Core load-balancer components
| Component | Purpose |
|---|---|
| Virtual IP / virtual server | Client-facing address, port and protocol. |
| Pool | Logical collection of backend members. |
| Pool member | Server address and service port. |
| Health monitor | Tests whether a member or application is safe to receive traffic. |
| Profile/policy | Controls TCP, HTTP, TLS, persistence, logging and transformations. |
| Persistence | Attempts to send related client requests to the same backend. |
Layer 4 versus Layer 7 balancing
| Mode | Decision data | Examples |
|---|---|---|
| Layer 4 | IP addresses, protocol and ports; often connection-oriented. | Generic TCP/UDP services, high-throughput pass-through. |
| Layer 7 | Application data such as HTTP host, URI, header or cookie. | Content routing, redirects, header insertion, WAF integration. |
Layer 7 features normally require the load balancer to proxy or terminate the client-side connection. This gives application visibility but increases processing and creates separate client-side and server-side connection behaviour.
Distribution algorithms
- Round robin: cycles through healthy members.
- Least connections: prefers a member with fewer active connections.
- Weighted methods: send more traffic to higher-capacity servers.
- Hash-based: uses client/source or other fields for deterministic distribution.
- Observed/predictive methods: use measured response or platform-specific metrics.
No algorithm fixes an unhealthy application. Choose based on connection duration, request cost, server capacity and whether the load balancer can see application transactions.
Health checks
A basic TCP monitor proves only that a port accepted a connection. An application monitor can send an HTTP request, validate status and search for expected content. The best check is deep enough to detect real service failure but light enough not to overload the backend.
- Use interval and timeout values that avoid flapping.
- Consider rise/fall counters before state changes.
- Monitor dependencies or a purpose-built readiness endpoint.
- Use graceful draining before maintenance.
Persistence and application state
Persistence may use source address, cookies, TLS/session identifiers or application tokens. It is needed when session state is stored only on one backend. Excessive persistence can produce uneven load or keep clients pinned to a degraded node.
More scalable applications externalise session state or use stateless tokens so any healthy backend can serve a request. Even then, long-lived TCP, WebSocket or streaming connections remain naturally attached to a selected member.
TLS termination and client identity
A load balancer can terminate TLS, inspect HTTP and establish a new server-side TLS connection. Certificates, protocol versions, cipher policy, SNI, trust validation and re-encryption must all be maintained.
Because the backend may see the load balancer's address as the source, preserve client identity using mechanisms such as X-Forwarded-For, the standardized Forwarded header, PROXY protocol or transparent/DSR designs. The backend must trust these values only from approved proxies.
High availability and traffic flow
Appliance or virtual load balancers are often deployed as an HA pair. Failover may move a floating address, update upstream routing or rely on anycast. Configuration and persistence/session state can be synchronised, but in-flight recovery depends on platform and protocol.
Troubleshooting workflow
- Test the VIP and the backend directly from appropriate locations.
- Check virtual server, pool and member state.
- Compare health-monitor request/response with the real application.
- Inspect connection tables and client-side/server-side resets.
- Verify SNAT/DSR design and symmetric return path.
- Check persistence records and uneven member utilisation.
- Validate Host header, SNI, certificate chain and backend TLS trust.
- Inspect HTTP status, response time and application logs.
- Check port exhaustion, connection limits, CPU, memory and SSL capacity.
Interview focus
Use these points to practise concise, operations-focused answers. Explain the concept first, then give a verification or troubleshooting example.
- What is a VIP? The client-facing virtual IP/service presented by the load balancer.
- Why can a TCP health check be insufficient? The port may accept connections while the application or a dependency is unusable.
- What is persistence? A mechanism that attempts to keep related client traffic on the same backend.
- What is TLS offload? The load balancer terminates client TLS so backends do less cryptographic work or receive re-encrypted/plain traffic according to policy.
- Why is symmetric return routing important? Proxy/NAT and stateful processing often require response traffic to return through the load balancer.