Hello, I am building VyOS deployment beyond the traditional 2-node VRRP (Active/Passive) setup. My goal is to deploy an N-node Active/Active cluster to distribute the traffic load efficiently.
If a session initiates on Node A, how can we best handle asymmetric return packets hitting Node B?
Is there a native way (or routing workaround) in VyOS to redirect those specific flow packets back to the originating node? Way to make them sync etc?
Or the only way is upstream device like LB to handle sticky sessions?
Any insights, recommended architectures, or configuration examples for an N-node Active/Active VyOS cluster would be highly appreciated.
Thanks in advance!
Depends on what you want to achive.
As a L3-device (router) you can have as many VyOS as you wish and run BGP between them or such.
Is it for just loadbalancing like through haproxy then Im not aware of any failover or such.
The best practice here I think is to setup as many VyOS as you wish and then use DNS roundrobin for the client to connect random available LB and the client will continue to use it for the whole session.
That is the haproxy config is setup to not be transparent as in the srcip of the packet will change once it will traverse the LB so that the backend server will reply back to the correct LB.
You can of course if you wish setup the devices in pairs like instead of having 4x selfcontained VyOSes you could have 2x 2x pairs (using VRRP and conntrack sync).
As @Apachez said, it is a little dependent on what you’re wanting to achieve.
ESI would add some complexity, but it achieves active/active forwarding and can be extended to many nodes. In fact, it’s basically the open-source version of clustering for a lot of vendors. For ensuring traffic returns to the correct device, SNAT can be your friend, but again, it depends on what you’re wanting to achieve.