Add intelligence to your network with new approaches to Layer 7 traffic management

Hardware and software-oriented approaches to network traffic

New Asset  

Hardware and software-oriented approaches to network traffic




Forget unlimited bandwidth, forget port density - let's talk about adding intelligence to the network in the form of Layer 7 traffic management.

This is not about simple network management protocol and device management, but rather about controlling network traffic flows, changing packet contents, reserving bandwidth on demand and many more on-the-fly activities. This is where networking gets intelligent and programmable and it presents you with a choice. F5 has proposed a classic hardware-oriented approach, whereas Zeus has offered the option of a software-only design to run on Linux or Unix platforms or a hardware appliance format.

Revolution - not evolution - is long overdue in networking, yet it need not be bloody. We have a situation where, with the kind of capabilities now on offer, it is possible to completely re-engineer the network, but over as long a period of time as you need.

This approach to traffic management provides us with endless real applications, such as a true migration toolkit, whether that be with respect to IPv6, moving between enterprise software applications, changing authentication servers and services or any scenario where a change for the better should be made, but previously would have been too painful, in terms of time and cost, to consider.

F5 Networks V9 Big-IP 6800

F5 was one of the early specialists in the L4-L7 traffic management market with its Big-IP range of devices. What started life as essentially a gateway product has since progressed through two effective transformations to the product range we see now - the V9 range - a completely re-architected version of its still available V4.5 product line-up.

So what is new? Well, everything. Even the management GUI - always one of our favourite features - has been completely updated to cope with the mass of new features you can configure. And there are plenty.

The range starts with the Big-IP 1500, leading to the 6800 top-end product we are focusing on here. All have the same basic feature set in common, but lower down the range some features come as optional extras. For the first time, F5 has added compression to its Big-IPs, something that its competition has had in place for some time.

But F5 has not stopped there. Another new feature with V9 is Rate Shaping, which allows for traffic limiting, prioritisation and borrowing for maintaining enough bandwidth and fast service for high-priority applications and traffic. One problem for servers is that their load is often increased because they must handle many clients concurrently, each at different speeds. So with V9, F5 has introduced Content Spooling to the Big-IP system, which enables it to accept and buffer the complete server response, allowing the server to free the associated resources immediately.

The Big-IP device delivers the data to the client as fast as it can receive it. This allows the server to send data at its optimum rate and the client receives data at its optimum rate.

The Big-IP can convert IPv6 client traffic to IPv4 node traffic and back to IPv4 client traffic (and vice versa). It allows you to mix IPv6 and IPv4 nodes in the same pool. You can also have both an IPv6 and IPv4 virtual server direct traffic to that pool, ideal for migration scenarios.

Another addition is response error handling. With V9, the Big-IP device can look at any server response code such as standard 404 errors, or custom server errors such as 900 errors, and make decisions based on observing server responses. Businesses can use the iRules scripting language F5 has carried over and further developed from the previous architecture to customise actions to be taken, such as redirecting the request to another location or reload balancing the request back to the pool to servers with valid content.

This resolves the common problem of leaving many legitimate users directed to a resource that has been down for several minutes. The software creates an observed monitoring capability that can see all errors and take corrective action to redistribute requests before that error is transmitted to a user.

And so the list of new or improved features goes on. Security-wise, two interesting additions are protocol sanitisation and resource cloaking. The former is achieved by the Big-IP acting as an application proxy to protect against various denial of service attacks and all other forms of unanticipated malformed packets by default. It can detect and block any attack using iRules.

So what is resource cloaking? Well, there is a lot - repeat, a lot - of information about your network passing across the internet in headers which can provide valuable information for network terrorists.

To nullify this, the Big-IP can be configured to block response headers or portions of the headers which contain information about a web server, for example, important libraries or the language an application was written in. Most users do not want to broadcast they are using IIS or Apache servers, yet typically this kind of information is present in a server header. With Big-IP you can hide this information during a transfer.

The re-architecting of the product range has not only brought a load of new features but also a massive increase in performance, said F5. So we put it to the test with the 6800 model, creating a huge test bed and plan covering more than 150 tests, many based on direct feedback from F5 customers, asking what they would like to see the product achieve.

One area where F5 was making very bold claims was in Secure Sockets Layer (SSL) transaction handling. This is where the L7 device terminates the SSL sessions itself, relieving the servers behind it of that duty - one that kills server processes stone dead. Prior to this testing, anything we have seen that achieves 5,000tps (transactions per second) has been given a large nod of approval.

However, the 6800 in a test set-up with no SSL session ID reuse (not real-world but easily the toughest test for the device) recorded 16,494tps. With a more realistic 10-session ID re-use set, that figure rose to 23,533tps. These are big numbers and come courtesy of dedicated ASICs (chips that accelerate specific functions) within the box.

Across all the tests we ran, performance was outstanding and a huge leap over the previous generation of Big-IPs. For example, L7 connections per second peaked at almost 110,000tps and overall L7 throughput levels reached almost 4gbps - more than ample for the biggest enterprise applications.

