This means like you can add several server ips and you get a load balancer? And how many servers? And round-robin or something more smart?
In what plans will this be available and if at extra cost ?
Is there any alternative to this ?
This may be the perfect thing for dedicated providers that don't offer a loadbalancer.
This allows you to create groups of servers (multiple servers per group) and do load balancing across servers inside a group, failover between servers, failover between groups (based on some threshold number of servers inside a group having failed), geo-steering so that visitors from different parts of the world hit different groups.
Today's announcement is currently only weighted round-robin within a group, but additional algorithms will be supported.
Because Cloudflare uses Anycast there is no change in the public IP address for a request that hits us. It will be routed to the nearest data center (of which we now have 100 cities covered globally). The Traffic Manager product controls how that traffic is the routed to the origin server (if the request could not be served from cache).
As the active monitoring is performed from each location separately the Traffic Manager applies its policies in each location and can automatically route around connectivity problems in the Internet as well as origin server problems. All without changing public DNS.
This allows us to do very fast failover and route changes because this is independent of the propagation time for DNS on the public Internet. Solutions based on changing DNS records are suboptimal.
Somewhat off topic, but since CloudFlare keeps mentioning "routing the nearest data center" as one of its benefits...
I have a number of clients near ICN (Seoul) who have been happy with CloudFlare for some time, but now the vast majority of their users are being routed through LAX. Not Tokyo, nor Osaka, nor any of your other locations throughout East Asia, but LAX all the way across the Pacific Ocean! This detour adds about 300ms to every uncached request, and 150ms to every cached request. All the time I spent helping my clients shave a few milliseconds off their response times, now completely obliterated!
When the Pro plan ($20/mo) users contacted CloudFlare to find out what was going on, they were told to upgrade to the Business plan ($200/mo). Some of them did, but their users were still being routed halfway around the world. When they contacted support again, they were told to consider upgrading to an Enterprise plan. What is this, a cheap webhosting shop that tells people to upgrade whenever they're having a problem?
I don't know what happened around late summer that suddenly made Korean and Japanese locations off limits to all but the highest paying customers (local ISPs demanding more money?) but whatever it is, it has made CloudFlare barely usable where I live.
This is definitely correct.
Every Cloudflare pro plan site I know of now routes to LAX for South Korean users.
For business sites, going over a certain amount of traffic, they also route to LAX for South Korean users.
I also have confirmed with Cloudflare support, that sites going over a certain amount of traffic have to upgrade to Business -> Enterprise plan to keep South Korean users to route to ICN (Seoul). This is causing huge continous performance problems for nearly all Cloudflare sites in South Korea.
It doesn't have anything to do with how much they're paying (if Cloudflare uses the same network for all customers). Most likely, an Asian IP transit provider found a peer in an IX in LA and decided it was better to "cold potato" the data over there than deliver it to a nearby connection. Or it decided to de-peer for some stupid reason, or a route became "AS best path" to LA despite being actually worse in a way BGP can't figure out, et cetera.
Sometimes you can fix this with BGP communities, sometimes you have no control over it and are basically screwed unless you find another transit option that works better for everyone.
I've been building an Anycast network all week. Right now my problem is Australia. I make Sydney work better by peering and half the world starts best path routing to it. Debugging these problems is really tricky, particularly in Asia/Pacific, which is full of expensive submarine cables and, frankly, crappy communication monopolies that love to fight with eachother over peering.
Basically you need to get a contact to their NOC team and get them to check the BGP routes for those customers. I have no idea how they diagnose, but I myself would ask for some traceroute -A yoursite.com outputs from the people with the weird routing and go from there. Don't expect overnight results, the fix may require another transit hookup or peering agreement.
I saw the same thing with China. We have something hosted on IBM Softlayer in HKG that takes a detour through LA. Apparently all China traffic for Cloudflare must go through LA and that's just now China works, we were told.
I can't knock them for constantly adding features.
I know people don't like the psuedo-centralization and the hand wavy action that their waf does...
yet they keep creating a strong value proposition that makes it so easy for small-medium projects to get so many services for free (DNS, SSL, CDN) or relatively cheap compared to competition (DDOS Mitigation).
I don't know of any other single service that does this at their price points, is there one? (maybe aws with their offerings of waf, cloudfront, route 53 etc).
