Hi,
We deploy some Fortigates in some remote (to us) continents and since we have those appliances soon on site, we were looking into making use of SLB on them, but what I discovered is that Fortigates are missing some crucial basic load balancing items, that today are considered standard:
Http probes are not usable, host header a mandatory feature in 2017
- Response code check for range (200-499) or individual code (401) not possible
Many times we have a response code 401 and there is no content to match, so probes with match content, cannot be used
most of the services will be HTTPS and we will not be able to do a health monitoring, except TCP, not acceptable in 2017
- SSL Bridging but SSL Session ID stickiness
Something not clear to me, have not seen a way to do https load balancing without SSL Decryption, all documentation points to that Fortigate will always need to decrypt all SSL. If as you say “SSL Bridging (no decryption) with SSL Session ID stickiness is possible”, please provide an example. TCP Load balancing will not work as no SSL Session ID stickiness.
For us a modern platform should implement the above features in 2017, most of them are considered basics and even should be supported on Fortigate. Fortigate does a good job with many of the features, but becomes quite useless except for the most basic setups. And no we cannot affort to purchase FortiADC at those locations.
By the way, since some of the platforms already support SSL Offloading, why not add real L7 load balancing, so that we can have different farms per path and how abou backup server farms?
Why do we even care? Well now even in remote small locations the basic load balancing need has increased, some small setups with Exchange want to be able to properly load balance EAS / OWA.
Regards,
Pat
And yes, again, no we won‘t deploy any FortiADC for those use cases.
