NSX Edge Load Balancer - One Arm Mode

In the topology above, NSX edge load balancer is deployed in one arm mode.

NSX edge load balancer has a single layer 3 interface which is connected to Distributed Logical Router via a logical switch.

This logical switch is dedicated for Load Balancing Tier.

There is also a Web Tier hosting web servers and these web servers are connected to Distributed Logical Router via Web Tier logical switch.

Pool members corresponding to the virtual server are both residing on this Web Tier Logical switch.

The routing topology of this whole setup has already been covered in this post here.

The single vnic of NSX Edge Load Balancer has primary IP address as 172.16.20.100 / 24

The single vnic of NSX Edge Load Balancer also has secondary IP addresses assigned to it as below

Secondary IP 1 – 172.16.20.101

Secondary IP 2 – 172.16.20.102

We will be using one of these secondary IP addresses to create a virtual server.

=========================================

Configuration:

We will first enable the load balancer service on NSX Edge Services Gateway.

Enable Load Balancer Service

Application Profile

Application profile is created then and the details are as below

Application profile name - HTTPS

Application profile type – HTTPS

Certificate – For this lab setup, we have used a self-signed certificate.

Server Pool

Server pool is created as below

Pool name – pool

Algorithm – Round robin

Members – Virtual Machine web-01a, tcp/80

Members – Virtual Machine web-02a, tcp/80

Virtual Server

Virtual server is created using the secondary IP address and the virtual server details are as below

Virtual Server IP – 172.16.20.101

Virtual Server port – 443

Application Profile – HTTPS

Server pool name – pool

====================================

A management station is residing on the physical network with IP address as 192.168.110.10

We have also taken packet captures on the NSX Edge Load Balancer interface for below communications

• Communication between the management station and the virtual server 172.16.20.101, tcp port 443

• Communication between NSX Edge Load Balancer and the pool members.  
  
  
  
  

  

  Comm. between Mgmt. Station & Virtual Server

  
  
  
  

  

  Comm. between load balancer & pool members

  
  

  
  

  
  

It is worth noting that in the case when a secondary IP address 172.16.20.101 is assigned to single vnic of NSX Edge Load Balancer & the secondary IP address is used to create virtual server, the load balancer uses the primary IP address 172.16.20.100 to establish a connection between itself and the pool members.

Both the above packet captures are done at the same time while trying to access the web page at https://172.16.20.101
NSX Edge Load Balancer is working as a reverse proxy and from the packet captures, it is evident that there are two different TCP connections -

1. One between initiator and load balancer 
2. The other between load balancer and pool member

============================================================

NSX Edge Load Balancer supports below features:

1. SSL Offload
2. SSL Bridging
3. HTTP Profile with ‘insert X-Forwarded-For’
4. Cookie based persistence as well as source IP based persistence is supported.
5. Redirection from http to https
6. Multiple ciphers can be used.
7. Load balancing algorithms which are supported are:

• Round robin
• IP Hash
• Least connection
• URI
• HTTPHEADER
• URL 

=============================================================

Some very useful resources:

NSX Admin Guide
https://docs.vmware.com/en/VMware-NSX-for-vSphere/6.4/nsx_64_admin.pdf

NSX Reference Design Guide
https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/products/nsx/vmw-nsx-network-virtualization-design-guide.pdf

OSPF Routing Protocol in NSX

OSPF NSX

The above topology illustrates OSPF Totally NSSA setup in NSX domain.

Distributed logical router is handling east-west traffic within the data center while the edges E1 and E2 are handling north-south traffic.

Edges E1 and E2 are configured in ECMP mode which allows more bandwidth to flow in north-south direction.

Upto eight edges E1 – E8 can be configured in ECMP mode to handle north-south traffic.

The other mode for edge is Active/Standby which can be utilized when stateful services like NAT, firewall, load balancer, SSL and IPSec VPN are to be configured on the edge.

In our topology above, such stateful services are not configured and the requirement is to have more bandwidth in north-south direction.

Downstream to the DLR are the logical switches corresponding to Web, App and DB tiers respectively.

And the workloads are connected to the logical switches.

A brief about DLR control VM.

DLR Control VM is required when:

a.       There are dynamic routing protocols configured

b.       Or when there is L2 Bridging configured.

L2 bridging is useful while migrating workloads from physical to virtual environment.

L2 bridging also facilitates extending physical network to virtual network and vice versa.

Referencing the topology and the routing protocol setup, a DLR control VM is required in this setup.

Also, when you deploy edge as a Distributed Logical Router, these two IP addresses need to be configured aside from IP addresses related to LIFs

-          Protocol address – This IP address corresponds to the control plane exchange.

-          Forwarding address which corresponds to data plane and this IP address handles exchange of data traffic.

===========================================================================

Routing setup:

a.       Totally NSSA area is configured which is corresponding to the NSX domain.

b.       With Totally NSSA area configuration, the ABRs will inject a default route into Totally NSSA area automatically.

c.       Totally NSSA area configuration will allow redistribution of connected interfaces on the DLR.

d.       Physical routers have been configured as OSPF Area Border Routers

So the physical routers are interfacing backbone area and the Totally NSSA Area.

e.       The DLR along with edges E1 and E2 are within Totally NSSA Area.

f.        NSX domain needs a default route for egress traffic from NSX domain.

Routes which do not belong to the Totally NSSA area and which are external to this area will be replaced by Type 3 default route.

g.       Edge E1 will have OSPF peering with DLR control VM and with physical routers upstream.

Likewise for edge E2.

h.       Two external VLANs are used from each edge to peer with the physical routers.

The number of external VLANs will be equal to number of VDS uplinks. Each external VLAN will be carried on one ESXi uplink.

With such a setup, both uplinks from ESXi will be utilized for forwarding data traffic. Also a failure of one of the physical uplinks will cause data traffic to shift to the other physical uplink from ESXi.