At the moment, we are using Azure Traffic Management to provide Load Balancing and High Availability across multiple regions for Azure App Services deployed on App Service Environments. We have reduced the Traffic Manager TTL to 30 secs. However, some of the clients have DNS cache (4 hours TTL) which we cannot control and this impacts the availability of our solution.
What would be a good alternative to provide HA and LB to Azure App Services which does not rely on DNS? We have seen on the documentation that MS suggests third-party solutions, but are there any particular suggestions?
Thanks,
As you point out, Azure Traffic Manager operates in the DNS layer. If you are looking at managing multiple endpoints for high availability and load balancing outside of DNS layer, I would recommend considering Azure Application Gateway (for HTTP workloads) and / or Azure Load Balancer (for any layer 4 (TCP, UDP) load balancing).
You may also find this article on Combining Load Balancers in Azure relevant for your use case
Related
Note: I'm still in learning phase.
Question: For the scenario described below, in the Load Balancing Settings for the two VMs for the FrontEnd subnet should I choose Application Gateway or Azure Load Balancer?
In Azure portal, when I create the VMs for FrontEnd, the Networking tab of the wizard, gives me two choices shown below:
Why the confusion:
For Load Balancing Internet Traffic to VMs, this tutorial does not choose Application Gateway. But the 5th bullet of the following scenario seems to indicate I should choose Application Gateway
Scenario
This tutorial from official Azure team describes designing an infrastructure for a simple online store as follows:
The above configuration incorporates:
A cloud-only virtual network with two subnets (FrontEnd and BackEnd)
Azure Managed Disks with both Standard and Premium disks
Four availability sets, one for each tier of the online store
The virtual machines for the four tiers
An external load balanced set for HTTPS-based web traffic from the Internet to the web servers
An internal load balanced set for unencrypted web traffic from the web servers to the application servers
A single resource group
you can use both, its a matter of your needs. load balancer just forwards traffic to your vms, while application gateway can do path based routing, ssl offloading, has WAF capabilities, and so on. But it costs a lot more and is clunky.
Looking at the bullet points you've listed, your case will work with both of these solutions.
ps. Like Rahul mentioned, load balancer works on level 4 and is not HTTP aware, Application Gateway is a level 7 load balancer.
I am starting to read documentation on Azure Networking and every single example evrywhere gives an example of 2 Virutal Machines and then explains be it subnet, Traffic Manager, Load Balancer etc
Maybe its a dumb question But Can I do Load Balancing for Azure App Services, Azure DB, Storage Account etc without Virtual Machines ?
For PaaS services you cannot use load balancing for the most part, because it makes no sense. you would need to replicate data on your own. if you are to load balance between PaaS services. besides thats the idea behind PaaS, you dont have to care about PaaS. it just works.
But for webapps (and it makes sense) you can use load balancers\application gateway\traffic manager to balance load.
You need to understand network design and build a theory behind it.
Now, load balancing is required for HA and redundancy in a network, beyond which you extract the capability of the load balancer based on your requirements/Application.
So, PaaS services are not managed by completely by the user. You are paying a premium for using them and they will come with a built-in redundancy which you should opt for during deployment.
Load Balancing on Azure is Primarily "configurable" for IaaS only.
If two logic apps are there in two different regions and I want to do load balancing between these two how to do this.
Through some source, I got to know that it is possible through API management but they have not mentioned how to do this.
So, how to do load balancing between two logic apps?
Well...why do you want to do this? "Load Balancing" especially with LogicApps is fundamentally different on Azure than on-premise or self hosted. It's not wrong, just different ;)
What they were probably referring to was Azure Load Balancer which appears as a Networking Service, not APIM.
This, you can use to distribute requests as you would with traditional load balancers.
Since you want to load balance across regions I would look into Azure Traffic Manager. Traffic Manager is a DNS load balancer that sits outside/above Azure regions and allows you to have traffic balanced based on various performance profiles (i.e. Weighted, Performance, etc.)
High Level / General steps are:
Setup Logic Apps in 2 Regions
Create and register public dns domain for the logic apps - apps.foo.com (done outside Azure typically)
Point your DNS record for apps.foo.com to Azure Traffic Manager
Add endpoints to Azure Traffic Manager for Logic App in Region 1 and Logic App in Region 2 and setup your traffic manager profile
Calls to the Logic App start with the custom DNS domain get routed to ATM which then distributes to the regions based on your configured profile.
We've got an API micro-services infrastructure hosted on Azure VMs. Each VM will host several APIs which are separate sites running on Kestrel. All external traffic comes in through an RP (running on IIS).
We have some API's that are designed to accept external requests and some that are internal APIs only.
