Inefficient load balancing from NATed network

Frederic Marchal 0

I have a load balancer with 4 backend VM and one public IP address. Load balancing rule has no session persistence. According to the documentation, load balancing is computed with a 5-tuple hash.

This week-end, we had 200 devices connecting to the frontend IP from one single NATed network. That is, 4 out of the 5 parameters of the 5-tuple hash were identical for every device. The only variable was the source port assigned by the router on site. According to the doc:

By default, Azure Load Balancer leverages a 5-tuple hashing algorithm to distribute traffic to healthy backend instances. If the source IP address and ports are not randomly generated or have sufficient entropy, the resulting load distribution can also be uneven.

I believe we faced just that uneven distribution as the load was mainly directed to one server.

How can I "even" the distribution in that case?

Vlad Costa 1,480 Reputation points

2024-08-07T09:33:57.3233333+00:00
Hi @Frederic Marchal

When multiple devices connect from a single NATed network, the source IP, destination IP, destination port, and protocol type remain constant, leaving only the source port to vary. This can indeed lead to uneven distribution if the source ports lack sufficient entropy.

To address this issue, you can consider the following options:

Enable Session Persistence: By enabling session persistence (also known as source IP affinity), you can ensure that traffic from the same client IP is consistently directed to the same backend instance. This can be configured using either a 2-tuple (source IP and destination IP) or a 3-tuple (source IP, destination IP, and protocol type) hash.

Increase Entropy in Source Ports: Ensure that the source ports assigned by your router are sufficiently random. This can help in achieving a more even distribution of traffic across your backend instances.

Use a Different Load Balancing Algorithm: If session persistence is not suitable for your scenario, consider using a different load balancing algorithm that better suits your needs. Azure Load Balancer offers various distribution modes that you can explore.

Implementing one or more of these strategies should help you achieve a more balanced traffic distribution across your backend VMs.

References:
https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts
https://learn.microsoft.com/en-us/azure/load-balancer/concepts

If this answers your question, please click Accept Answer and Yes if this answer was helpful. Doing so would help other community members with similar issues identify the solution. I highly appreciate your contribution to the community.

1 answer

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-08-19T09:39:27.0266667+00:00
@Frederic Marchal ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

As mentioned by Vlad Costa, you can consider increasing randomness in Source Ports.

However, note that Session persistence(both methods) will not help you.

Or you can consider Azure Application gateway

If the backend pool contains multiple servers, the application gateway uses a round-robin algorithm to route the requests between healthy servers. This load balances the requests on the servers.

See : How an application gateway works

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.
Frederic Marchal 0 Reputation points

2024-08-20T11:34:02.63+00:00

Thank you @Vlad Costa and @KapilAnanth-MSFT for your answers.

Unfortunately, I can't increase the entropy of the source ports on an appliance not under my control.

The application gateway looks promising. I'm currently reading the documentation to understand how to set it up with minimal disturbances. I'll let you know if it solves my issue once I have one working instance.

I also considered adding another frontend public IPv4 to the load balancer. The idea was to add entropy through the destination IP of the 5-tuple with a round robin at the DNS level. Unfortunately, the Azure load balancer doesn't accept two load balancing rules with the same port and backend pool.

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-08-20T11:47:09.4533333+00:00

@Frederic Marchal , Thanks for keeping us posted.

Sure, let us know how this goes.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Inefficient load balancing from NATed network

1 answer

Your answer