Can I load balance protocols without ports, such as ICMP, GRE and IPsec (ANY - L3)?

Short answer

Yes, in a Network vService, by selecting ANY - L3 as the Protocol. In this protocol, all IP traffic (ICMP, GRE, ESP…) arriving at the frontend address is distributed by translating the destination address to the Backend Service. It has restrictions: the algorithm can only be Round-Robin or Weighted Round-Robin, LB Mode is not applied (the source address is translated only if a SNAT IP is selected), the health check result is not reflected in the distribution, and IPsec AH cannot be carried. For IPsec, L4 Persistence is turned on so that IKE and ESP go to the same server. Since ANY - L3 uses all the ports of the IP, this vService requires a separate frontend IP.

Problem: How Are Protocols Without Ports Distributed?

Protocols such as ICMP, GRE and ESP have no port like the one in TCP and UDP; distribution can be done only by IP address. Since this kind of traffic covers all the protocols of an IP address, no other vService can run on the same address. In addition, some protocols (IPsec AH) include the address information of the packet in the integrity check, so they cannot be verified after address translation.

Solution

ANY - L3 with a Network vService

• How it works The destination address of the packets arriving at the frontend address is translated to the address of the selected Backend Service; distribution is done with Round-Robin or Weighted Round-Robin, and the traffic passes through TR7 in every case.
• Where it is opened vService → Type: Network → Protocol: ANY - L3
• Requirement A frontend IP reserved for this vService
• vService type Network
• Backend Service side If no SNAT IP is selected, the return traffic of the Backend Service must pass through TR7 (the server's gateway is TR7). If SNAT is selected, no change is required on the server; the server sees the traffic as coming from the SNAT IP.

Step-by-Step Configuration

1

Adım 1 Open the IP add form (if none exists)

If there is no IP that is not used by another vService, the Network → Interfaces → Actions → Add IP steps are followed (how to add). The same form also opens with Add IP in the Frontend IP list of the Network vService.

2

Adım 2 Enter the IP fields

In the IP Interface field, the interface in the vService's route table is selected, and the address and CIDR are written. In a cluster, the address is added as a VIP. In a Network vService, the Frontend IP list is limited to the IPs of the selected route table (Why can't I type the Frontend IP manually; what should I do to use an IP that is not in the list (e.g. IPv6) on a vService?).

3

Adım 3 Save the IP

The Add IP button at the bottom of the form is clicked.

4

Adım 4 Open the Backend Service add form (if none exists)

On the Load Balancer → Backend Services screen, the Add button is clicked (How is a Backend Service added; which information is required?).

5

Adım 5 Enter the server information

Backend Service Name and Address are entered; the vService's route table is selected as the Route Table. In ANY - L3, the destination port of the packets is not changed.

6

Adım 6 Save the Backend Service

The Add button at the bottom of the form is clicked. Steps 4–6 are repeated for each server.

7

Adım 7 Open the Network vService form

The Load Balancer → Load Balancer vService List → Add steps are followed; Name is entered and Network is selected as the Type.

8

Adım 8 Select ANY - L3 as the Protocol

The Route Table is selected, and ANY - L3 is selected as the Protocol. The Port field of the frontend rows is locked to 0 and all ports are processed; Port Range and SIP Persistence are hidden.

9

Adım 9 Select the reserved frontend IP

In the frontend row, the IP added in steps 1–3 is selected. Since ANY - L3 covers all ports, if there is another vService on the same IP, the form shows the "Port collision" error.

10

Adım 10 Select the Backend Services

In the Default Backend Services table, the Backend Services added in steps 4–6 are selected.

11

Adım 11 Select SNAT (optional)

If the return path of the Backend Service is not TR7, SNAT is selected in the LB Mode field, and one of TR7's IPs in the route table is selected from the SNAT IP field that appears. In ANY - L3, only Direct Server Return and SNAT appear among the LB mode options; Direct Server Return is not applied, and the traffic is routed through TR7.

12

Adım 12 Select the algorithm and L4 persistence

The Details switch at the top right of the form is turned on; Round-Robin or Weighted Round-Robin is selected in the LB Algorithm box. If multiple protocols need to go to the same server, as in IPsec, L4 persistence is turned on (the duration comes set to 5 minutes).

13

Adım 13 Save

The Save button is clicked. On a Network vService, every save restarts the vService; the change is made at a low-traffic time. In a cluster setup, the change is also transferred to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1With ICMPClient and Backend Service side

Commandping 203.0.113.20 · on the Backend Service tcpdump -n icmp

ExpectedThe ping is answered; ICMP packets appear on the Backend Service

For GRE and IPsec, the tunnel is set up and the tunnel status is checked.

Common Mistakes

• Relying on the health check. In ANY - L3, the health check result is not reflected in the distribution; a failed Backend Service continues to receive packets.
• Using IPsec AH. Address translation breaks the integrity check of AH; IPsec is used with ESP.
• IKE and ESP going to different servers. If L4 persistence is off, the IPsec tunnel may not be established.
• Sharing the same IP with another vService. ANY - L3 covers all the ports of the IP; a separate IP is required.
• Looking for Route Mode. In ANY - L3, the Route Mode option does not appear; if the return path is not TR7, SNAT is used.

How it is done in the documentation

• Network vService · Protocols Without Port Separation
• Network vService · Protocol
• Network vService · LB Mode
• vService · Network (packet level)

Related questions

• Can I make a vService listen on a wide port range (e.g. 4000-5000)?
• Can I load balance UDP traffic (DNS, Syslog, NTP)?
• How does L4 Persistence work on a Network vService; how is the duration set?