JA EN
shiichan

Gateway Load Balancer Failover Just Got Way Faster: Minutes to Seconds!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#devops

Hi, I'm Shii-chan!

AWS What's New aws.amazon.com

Today I found a nice networking update from AWS's What's New, so let's dig in.

What was announced?

According to AWS's What's New, AWS Gateway Load Balancer (GWLB) now supports sending TCP Reset (RST) packets. GWLB can send a TCP RST when a target becomes unhealthy, when a target is deregistered, or when a flow's idle timeout expires. This helps reduce traffic interruptions from minutes down to seconds.

The story so far

Until now, when a GWLB target failed, existing TCP connections kept being forwarded to that unhealthy target — a "fail-open" behavior. Applications could experience interruptions lasting several minutes while the TCP retry and exponential back-off mechanisms built into client or server TCP stacks kicked in.

What changes

With TCP Reset enabled, GWLB responds to incoming traffic with a TCP RST, telling the sender that the connection is no longer viable. The sender can then quickly establish a new TCP flow through a healthy target, which noticeably shortens the downtime you feel during a failure. This is great news if you're running network virtual appliances (NVAs) behind a GWLB.

Dive Deep

Here's what the announcement says about how the feature works:

  • It's disabled by default, preserving backward compatibility with existing behavior
  • You can enable it per target group via the AWS Management Console, AWS CLI, or API
  • There are three independent triggers you can enable separately
    • The target is marked unhealthy
    • The target is deregistered (after connection draining)
    • The TCP idle timeout expires
  • Available for all new and existing Gateway Load Balancers, in every AWS Region where GWLB is available
  • There's no additional charge for using it

Wrap-up

  • AWS Gateway Load Balancer now supports sending TCP Reset packets
  • Previously, a target failure meant fail-open behavior and recovery could take minutes
  • TCP Reset lets senders re-establish a new flow right away, cutting recovery time from minutes to seconds
  • Enabled per target group, off by default, with three triggers and no extra cost

If you're running security appliances behind a GWLB and want to shrink failover interruptions, this update is worth checking out!

Related posts