SLB can be deployed in the following modes:
- Router mode
- Bridge mode
- One-armed or two-armed mode
SLB Router Mode
SLB router mode is one of the most popular implementation modes. In this mode, the load balancer will route between the outside subnets (toward the clients) and the inside subnets (toward the servers). In this scenario, the services’ addresses are typically globally routable public IP subnet addresses. The external subnets represent public networks, while the internal subnets represent private networks, as illustrated in Figure 8.4 below:
Figure 8.4 – Server Load Balancing Design – Router Mode
The load balancer device routes between the public and the private networks and the servers will use the load balancer’s inside address as their default gateway. Since the replies that come back from the servers (responses to clients) pass through the load balancer and it changes the server IP address to the appropriate address, the end-users do not know there is a load balancer device in the path. This process is similar to NAT technology. SLB router mode is easy to deploy, works with many server subnets, and is the recommended mode to be used for the majority of appliance-based SLB.
SLB Bridge Mode
SLB bridge mode is also called the “inline” mode and it works by having the load balancer device operate as a transparent firewall. In this situation, an upstream router is needed between the clients and the load balancer, as shown in Figure 8.5 below:
Figure 8.5 – Server Load Balancing Design – Bridge Mode
In this design, the physical servers are in globally routable IP subnets and the IP addresses on the load balancer can be in the same or in different IP subnets. Each one of the inside server farms (i.e., the Web server farm, the application server farm, and the database server farm) must be in a single IP subnet because the load balancer will modify the MAC addresses associated with the virtual IP (VIP) to the specific MAC address of a physical server and will direct traffic to the appropriate server.
This design method is seen most often with integrated load balancers, such as the Cisco Content Switching Module or the Application Control Engine in a 6500 or 7600 chassis. However, if these load balancers are deployed in a redundant configuration, the network designer must be aware of the implications of STP and how it will affect the devices and the backend servers. It is typically easier to configure the load balancer device in SLB routed mode because troubleshooting STP can be very complicated.
SLB One-Armed/Two-Armed Modes
The one-armed/two-armed modes (see Figure 8.6 below) are popular approaches as well and they involve running the load balancer device in an Out-of-Band fashion, similar to an IDS sensor that analyzes mirrored traffic from a switch. The load balancer is connected to a switch with one or two links that are not placed directly in line with the traffic, as is the case with the router and bridge modes presented previously.
Figure 8.6 – Server Load Balancing Design – One-Armed/Two-Armed Modes
In a one-armed topology, the load balancer and the physical servers are in the same VLAN (or subnet), while with the two-armed approach, the load balancer device routes the traffic to the physical server subnet, which can also be a private subnet with NAT.