Load balancing and sessions

Question

What is the better approach for load balancing on web servers? My services run in .NET and Mono, so they could be hosted on IIS or Apache2, and the will have to provide SSL connection.

I've read two main approaches, store the state in a common server and use sticky sessions, there is any other else?

I've read 3 diffent things about sticky sessions:

1)the load balancing device will know with which server did you start the connection and all the further connections from that host will be routed to the same server.

2)the load balancing devide read a cookie named: JSESSIONID

3)the load balancing devide read a cookie named: ASPSESSIONID

I'm a little bit confused, what will happen exactly? As the connections will be SSL there is not a chance for the load balancing devide of read the cookies, so then what?

About store the estate in a common server, what solutions do you know? I've read memcache is a good solution but is there any other else?

Cheers.

Answer 1

When using SSL with a load balancer, it is common to put the SSL certificate on the load balancing server, and not on the back end servers. In this way you only need 1 certificate on 1 server. The load balancer then talks to the back end servers using plain HTTP. This obviously requires that your back end servers are not directly accessible from the internet.

So, if the load balancer is responsible for decrypting the request, it will also be able to inspect the request for a jsessionid.

Sticky sessions work well with Apache as load balancer. You should check out the Apache modules mod_proxy and mod_proxy_balancer.

Answer 2

Generally SSL load balancing means that the client is talking to the load balancer over HTTPS, and the load balancer is talking to the web server via HTTP.

Some load balancers are smart enough to establish an SSL session with the web server (so it can read cookies) and maintain a separate SSL session with the client.

And, some load balancers can maintain stickiness without using web server cookies. My load balancers are able to send their own cookies to the client (they have a bunch of other stickiness settings as well).