3

Can anyone explain what the impact is of enabling “preserve source address” inside the Network Load Balancer? Our customer’s NLB vendors are;

  1. F5
  2. Netscaler

I've been asked this by one of my customers. Though I've googled about it I've got no idea how it really impacts.

3

I'm not familiar with Netscaler, so take this with grain of salt.

I presume you are using NAT to translate source address of request today, so actual server is not seeing today real request address but some single NAT address translated by Netscaler. I also presume that his toggle would remove that source address NAT, allowing your servers to see real request address.

There are some scenarios where one would want to NAT the request address, such as if for redundancy purposes you want to connect your server to two or more SLB devices simultaneously (who would ECMP the VIP, i.e. both SLB are hot:hot, but not connected to each other in anyway). Then when your server replies to a request, it needs to reply via same interface where the original query came in from.

On Linux machines you can fix this easily, without relying on natting the source at SLB.

On Windows server, you wouldn't really have any way to return the request back to the SLB which sent it, unless you NAT each request. If SLB1 NATs source to 192.0.2.1 and SLB2 NATs source to 192.0.2.2, then it's just matter of setting static route in windows, 192.0.2.1/32 pointing to SLB1 and 192.0.2.2/32 pointing to SLB2. This way you are always returning packet back to the SLB which sent the request.

3
  • Thanks for your reply. However, can you please let me know if we select "preserve source address" it means we are not using/replacing NAT or otherwise it also preserves source IP event after the request undergone NATing. So that Server will be aware of actual Source IP and NAT IP. Sorry, I'm still not clear if we enable "preserve source address" option this would disable NAT process ? or if this is an extra feature apart from NATing ? Thanks, – Sandy May 28 '13 at 5:18
  • Means if we enable "preserve source address" inside NLB what is good and bad about doing this action ? For instance, Good Part is : If server should have the visibility of the source(client) IP address then enabling this option helps it. like wise if I get few good and bad points with respect to this option will be more useful and insightful to me. Thanks Again for your time and help. - Sandy – Sandy May 28 '13 at 5:37
  • Unfortunately I'm only speculating, as I'm not familiar with the product. But if it does what I think it does (disable Source NAT). It's generally very good thing, as server logs will show correct client IP. But if the deployment relies on the scenario I explained, disabling source NAT would break the service. – ytti May 28 '13 at 6:16
2

The impact from this depends on where your servers are located in relation to the LB and the client.

If the client is in front of the LB and the server behind such that return traffic (server-to-client) has pass through the LB then there shouldn't be any impact.

If the client and server are both in "front" of the LB then you have to NAT the source address to an IP on the LB so that the return traffic comes to the LB. In this case if the application needs to see the clients IP you can have the LB insert it into an HTTP header (assuming HTTP of course) such as HTTP_FORWARDED_FOR. If it's not HTTP then I'm not aware of a way to make it work without NAT.

2

This is really a design decision and you have already gotten some good answers. There are many reasons to do both, but here are a couple for doing it either way.

If you have multiple load balancers in some sort of active/active state, you would want to leave this disabled so that the servers behind the load balancer respond to the correct load balancer. If they were to send traffic back to the wrong load balancer, this could create problems (again based on design).

However if your servers are doing logging or need to use the actual source address in any responses, then turning this on will be required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.