suitable knowledge path, all whereas sustaining their authentic supply IP and stream symmetry with out requiring Supply Community Handle Translation (SNAT) or different complicated configurations like user-defined routes (UDRs).
The VXLAN tunnel interfaces are configured as a part of the GWLB’s back-end pool and allow the NVAs to isolate “untrusted” visitors from “trusted” visitors. Tunnel interfaces can both be inner or exterior and every backend pool can have as much as two tunnel interfaces. Sometimes, the exterior interface is used for “untrusted” visitors—visitors coming from the web and headed to the equipment. Correspondingly, the inner interface is used for “trusted” visitors—visitors going out of your home equipment to your software.
Contoso case examine
To raised perceive the use case of GWLB, let’s dive deeper into instance retail firm Contoso’s use case.
Who’s Contoso?
Contoso is a retail firm that makes use of Azure Load Balancer right this moment to make their internet servers supporting their retail platform regionally resilient. Previously few years, they’ve skilled exponential progress and now serve over 20 million guests per 30 days. When confronted with the necessity to scale their retail platform, they selected Azure Load Balancer due to its excessive efficiency coupled with ultra-low latency. Because of their success, they’ve begun to undertake stricter safety practices to guard buyer transactions and cut back the danger of dangerous visitors reaching their platforms.
What does Contoso’s structure appear like right this moment?
One in every of their load balancers supporting the eastus area is known as contoso-eastus and has a front-end IP configuration with the general public IP 101.22.462. Right this moment, visitors headed to 101.22.462 on port 80 is distributed to the backend situations on port 80 as effectively.
What’s the issue?
The safety workforce lately recognized some probably malicious IP addresses which were trying to entry their retail platform. In consequence, they’re seeking to place a network-layer digital firewall to guard their purposes from IP addresses with poor reputations.
What’s the plan?
Contoso has determined to go along with a third-party NVA vendor whose home equipment the workforce has utilized in different contexts akin to smaller scale purposes or different internal-facing instruments. The safety workforce needs to maintain the creation of further assets to a minimal to simplify their NVA administration structure, so that they determine map one GWLB with an auto-scaling backend pool of NVAs utilizing Azure VMSS to every group of load balancers deployed in the identical area.
Deploying Gateway Load Balancer
The cloud infrastructure workforce at Contoso creates a GWLB with their NVAs deployed utilizing Azure VMSS. Then, they chain this GWLB to their 5 Commonplace Public LBs for the eastus area. After verifying that their Knowledge Path Availability and Well being Probe Standing metrics are one hundred pc on each their GWLB and on every chained Commonplace Public LB, they run a fast packet seize to make sure all the things is working as anticipated.
What occurs now?
Now, visitors packets whose vacation spot are any of the frontend IPs of the Commonplace Public LBs for eastus will probably be encapsulated utilizing VXLAN and despatched to the GWLB first. At this level, the firewall NVAs will decapsulate the visitors, examine the supply IP, and decide whether or not this visitors is protected to proceed on in direction of the top software. The NVA will then re-encapsulate visitors packets that meet the firewall’s standards and ship it again to the Commonplace LB. When the visitors reaches the Commonplace LB, the packets will probably be decapsulated, that means that the visitors will seem as if it got here instantly from the web, with its authentic supply IP intact. That is what we imply by clear NVA insertion, as Contoso’s retail platform purposes will behave precisely as they did earlier than, with out ever understanding that the packet was inspected or filtered by a firewall equipment previous to reaching the applying server.
Gateway Load Balancer companions
Gateway Load Balancer helps quite a lot of NVA suppliers, you may be taught extra about every of our companions on our companions web page.
Digital firewalls
- Examine Level
- Cisco
- F5
- Fortinet
- Palo Alto Networks
Visitors observability
- cPacket Networks
- Glasnostic
Community safety
- Citrix
- Development Micro
- Valtix
DDoS safety
Study extra
Check out Gateway Load Balancer right this moment with the assistance of our quickstart tutorials, or learn extra about Gateway Load Balancer on our public documentation.