The internal APIs are hosted on scalesets with each scaleset VM being a replica that hosts all of the internal APIs. There is an internal load balancer(ILB)/vip in front of the scaleset. The root issue is that we have internal APIs that call other internal APIs that are hosted on the same scaleset. Ideally these calls would go to the VIP (using internal DNS) and the VIP would route to one of the machines in the scaleset. But it looks like Azure doesn't allow this...per the documentation:
You cannot access the ILB VIP from the same Virtual Machines that are being load-balanced
So how do people set this up with micro-services? I can see three ways, none of which are ideal:
Separate out the APIs to different scalesets. Not ideal as the
services are very lightweight and I don't want to triple my Azure VM
expenses.
Convert the internal LB to an external LB (add a public
IP address). Then put that LB in it's own network security
group/subnet to only allow calls from our Azure IP range. I would
expect more latency here and exposing the endpoints externally in
any way creates more attack surface area as well as more
configuration complexity.
Set up the VM to loopback if it needs a call to the ILB...meaning any requests originating from a VM will be
handled by the same VM. This defeats the purpose of micro-services
behind a VIP. An internal micro-service may be down on the same
machine for some reason and available on another...thats' the reason
we set up health probes on the ILB for each service separately. If
it just goes back to the same machine, you lose resiliency.
Any pointers on how others have approached this would be appreciated.
Thanks!
I think your problem is related to service discovery.
Load balancers are not designed for that obviously. You should consider dedicated softwares such as Eureka (which can work outside of AWS).
Service discovery makes your microservices call directly each others after being discovered.
Also take a look at client-side load balancing tools such as Ribbon.
#Cdelmas answer is awesome on Service Discovery. Please allow me to add my thoughts:
For services such as yours, you can also look into Netflix's ZUUL proxy for Server and Client side load balancing. You could even Use Histrix on top of Eureka for latency and Fault tolerance. Netflix is way ahead of the game on this.
You may also look into Consul.io product for your cause if you want to use GO language. It has a scriptable configuration for better managing your services, allows advanced security configurations and usage of non-rest endpoints. Eureka also does these but requires you add a configuration Server (Netflix Archaius, Apache Zookeeper, Spring Cloud Config), coded security and support accesses using ZUUL/Sidecar.
Fast question is it possible to have Azure Traffic Manager
I would like to rent dedicated servers in 3rd party suppler and to load balancer from Azure
Question 1:
Can I setup this scenario? and use the load balancer from Azure?
Question 2:
Will I pay Outgoing bandwidth
Question 3:
Will you share for website with 10 000 000 page views per month how much you pay for DNS look ups as average.
Question 4 please suggest same service competitors... Google, Amazon, Rackspace I already know
The link you provided to the article already answers #1 and #3. Yes you can set this up. Billing is done by DNS lookup at $0.75 per million lookup, so your 10m page views will cost at most $7.50, but this isn't taking into consideration DNS caching which will drastically lower this (already very low) cost.
Question 2 is not an Azure Traffic Manager related question. No bandwidth goes through ATM so there is no charge. I am sure you will pay bandwidth charges with whatever 3rd party datacenter provider you are going to use.
I don't understand question 4. What do you want suggestions for? A cloud provider? There are lots of good ones but it depends on your scenario.
Azure Traffic Manager is a DNS routing system. It is similar to the routing features of AWS Route 53 (although Route 53 is a more full-featured DNS system).
Azure Traffic Manager uses DNS to point incoming traffic to different endpoints, which can be either within Azure or external urls. Because it uses DNS, it doesn't actually see any of the data itself, it just translates something like myapp.trafficmanager.net to 'webserver1.example.comorwebserver2.example.com` based on your rules and setup.
You can use round-robin, weighted or performance (which directs to the geographically closest address you have setup). You can further use Azure's DNS or another DNS system to use your own (sub)domain to CNAME to the trafficmanager.net domain name.
Load balancers like Azure Load Balancers and Amazon's Elastic Load Balancers are used to actually spread the traffic itself to different machines or services. Each work only with services hosted with the cloud provider so Azure Load Balancers can be used to load balance Azure VM's but not some servers you have hosted elsewhere.
Load balancers have bandwidth charges because they actually pass through the traffic. Azure Traffic Manager just has DNS query charges because that's all it does.
In your case, yes you can use Azure Traffic Manager to point to several external endpoints for your dedicated servers. You can also nest Traffic Manager profiles so that you can first use geo-location then round-robin. Azure Traffic Manager does support basic http/https monitoring to make sure the endpoint is still active.
Because it is based on DNS, there will always be a lag between changes with the TTL value and how clients cache DNS addresses. This is inherent with all DNS routing. To be extra safe, you can use Azure Traffic Manager to route to your datacenter and then run your own load balancing software locally to spread the load among servers.