[22648] in Kerberos
Re: Kerberos behind load balancer?
daemon@ATHENA.MIT.EDU (Frank Cusack)
Wed Oct 6 16:48:21 2004
From: Frank Cusack <fcusack@fcusack.com>
Date: Wed, 06 Oct 2004 13:43:34 -0700
Message-ID: <x5yvfdnvaq1.fsf@mother.corp.google.com>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Wed, 6 Oct 2004 19:31:19 +0000 (UTC) jthardy@uta.edu (Jason T Hardy) wrote:
> I guess the problem that everyone is having with our deployment is the
> term load-balancer. We don't actually want to easy the load off of our
...
Good, because:
> You'll say that DNS is the answer. I would agree. The problem is, we
> don't have access, or support from the folks controlling our DNS, to add
> the SRV records which would simplify the whole mess. Since we already
> have a load balancing switch (NetScaler) around for other purposes,
> we're trying to use it in place of doing things properly. :-)
The netscaler can only do 325k UDP qps, and this is the big netscaler
(9900) without any other load on it. So putting a netscaler in front
of your KDCs actually reduces service capacity.
Availability, as mentioned earlier, is already dealt with quite well
in the libraries. (But really requires the ability to play with DNS.)
/fc
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
