F5 bests Radware in WAN-link manager duel

Given the increasing importance of Web services for conducting business, IT staff can’t afford to gamble on a single WAN connection to the Internet. In the real-world of wide-area networking, backhoes slice through data lines, telco workers disconnect T1s in the phone closet when installing phone lines, and cables simply go bad.

Until recently, the best choice for network multihoming has been to tangle with BGP (Border Gateway Protocol) — a black art to all but the wizards among us. For organizations that want to stick with BGP, offerings from Proficient Networks and Sockeye are making that row much easier to hoe. For everyone else, hardware-based WAN link managers such as F5’s Link Controller, Radware’sLinkProof, Alteon’s (now Nortel’s) Link Optimizer, and FatPipe Network’s XTreme have greatly reduced the pain of multihoming technology.

I spent one day a piece testing Radware’s and F5’s products at the University of Hawaii’s Advanced Network Computing Lab (for more on how I tested these products, see the online version of this Test Center Review at www.infoworld.com/reviews). Both companies sent out a systems engineer to set up their respective boxes, which is typical for such installations.

Both products use DNS and their own proprietary NAT schemes to deal with delivery issues when multiple ISP links are used. Although both offerings handled the basics of link load balancing in my tests, the F5 Link Controller pulled far ahead of the RadwareLinkProof because of its relatively quick setup, excellent support, and superior reporting and management tools.

F5 Link Controller surges

The F5 Link Controller is a nice piece of equipment and is a breeze to configure. I had the choice of the CLI (command-line interface) or Web GUI, both of which can handle all aspects of configuration. F5’s BSD-based CLI will be immediately familiar to Unix administrators. F5 bundles the Mindterm SSH (Secure Shell) client Java applet within the Web interface — a nice touch for those network administrators who don’t want to fumble around for an SSH client in a time of crisis. Fortunately, the stability, reliability, and ease of administration provided by the F5 Link Controller mean that after you’ve set up the box, it’s unlikely you’ll be forced to deal with too many crises — this box just works.

Despite the fact that the CLI provides all the management functionality needed, I used the Web GUI to configure the F5 Link Controller and the CLI bigtop utility, which is similar in spirit to Unix top, for real-time monitoring. I enabled the default ICMP (Internet Control Message Protocol) ping health monitor for each link with configurable time-out and interval values, which I entered as 10 seconds and 3 seconds, respectively. I generated HTTP traffic and confirmed that traffic was moving through both links by using the bigtop utility. The Web GUI gave me a real-time sense of throughput via a status window on the main page that updated every 5 seconds.

For my first test, I literally pulled the plug on the network link that represented ISP1. As expected, the bigtop utility immediately showed the link as down, and I verified that all traffic was now going through ISP2’s link. The Link Detail Statistics screen within the Web GUI confirmed this behavior by showing there was no traffic through ISP1’s link during the 5-minute interval in which I knew it was down. The fail-over occurred nearly instantly, and all HTTP requests to the Internet made from my internal client machine were completed successfully.

I then tested the cost-based link routing. As expected, the Link Controller filled both ISP lines at 1.5Mbps — because they were the same price at that level of utilization — and sent the remaining 6Mbps to 8Mbps via the less expensive ISP2 line, clearly saving money in this model. The intuitive reporting of the Web GUI made it easy to see how each link was performing during various time intervals. The F5’s Link Controller worked as advertised. The company’s systems engineer didn’t call back to the home office for help even once; when minor questions arose, the online help within the Web interface readily provided answers.

RadwareLinkproof staggers

My tests with the RadwareLinkProof proved less successful and significantly more frustrating. Although the standard LinkProof includes a Web GUI and CLI, the systems engineer attending the installation suggested ConfigWareInsite, a Java application that runs stand-alone or within a browser. Using its SNMP autodiscovery feature, the uniquely intuitive ConfigWareInsite application discovered the LinkProof and allowed me to visually map the network and to configure the box.

Although ConfigWareInsite made configuration easy, making the configuration work was substantially more time-consuming than it was using the F5 Link Controller. Furthermore, serious weaknesses in the products reporting capabilities — again, as compared to that of the F5 Link Controller — made it difficult to determine how the box was performing.

In my first test with the RadwareLinkProof, I immediately ran into trouble. After successfully generating traffic via the links representing ISP1 and ISP2, I did the “pull the plug” test on ISP1; all outbound HTTP traffic to the Internet on both ISP links stopped, while HTTP traffic to my intranet server inexplicably continued uninterrupted. I replaced the plug for ISP1 and pulled the plug for ISP2, and all HTTP traffic stopped completely. After hours of tweaking and making calls to Radware’s home-office support department, the basic link fail-over functioned as expected but not before most of my allotted testing time had passed.

In the time remaining, I configured LinkProof’s Price-Based Traffic Routing, but the reporting within ConfigWareInsite made the test results confusing — the reports showed the expected levels of traffic going down each ISP line, but the numbers were reversed; what I expected to see on ISP1 was happening on ISP2, and vice versa.

When I tested this feature again later in the InfoWorld Test Center’s San Francisco labs, I used ConfigWare, the predecessor to ConfigWareInsite. Although ConfigWare does not have the same visual appeal, configuration was still simple; however, I found the reporting capabilities to be even more inadequate. No report for measuring the throughput of either link existed, so I was unable to check the performance of the LinkProof against the cost metrics I had set. It appeared from the available canned reports that the proportions of traffic across the two lines were roughly what I expected, but this was inconclusive.

In the end, the F5 product emerged as the clear winner simply because it worked as expected in each scenario I tested. For a product that is supposed to deliver measurable traffic patterns based on the needs of a network administrator, the inconsistencies in the Radware offering’s reporting capabilities was too much of an obstacle to garner a strong score. If in subsequent iterations Radware can provide more robust reporting, LinkProof would be worth another look.