It was my understanding based on the website's copy that this was also a DNS GLB:
Expanding on Cloudflare’s highly available DNS infrastructure and global Anycast network, the Cloudflare Traffic Manager is a cloud-based load-balancing solution that enhances the performance and availability of your Internet facing infrastructure. Designed for scale, flexibility and robustness, CTM enables your applications to deliver the ultimate end user experience through the highest level of performance and reliability.
It has since been clarified that this product has the ability to re-route traffic based on availability and it does not base its balancing in returning different results for the same DNS query.
P.S.: I'm not saying that the copy "says" this is DNS GLB, I'm just saying it was vague enough for me to assume it was a DNS GLB.
I am a customer of a competitive product, where we have a cluster of servers on port 25 that need load balancing. Pretty simple setup - if port 25 goes down for more than 2 minutes remove from DNS until it comes back online.
It's been incredibly stable and robust and a real life saver if you have gear in multiple geographic data centers that are not all with one provider. The competitors cost for the service is incredibly cheap hen you consider what it does - but the BIG GOTCHA is you need to use their DNS in order to use the load balancer.
And we move about 350 queries per second so the bill is pretty high (for our sized company). The place that I should be able to get an immediate impact and huge savings is that Cloudflare does DNS for "free".
I should be able to pay a modest but competitive rate for their traffic manager, but with no QPS it will be huge.
I just spoke to sales in the UK and they don’t actually have a good definition of the product yet. No pricing and really did not have their questions to ask prospects yet.
That being said we are already using them for pseudo-Traffic Management services we have a script tied to Pingdom.com that updates DNS from the port monitoring and adds and removes records in just a few seconds.
It's okay for port 25 to go down for 2 minutes because standards-compliant senders will retry when your server is back up.
It's not okay for a widely used web service to go down for 2 minutes until you can update your DNS. Failover needs to happen within a few seconds, and most importantly, while the client is still connected to the load balancer. You can't do this using DNS with short TTL values.
> Failover needs to happen within a few seconds, and most importantly, while the client is still connected to the load balancer. You can't do this using DNS with short TTL values.
No it doesn't and it's good enough. Humans are not stupid, they will try again, web browsers will try other IPs too. For custom clients it's not even a question, as they can implement transparent failover in the client itself. Essentially this is all about web browsers.
The big problem with anycast routing is that you still have to rely on a single AS/company and have a huge SPOF, that will fail from time to time. A few hours of downtime every other year is as good as you can get, less than that would be pretty much impossible for such architecture. So, if you need anything better, you would have no choice but implement a DNS failover.
It is shocking how many sites now use CloudFlare, I have recently switched ISPs and aparently my new ISP is SPAMMER and BOT heaven so almost every site I go to asks me to complete the Im Not A Robot Cloudflare reCapture.
Really makes the experience suck.
If I was operating a site? I dont think there is anything comparable at the free cost. But what you can do is turn the sensitivity if the captcha challenge down to 'Essentially Off' as detailed here https://support.cloudflare.com/hc/en-us/articles/200170096-H... the default setting seems to be way too quick to throw up a captcha.
25 comments
[ 3.3 ms ] story [ 76.7 ms ] threadhttps://www.incapsula.com/load-balancing-failover.html
This means like you can add several server ips and you get a load balancer? And how many servers? And round-robin or something more smart? In what plans will this be available and if at extra cost ?
Is there any alternative to this ? This may be the perfect thing for dedicated providers that don't offer a loadbalancer.
Today's announcement is currently only weighted round-robin within a group, but additional algorithms will be supported.
As the active monitoring is performed from each location separately the Traffic Manager applies its policies in each location and can automatically route around connectivity problems in the Internet as well as origin server problems. All without changing public DNS.
This allows us to do very fast failover and route changes because this is independent of the propagation time for DNS on the public Internet. Solutions based on changing DNS records are suboptimal.
I have a number of clients near ICN (Seoul) who have been happy with CloudFlare for some time, but now the vast majority of their users are being routed through LAX. Not Tokyo, nor Osaka, nor any of your other locations throughout East Asia, but LAX all the way across the Pacific Ocean! This detour adds about 300ms to every uncached request, and 150ms to every cached request. All the time I spent helping my clients shave a few milliseconds off their response times, now completely obliterated!
