<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi,<div><br></div><div>I don't get it. How DNS round robin can help if each strong swan node has his own bind/ipaddress. If there will be a cluster (virtual ip) it make sense but without that it’s not the point or I’m missing somethings :-)</div><div><br></div><div>Thanks,</div><div>Pawel Grzesik</div><div><br></div><div><div><div>On 24 Nov 2013, at 15:57, <a href="mailto:J.Witvliet@mindef.nl">J.Witvliet@mindef.nl</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><font style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">
Hi,<br><br>As you are faced with thousands clients, i would suggest to get multiple strong-swan servers. (Just to avoid SPOF's) and use DNS-round-robin to select them. Probably the easiest solution.<br><br>Oh, i mist the C-key, i meant to write "lartc" : an indepth howto about linux advanced routing and traffic control. Priceless!<br><br>Hans.<br></font><br> <br>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<font style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<b>Van</b>: Naveen [<a href="mailto:pncbose@yahoo.com">mailto:pncbose@yahoo.com</a>]
<br><b>Verzonden</b>: Friday, November 22, 2013 08:27 PM W. Europe Standard Time<br><b>Aan</b>: <a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a> <<a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>>
<br><b>Onderwerp</b>: Re: [strongSwan] Load balancing
<br></font> <br></div>
<div style="background-color: rgb(255, 255, 255); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"><pre><span style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;">Thanks Hans for responding. Sorry for changing the mail thread as i am having issues with mail client.</span><br></pre><div><br></div><div><span style="font-style: italic;">> "It depends on your perspective cq. what you try to achieve...."</span><br></div><div>use case is like this: <span style="font-size: 10pt;">few thousand iOS clients connecting to 'n' Strongswan nodes. For now i am not worried about node failure. Once node fails, client needs to reconnect.</span></div><div style="background-color: transparent;"><br><span style="font-style: italic;">> 1. Clients P.O.V., you probably want to initiate multiple tunnels, and load balance your traffic over
them, see LART</span></div><div style="background-color: transparent;">Not sure what LART means.. Please elaborate.<br><br><br><span style="font-style: italic;">> 2. Server P.O.V. multiple options though it is more load-spreading and not really load-balancing , you can spread incoming requests, the set-ups, over multiple servers by means of iptables, dnat and the random module.</span></div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;">Could you point me to a working config/example that i could start experimenting.</div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><br></div><div style="background-color: transparent;"><span style="font-style:
italic;">> After setup, the tunnel remains bound to that machine, no swapping hosts after that.<span style="background-color: transparent; font-size: 10pt;">Also, DNS/round-robin should also work</span></span></div><div style="background-color: transparent;"><span style="font-style: italic;">Hans</span></div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;">Yes - no swapping after tunnel connection. while DNS/round-robin works, i believe it has a limitation of not considering load of the nodes.</div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><br></div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;">regards</div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;">Naveen</div><div style="background-color: transparent; font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><br></div> </div>
<hr>Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het electronisch verzenden van berichten.<br>
<br>
This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.<br>
</div>
_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>https://lists.strongswan.org/mailman/listinfo/users</blockquote></div><br></div></body></html>