Load balance a clientless application

[grenzi]

Hello evrybody,

  some of our customers make heavy use of the Clientless VPN feature of the GlobalProtect Portal, and one of the most used application this time is the Apache Guacamole remote desktop gateway (https://guacamole.apache.org/). The GP Portal is configured to show the icon of this app and clicking on the app, of course, the remote users access the web server (NGINX in reverse proxy mode) through which the application is served.

As you know, when using the clientless feature, all the requests made by the remote clients are proxied by the firewall, so from the application server's point of view all the connections originate from the same IP address (the IP of the firewall interface facing the application).

This is working very fine for us but, with the ever growing number of remote users, a single Guacamole server is no more enough to manage all the necessary concurrent connections. So we need to add more Guacamole servers and put those servers behind a load-balancer (i.e. HAProxy or NGINX itself). In this fashion, the clientless app on the GP Portal is configured to point to the load balancer address instead of the address of the Guacamole server. The problem is: how can we load balance and ensure stickiness of the connections if all the user requests are coming form the firewall IP address? I already asked to the customer support to know if the firewall can inject an XFF in the HTTP requests, but it's not possible. Any idea?

[SutareMayur]

Hi @grenzi ,

As per my understanding, this can be easily manage on load balancer level. You can look for Persistence Profile and type that you will help would be Destination Affinity. 

Hope it helps!

[grenzi]

Hi @SutareMayur ,

  I'll try to load balance with HAProxy at layer 4, so that a single TCP stream will be forwarded always to the same backend server. I have to figure it out if the entire user session is always included in a single TCP connection, but I'm not convinced.

Thank you,

G.

[BPry]

@grenzi,

Because Guacamole is just a standard website from an access perspective, you should be able to use Cookie Insert (Barracuda) or Sticky Cookie (NGINX) on the traffic. This allows each session to be load-balanced like you would expect, but it inserts a cookie so that the session persists on a single server. That's how I would deal with this.

Now if you run into something that isn't capable of being load-balanced for any reason, that's when you have to get kind of tricky with clienteles access until additional features come online to pass XFF and such. Effectively you just manually load-balance by creating multiple different apps and feeding those apps to different user groups. It's a much more manual process, but for things that really can't load-balance well that's effectively the only "solution". 

[grenzi]

Hi @BPry, thank you!

I'll do some tests with NGINX (I need to learn more about Sticky Cookie).

Regards,

G.

[grenzi]

Just found that the Sticky Cookie session persistence is only available in NGINX PLUS. It seems that HAProxy can be configured in a similar way, so I'll try with HAProxy.