Load Balancing SolarWinds Web Connections

Hi Guys

Our setup:

1 x MPE server

5 x APE servers

3 x AWE/S servers

We currently have an F5 Load Balancer, simple configuration which we want to remove because quite frankly, we're not even sure why it is even implemented, other than to distribute User connections to the Web Console.

We are also trying to implement Okta SSO MFA which works perfectly in our Test environment, which Doesn't have an F5 implementation.

To reconfigure the F5 to supplement or support the Okta SSO, is not going to work with our very OLD version of F5.

To be honest, we don't have many users connecting into SolarWinds at the moment and my question is this.

Is there a way whereby we can simply distribute User Web Connections to SolarWinds via a SW Web Server without a Load Balancer. For example, some kind of IIS/Web Server cluster for the 3 x AWS/E servers, with a virtual address/server between the User and Web Server, so that we can implement Okta SSO?

In advance, thank you for your support.

Find more posts tagged with

additional web server

load balancer

okta

sso

Comments

KMSigma.SWI

Any Load Balancer (Physical or Software) should be able to work if it offers Session Persistence (nginx simple example). In the past, I've helped customers configure F5's Cisco ACE, NginX, Citrix NetScaler, and a few others. The biggest thing to do it make sure that if you are using weighted or round-robin assignment, you still use session persistence so that if USER1 are connected to SWAWS01 via HTTPS, they will continue to be connected there until their session ends.

What's also nice about using the Load Balancer, is that some services (like the SolarWinds Information Service) can also be configured to be sticky this way (but with different TCP ports of course).

bootneck1111

After having a call with our F5 engineer today, it seems that although Load Balancing is in play at the moment using a simple configuration, and the version has just been updated, he doesn't believe that the company are going to be spending anymore money on the F5.

I talk about money because, what we currently have is a F5 LTM (Local Traffic Manager), but to implement Okta SSO we're going to need an F5 ASM (Application Security Manager), either Virtual, or hardware application cluster, due to cost restrictions.

Okta SSO works in our test environment (without an F5), and we need this to be implemented onto the LIVE environment.

I was looking at something simple such as Windows Server Failover Clustering which has 3 options;

1. Microsoft Cluster Service (MSCS), a HA clustering service (Not Needed. )

2. Component Load Balancing (CLB)

3. Network Load Balancing Services (NLB)

So an Active instead of passive load balancing whereby the request can be interpreted by a request URL and redirect the request to different servers based on request URL.

Would this work?

KMSigma.SWI

NLB should work fine since it behaves much like a physical network load balancer. Just be aware of the number of NICs, their configuration, and the DNS settings necessary. It's not overly difficult, but you should take time to test.

I'd (personally) steer away from CLB and MSCS. Cluster Services is overly complicated for your needs and Component Load balancing can get a little complex. Are either viable, yeah, probably, but more work than they are worth in my opinion.

Scratch all of that. I was mentally swapping NBL for ARR. (More details)

It's not that difficult to setup, but a very small nginx server acting as a load balancer is much easier (IMHO).

bootneck1111

Thanks KMSigma, so your advice is a small nginx server instead of ARR to load-balance, and with that, we will, or shouldn't have any issues setting up SSO via Okta through this configuration? Okta SAML SSO is the main objective through LB.