NSX Load Balancing for VMware Unified Access Gateway – Part1

This blog post will be a two part series showing you step by step on how to load balance VMware Unified Access Gateway (UAG) using the VMware NSX. There are quite a few options such as F5, KEMP etc. available to do the load balancing of the UAG appliance but in this post we shall deep dive into NSX Load balancing. The objective in a production deployment is to load balance multiple UAG appliances deployed in the DMZ.

Load Balancing of multiple VMware UAG Appliances

There are plenty of guidance available on how to create the NSX Edge to do the load balancing. I am not going to cover those steps in this blog. Instead I will fast forward to the Load Balancing configurations required to do Unified Access Gateway.

Pre-Installation Checklist

This list should include everything that needs to be available BEFORE we start to install the UAG Load Balancer.

• A pair of UAG Appliances should be deployed
• The admin page of both the UAG appliances should be accessible
• Create a X-Large NSX Edge and make sure its deployed using HA (Active/Passive)
• Enable Syslog on the NSX Edge
• Reserve the VIP IP address used by NSX

Step-by-Step guide (Part1 – We shall cover Global Configuration, Application Profiles and Service Monitoring)

1. Configure the Load Balancing – Global Configuration

• Log into the Edge GW you need to configure and go to the Manage tab then the Load Balancer tab.
• Click on Global Configuration
  • Check the Enable Load Balancer checkbox
  • Check the Enable Acceleration checkbox
  • Check the Logging checkbox
  • Change the Log Level dropdown to Warning
  • Leave the rest as the default
  • Click Ok
    

2. Configure the Load Balancer – Application Profiles

• Overall we will be creating three Profiles – HTTPS, TCP and UDP as follows:
  
• Click on the green plus sign to add the HTTPS profile
  • Set the Name to XX_External-SSL_Offload
  • Set the Type to HTTPS
  • Set Enable SSL Passthrough
  • Persistent to Source IP
  • Expires in (seconds): 28800 (Preferably match it from Horizon Administrator – Global Configuration Settings)
  • Everything else should be blank, grayed out, or None
  • Click Ok
    
• Click on the green plus sign to add the TCP profile
  • Set the Name to XX_External-TCP
  • Set the Type to TCP
  • Persistent to Source IP
  • Everything else should be blank, grayed out, or None
  • Click Ok
    
• Click on the green plus sign to add the UDP profile
  • Set the Name to External-UDP
  • Set the Type to UDP
  • Persistent to Source IP
  • Everything else should be blank, grayed out, or None
  • Click Ok
    

3. Configure the Load Balancer – Service Monitoring

• Overall we will be creating three Service Monitors – HTTPS, TCP and UDP as follows:
  
• Click on the green plus sign to add the Access Point TCP Monitor.  This one monitor will be used for all APs.
  • Set the Name to default_tcp_monitor
  • Set the Interval to 5
  • Set the Timeout to 15
  • Set the Max Retries to 3
  • Set the Type to TCP
  • Click Ok
    
  • Click on the green plus sign to add the Access Point HTTP Monitor.  This one monitor will be used for all APs.
    • Set the Name to default_http_monitor
    • Set the Interval to 5
    • Set the Timeout to 15
    • Set the Max Retries to 3
    • Set the Type to HTTP
    • Set the Method to GET
    • Click Ok
      
    • Click on the green plus sign to add the Access Point HTTPS Monitor.  This one monitor will be used for all APs.
      • Set the Name to default_https_moinitor
      • Set the Interval to 5
      • Set the Timeout to 15
      • Set the Max Retries to 3
      • Set the Type to HTTPS
      • In the Expected field, type:  HTTP/1.1 200 (note there is a space between the 1.1 and 200)
      • Set the Method to GET
      • In the URL field, type /favicon.ico
      • Click Ok
        

Remaining configuration around the “Pools” and “Virtual Servers” to be continued in the NSX Load Balancing for VMware Unified Access Gateway – Part2

I hope you find these steps useful and don’t have to invent the wheel when it comes to NSX LB for VMware UAG.

Thanks,
Aresh