Load Balancing Server AAA Session State
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional load balancers are inadequate for handling complex protocols like Extensible Authentication Protocol (EAP), particularly in maintaining state information across extended user sessions, leading to authentication failures and increased CPU and network bandwidth usage due to the inability to ensure all messages are sent to the same AAA server.
Innovation Solution
A load balancing method that uses a Load Balancing Server (LBS) to associate remote supplicants with specific AAA servers based on unique identifiers, such as MAC addresses, ensuring all messages are routed to the same server, and employing modulo operations to distribute workload efficiently across multiple AAA servers, with failover and fail-back capabilities to maintain session state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional load balancers use random load balancing techniques between AAA servers, then workload distribution is achieved, but authentication failures occur because sequential EAP messages are sent to different servers
Solution Approach 1:
The load balancer performs preliminary actions by establishing a sticky session mapping between client identifiers and AAA servers before EAP message exchanges begin. This pre-association ensures that all subsequent messages from the same client are directed to the same AAA server, preventing authentication failures caused by state loss.
Solution Approach 2:
The load balancer acts as an intermediary that intercepts EAP messages, maintains session state information, and forwards messages to appropriate AAA servers. This intermediary function allows the system to maintain session continuity across multiple message exchanges while still distributing load across multiple servers.
2Reliability
If sticky timers are used to tie traffic to a given AAA server, then session state is maintained for the timer duration, but re-key exchanges occurring after timer expiration are sent to different servers
Solution Approach 1:
The load balancer implements dynamic session management by extending sticky session durations based on actual EAP message exchange patterns rather than fixed timer expiration. The system adapts session persistence dynamically, maintaining bindings until authentication completes or explicit session termination occurs, thereby covering the full duration of extended EAP sessions including re-key exchanges.
3Device complexity
If load balancers cannot maintain session state across multiple EAP messages, then simple load distribution is achieved, but CPU usage and network bandwidth increase due to repeated authentication exchanges
Solution Approach 1:
The load balancer implements self-service mechanisms by maintaining local session state caches that allow it to make routing decisions without querying AAA servers for session information. This self-contained approach reduces the need for repeated authentication exchanges and minimizes both CPU usage and network bandwidth consumption while maintaining simple load distribution.
Data Source
AI summary
A method and apparatus for load balancing within a computer system makes use of client MAC addresses, reduced modulo N, to direct client requests to a particular server within a server farm. The method is particularly applicable to load balancing applied to AAA servers. In the preferred embodiments, the method can handle failovers and fail-back with few or no aborted authentications.