When the Pro plan ($20/mo) users contacted CloudFlare to find out what was going on, they were told to upgrade to the Business plan ($200/mo). Some of them did, but their users were still being routed halfway around the world. When they contacted support again, they were told to consider upgrading to an Enterprise plan. What is this, a cheap webhosting shop that tells people to upgrade whenever they're having a problem?
I don't know what happened around late summer that suddenly made Korean and Japanese locations off limits to all but the highest paying customers (local ISPs demanding more money?) but whatever it is, it has made CloudFlare barely usable where I live.
I also have confirmed with Cloudflare support, that sites going over a certain amount of traffic have to upgrade to Business -> Enterprise plan to keep South Korean users to route to ICN (Seoul). This is causing huge continous performance problems for nearly all Cloudflare sites in South Korea.
http://www.todayhumor.co.kr/cdn-cgi/trace http://www.ilbe.com/cdn-cgi/trace http://www.issuein.com/cdn-cgi/trace
All show loc=KR, while using a slow LAX colocation. The first two from what I know, are business plan sites.
Sometimes you can fix this with BGP communities, sometimes you have no control over it and are basically screwed unless you find another transit option that works better for everyone.
I've been building an Anycast network all week. Right now my problem is Australia. I make Sydney work better by peering and half the world starts best path routing to it. Debugging these problems is really tricky, particularly in Asia/Pacific, which is full of expensive submarine cables and, frankly, crappy communication monopolies that love to fight with eachother over peering.
Basically you need to get a contact to their NOC team and get them to check the BGP routes for those customers. I have no idea how they diagnose, but I myself would ask for some traceroute -A yoursite.com outputs from the people with the weird routing and go from there. Don't expect overnight results, the fix may require another transit hookup or peering agreement.
But if the matter really is beyond CloudFlare's control, their support should not be encouraging people to upgrade to a plan that costs 10x as much.
Thank you very much for sharing!
I know people don't like the psuedo-centralization and the hand wavy action that their waf does...
yet they keep creating a strong value proposition that makes it so easy for small-medium projects to get so many services for free (DNS, SSL, CDN) or relatively cheap compared to competition (DDOS Mitigation).
I don't know of any other single service that does this at their price points, is there one? (maybe aws with their offerings of waf, cloudfront, route 53 etc).
Expanding on Cloudflare’s highly available DNS infrastructure and global Anycast network, the Cloudflare Traffic Manager is a cloud-based load-balancing solution that enhances the performance and availability of your Internet facing infrastructure. Designed for scale, flexibility and robustness, CTM enables your applications to deliver the ultimate end user experience through the highest level of performance and reliability.
It has since been clarified that this product has the ability to re-route traffic based on availability and it does not base its balancing in returning different results for the same DNS query.
P.S.: I'm not saying that the copy "says" this is DNS GLB, I'm just saying it was vague enough for me to assume it was a DNS GLB.
A colleague just published more details here https://blog.cloudflare.com/cloudflare-traffic-manager-the-d...
It's been incredibly stable and robust and a real life saver if you have gear in multiple geographic data centers that are not all with one provider. The competitors cost for the service is incredibly cheap hen you consider what it does - but the BIG GOTCHA is you need to use their DNS in order to use the load balancer.
And we move about 350 queries per second so the bill is pretty high (for our sized company). The place that I should be able to get an immediate impact and huge savings is that Cloudflare does DNS for "free".
I should be able to pay a modest but competitive rate for their traffic manager, but with no QPS it will be huge.
I just spoke to sales in the UK and they don’t actually have a good definition of the product yet. No pricing and really did not have their questions to ask prospects yet.
That being said we are already using them for pseudo-Traffic Management services we have a script tied to Pingdom.com that updates DNS from the port monitoring and adds and removes records in just a few seconds.
It's not okay for a widely used web service to go down for 2 minutes until you can update your DNS. Failover needs to happen within a few seconds, and most importantly, while the client is still connected to the load balancer. You can't do this using DNS with short TTL values.
No it doesn't and it's good enough. Humans are not stupid, they will try again, web browsers will try other IPs too. For custom clients it's not even a question, as they can implement transparent failover in the client itself. Essentially this is all about web browsers.
The big problem with anycast routing is that you still have to rely on a single AS/company and have a huge SPOF, that will fail from time to time. A few hours of downtime every other year is as good as you can get, less than that would be pretty much impossible for such architecture. So, if you need anything better, you would have no choice but implement a DNS failover.