Microsoft Cluster Service or network load balancing?

You cannot run both clustering technologies on the same server, but you can run them together in the same solution. With such an arrangement, Microsoft would portray them as complementary rather than conflicting, providing, of course, that hardware and licenses are plentiful. Let's consider two examples that typify how and when you might use both advantageously: database-driven Web servers and e-mail access. We'll also look at a lesser-known scenario, using the same principles but employing some more obscure clustering techniques. In all cases, the NLB servers are placed in the DMZ, simply accepting and rerouting traffic from the Internet to back-end servers that are running the Cluster Service. Because no data is held on the NLB servers, the security implications are lessened. And because the servers are running very few services, they are easier to harden. The data is kept secure behind another firewall. Connecting users are unaware of where that data is held and will have minimal inconvenience if the back-end servers change. Lets see how this works. Web servers are placed within the DMZ and configured to accept traffic only on port 80 (http) and 443 (https). All other ports can be blocked. If SSL is being used, these servers all need a certificate installed and will be responsible for the encryption/decryption over the Internet. All servers will have Internet Information Services (IIS) running, configured identically, but the actual data being used (such as an online shopping store) is stored in a SQL database running on a back-end server (behind another firewall), which is running the Cluster Service. The SQL back-end server is more secure because it's not directly available on the Internet, it won't have the overhead of SSL, and it can be independently reconfigured without requiring external changes (to the DNS or on clients). The data is monitored by the Cluster Service to ensure that it remains available on at least one of the clustered servers. You can also use IPSec so that the SQL servers accept connections only from the NLB servers. This will provide an additional safeguard on top of your firewall filtering rules and any router configuration. For Exchange 2000 offering IMAP4, POP3, and OWA for Internet-connected clients, the process is similar. The servers in the DMZ that accept the Internet connections are running NLB, with the actual data (e-mail, public folders, and calendar) held on back-end servers running the Cluster Service. Only this time, each NLB server that has Exchange 2000 installed must have an additional option checked to enable it as a front-end (FE) server--a new feature in Exchange 2000. Then, make sure you remove any data stores on these FE servers. In this scenario, the NLB servers will need to communicate with more servers on the internal network than just the Exchange servers that hold the data stores. Exchange 2000 FE servers locate the back-end Exchange data stores by querying the Active Directory Global Catalog. And because this service is for your internal domain users rather than for anonymous public access, users must be authenticated with domain controllers. The Global Catalog and domain controllers are vital services, which, in this scenario, deliver an extra layer of security by being only indirectly accessible by the Internet. As before, encryption for added security will require a server certificate on the NLB servers, which offloads the encryption/decryption process from the back-end servers. Our final example involves multiple VPN servers offering PPTP connections, all with NLB configured. Remember that IPSec won't work with NLB, so you can't use L2TP/IPSec. This means that you'll have to use PPTP. Once connected and authenticated, users connect to back-end clustered file servers. Users just need to know one IP address (or server name) for their remote connection, irrespective of how many VPN servers are actually available. Access to their data is always protected on clustered servers. Putting it all together
We've taken an under-the-hood look at how both Microsoft clustering technologies work, including their differences and similarities, and how they can work together to offer highly available solutions. Delving a little deeper into specifics, my next article will draw up a list of pros and cons for each technology to help you decide which to use when you have to choose between them.

Have your say instantly in the Tech Update forum. Find out what's where in the new Tech Update with our Guided Tour. Let the editors know what you think in the Mailroom.

« Previous
1
2
3
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

14 minutes ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

5 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

6 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

7 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

9 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

23 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

1 day ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

1 day ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint