Dynamically optimizing weighted load balancing according to how busy cluster units are
In conjunction with using static weights to load balance sessions among cluster units you can configure a cluster to dynamically load balance sessions according to individual cluster unit CPU usage, memory usage, and number of HTTP, FTP, IMAP, POP3, SMTP, or NNTP proxy sessions. If any of these system loading indicators increases above configured thresholds, weighted load balancing dynamically sends fewer new sessions to the busy unit until it recovers.
High CPU or memory usage indicates that a unit is under increased load and may not be able to process more sessions. HTTP, FTP, IMAP, POP3, SMTP, or NNTP proxy use are also good indicators of how busy a cluster unit is, since processing high numbers of these proxy sessions can quickly reduce overall cluster unit performance.
For example, you can set a CPU usage high watermark threshold. When a cluster unit reaches this high watermark threshold fewer sessions are sent to it. With fewer sessions to process the cluster unit’s CPU usage should fall back to the low watermark threshold. When the low watermark threshold is reached the cluster resumes normal load balancing of sessions to the cluster unit.
You can set individual high and low watermark thresholds and weights for CPU usage, memory usage, and for the number of HTTP, FTP, IMAP, POP3, SMTP, or NNTP proxy sessions.
The CPU usage, memory usage, and UTM proxy weights determine how the cluster load balances sessions when a high watermark threshold is reached and also affect how the cluster load balances sessions when multiple cluster units reach different high watermark thresholds at the same time. For example, you might be less concerned about a cluster unit reaching the memory usage high watermark threshold than reaching the CPU usage high watermark threshold. If this is the case you can set the weight lower for memory usage. Then, if one cluster unit reaches the CPU usage high watermark threshold and a second cluster unit reaches the memory usage high watermark threshold the cluster will load balance more sessions to the unit with high memory usage and fewer sessions to the cluster unit with high CPU usage. As a result, reaching the CPU usage high watermark will have a greater affect on how sessions are redistributed than reaching the memory usage high watermark.
When a high watermark threshold is reached, the corresponding weight is subtracted from the static weight of the cluster unit. The lower the weight the fewer the number of sessions that are load balanced to that unit. Subsequently when the low watermark threshold is reached, the static weight of the cluster returns to its configured value. For the weights to all be effective the weights assigned to the load indicators should usually be lower than or equal to the static weights assigned to the cluster units.
Use the following command to set thresholds and weights for CPU and memory usage and HTTP, FTP, IMAP, POP3, SMTP, or NNTP proxy sessions:
config system ha
set mode a-a
set schedule weight-round-robin
set cpu-threshold <weight> <low> <high>
set memory-threshold <weight> <low> <high>
set http-proxy-threshold <weight> <low> <high>
set ftp-proxy-threshold <weight> <low> <high>
set imap-proxy-threshold <weight> <low> <high>
set nntp-proxy-threshold <weight> <low> <high>
set pop3-proxy-threshold <weight> <low> <high>
set smtp-proxy-threshold <weight> <low> <high>
end
For each option, the weight range is 0 to 255 and the default weight is 5. The low and high watermarks are a percent (0 to 100). The default low and high watermarks are 0 which means they are disabled. The default configuration when weighted load balancing is enabled looks like the following:
config system ha
set mode a-a
set schedule weight-round-robin
set cpu-threshold 5 0 0
set memory-threshold 5 0 0
set http-proxy-threshold 5 0 0
set ftp-proxy-threshold 5 0 0
set imap-proxy-threshold 5 0 0
set nntp-proxy-threshold 5 0 0
set pop3-proxy-threshold 5 0 0
set smtp-proxy-threshold 5 0 0
end
| When you first enable HA weighted load balancing, the weighted load balancing configuration is synchronized to all cluster units and each cluster unit has the default configuration shown above. Changes to the CPU, memory, HTTP, FTP, IMAP, NNTP, POP3, and SMTP thresholds and low and high watermarks must be made for each cluster unit and are not synchronized to the other cluster units. |
When you configure them, the high watermarks must be greater than their corresponding low watermarks.
For CPU and memory usage the low and high watermarks are compared with the percentage CPU and memory use of the cluster unit. For each of the UTM proxies the high and low watermarks are compared to a number that represents percent of the max number of proxy sessions being used by a proxy. This number is calculated using the formula:
proxy usage = (current sessions * 100) / max sessions
where:
current sessions is the number of active sessions for the proxy type.
max sessions is the session limit for the proxy type. The session limit depends on the FortiGate unit and its configuration.
You can use the following command to display the maximum and current number of sessions for a UTM proxy:
get test { ftpd | http | imap | nntp | pop3 | smtp} 4
You can use the following command to display the maximum number of sessions and the and current number of sessions for all of the proxies:
get test proxyworker 4
The command output includes lines similar to the following:
get test http 4
HTTP Common
Current Connections 5000/8032
In the example, 5000 is the current number of proxy connections being used by HTTP and 8032 is the maximum number of proxy sessions allowed. For this example the proxy usage would be:
proxy usage = (5000 * 100) / 8032
proxy usage = 62%