Recently, I was asked a lot of questions around the capability of NSX load balancer by team and customers. So I put a quick summary of NSX load balancer to ease my life.

NSX can perform L4 or L7 load balancing:

• L4 Load Balancing (packet-based load balancing) : support TCP and UDP load balancing, which is based on Linux Virtual Server.
• L7 Load Balancing (socket-based load balancing): Support TCP and TCP-based application (e.g. HTTPs_ load balancing, which is based on HAProxy.

Regarding SSL load balancing, it requests L7 load balancing.

3 options for SSL load balancing:

• SSL Passthrough:
  • NSX load balancer won’t terminate the client session and only pass through the SSL traffic;
  • Session persistence: SSL session id or source IP
• SSL Offload:
  • client SSL session will be terminated on NSX load balancer and a clear-text (e.g. HTTP) session will be initiated from NSX load balancer to backend server;
  • Session persistence: cookie, SSL session id or source IP
• SSL end to end:
  • client SSL session will be terminated on NSX load balancer and a new SSL session will be initiated from NSX load balancer to backend server;
  • Session persistence: cookie, SSL session id or source IP

Tips:

1. L4 and L7 virtual server can co-exist on the same NSX load balancer;
2. NSX load balancer can use 1 or multiple security groups as pool member, which means Virtual machines will be added into the load balancing pool automatically if they are added into right security group; This feature is especially useful when your Cloud VM is re-provisioned and its IP is changed;
3. Transparent mode load balancing is not recommended due to the complexity and potential performance issue;
4. In proxy mode, you can try to use HTTP x-forwarded-for to maintain the source IP information in the request;

Limitation and Constraints:

1. Don’t supprt the integration with HSM;
2. As NSX load balancer use the secondary IPs of vNIC, the size of virtual IP can’t scale up well;
3. Lack of fine security control for traffic to virtual server;
4. NSX can’t provide good service monitoring like F5 BIGIP or Citrix Netscaler;