Load Balancing terminal servers

[joebrug]

Hey all,

I've inherited a bit of an outdated mess that I'm working towards solving, but first things first. Currently have two (2003) Terminal Servers running as VMs using Microsoft NLB (in multicast mode) to cluster the two together. They also use Session Directory, so if a user gets disconnected, they get placed back on the same server. The users connect from their homes to the external NAT'd ip address of the cluster. 

I've noticed in wireshark, that NLB is spewing packets to every computer on the LAN all day, every day.

In an effort to stop that, I wanted to use the Fortigate's 200D 5.2.6fw Load Balancing using Least Session option instead of NLB. I set up the virtual IP address (external), added the two Terminal Servers as "Real servers" and it works just fine. However, I can't get Session Directory to work.. if I disconnect my session and try to reconnect, the Fortigate will load balance me and put me on TS2, but the Session Directory tries to connect me to my existing session on TS1 and fails.

Can't figure out how to get this working.. Any ideas? Users get disconnected all the time, so cant really just have them start a new session and lose all their work thats currently running on their first connection/server.

Thanks in advance!

[joebrug]

No one? :) surprising

[echo]

I think the best you can do is to try different ldb-method's in vip configuration and if they don't work then FG just don't support this feature. On the other hand, how should FG know that this particular user was previously connected to this certain TS? If there isn't any user authentication from FG's side nor remembering/buffering (previous) sessions from the same IP, or something else like that, I don't know how this should work at all. CLI reference file gives many options to consider but I haven't used such configuration so I can't give any direct instructions.

[Antonio_Milanese]

Hi Joe,

your problem it's a well known one when you try build a loadbalancer for an RDP farm:

you cannot simply rely on IP affinity to load balance an RDP session as far as  Session Directory (or Connection Broker nowadays) is configured in your deployment since the LB algo persistence (with collaboration of RDP client) will use a routing token (also referred ad RDP cookie in not recent Windows) for stikyness/session reconnetion:

anyway AFAIK Fortigate LB code do not support RDP cookie persistence so you have to :

1) - preferred - setup a >= Windows 2008 R2 RDS Gateway and load balance HTTP requests with IP affinity

2) use a LB RDP aware such as HAPROXY:

http://loadbalancer.org/blog/load-balancing-windows-terminal-server-haproxy-and-rdp-cookies

if you choose the latter be advised that plain RDP cookie has been deprecated/broken/fixed in the RDP client above 7.x (now Windows 2012 and above use a session hint routing token) and so it can not work as expected!

Regards,

Antonio