Overall, it is fair to say we were very impressed with F5's total reworking of its Big-IP products. We liked the old range, but it does look positively antiquated against the new V9 release which is a huge leap forward.

Details: F5 Big-IP 6800. Price: from £38,610 (£48,771 fully loaded as tested).


Zeus ZXTM 3.0

The name Zeus might be familiar to those of you who know the Webserver product, itself at the heart of the mighty eBay engine - but with respect to Layer 7 traffic management? No, didn't think so.

Based in the UK, Zeus has taken the software engineering that went into the Webserver product and subsequent load balancer to form the basis of its entry into L7 traffic management. The Zeus' ZXTM (Zeus Extensible Traffic Manager) is a software application designed to run on a number of listed supported Unix and Linux platforms. You can even download this one for free evaluation from the Zeus website and then keep it if you like it (as long as you pay up).

It operates at both L4 (load-balancing) and L7, so there is no denying it is in direct competition with the likes of F5 Networks' Big-IP application switch, which we tested alongside it. However, ZXTM 3.0 is not a switch but effectively a server-based network appliance which just happens to be sold as software. It therefore typically sits in front of the server farm, behind the internet gateway, from where it conducts traffic in a wide number of ways.

ZXTM's feature set is extensive, covering intelligent L7 load-balancing and every aspect of L7 traffic management: throughput, compression, data manipulation, security - such as denial of service protection - server and application optimisation and migration tools.

The company has unashamedly looked at F5 as the market leader and sought to equal or better every element of its own products. The result is what would be a very comprehensive set of capabilities for a mature product, let alone a new kid on the block. One excellent example of this attention to detail lies in ZXTM's Trafficscript feature for deep-packet inspection and manipulation.

This is quite simply the most comprehensive, rules-based methodology for traffic control available on anything we have seen. Configuration and deployment tools are very important with the fairly complex products in the L7 world. ZXTM comes with a first-class GUI and basic configurations literally take minutes. An excellent feature is a diagnose button, which checks you have configured the system correctly via a single mouse button click. And, in the event of any problem in the cluster, the diagnostics report gives a complete summary of the state of the cluster.

It runs a number of tests on each ZXTM machine to determine connectivity and configuration problems, platform/ licence incompatibilities and fault intolerance. Where possible, the page includes links to tools to resolve the problems it has found.

Another feature is ZXTM's draining nodes, which let you gracefully take servers out of an active pool without cutting user connections. Equally important on the scalability side is Zeus' N+M scalability, where near infinite redundancy and scalability has been achieved. Adding an additional ZXTM to a cluster is simple, as a new ZXTM is automatically detected by the existing cluster and the configuration is automatically replicated. This makes scalability very cost effective as you only have to buy one additional ZXTM if that is all you need and very easy at the same time.

ZXTM 3.0 arrived, pre-installed on a couple of Sun servers running Linux - dual Opteron devices in this case, but of course you can spec the hardware according to your own performance requirements.

We looked to put ZXTM 3.0 to the test in intelligence scenario tests and performance tests. For the intelligence tests, we looked at two really fascinating applications. The first was the problem of when searching on Google you get a "page not found" message. One way around this is to use ZXTM to intercept the page request and route it to the new site, transparent to the user. This involves creating a simple rule that examines the request, identifies the old link and rewrites it with the new link and forwards the request.

The second application test may be a familiar scenario to anyone who has a website with a somewhat inferior search engine. There is this monster called Google that is staggeringly capable of returning search results about almost anything within microseconds. So wouldn't it be cool to simply front-end the Google engine with your search utility and take advantage of its great power?

For the time being Google allows you to issue an XML request to its Soap interface and get a Soap request back. For free. So we used ZXTM's Trafficscript's ability to embed XML requests and translate Soap responses. What we ended up with is a perfectly formatted page of search results that looks like it was delivered by your own search engine but was actually delivered via Google.

Using Spirent's Webavalanche and Webreflector internet traffic simulators, we ran a series of performance tests, looking at maximum requests per second, SSL session termination, maximum throughput and compression (rates and throughput).

In all instances, ZXTM 3.0 performed to class standards, either literally or on a price and performance basis. We achieved 87,512 requests per second, 19,835tps compressing html pages at a 9:1 compression ratio, 2.6gbps of sustained L7 throughput and 8,511 SSL tps (10 session ID reuse).

Price and performance indexed against the Big-IP 6800 translates into figures of 227,531 requests per second, 51,571tps of compression, 6.8gbps of sustained L7 throughput and 21,000 SSL tps. Given Zeus' scalability claims, this augurs well for future tests where we will be looking at a clustered ZXTM configuration to see if we can get record figures in each category.

In summary, ZXTM 3.0 met or surpassed all our targets, both for performance and feature flexibility. As such, we recommend it to anyone looking at L7 traffic management devices without hesitation. And if you do not think you need such a device, use your imagination and take a look anyway.

Details: Zeus ZXTM (Zeus Extensible Traffic Manager) 3.0. Price: from £4,400 (£12,100 plus hardware as tested, fully-loaded).

Read more on IT strategy