Third Party Load Balancing Active Directory

Question

We have serveral applications that target individual Active Directory domain controllers for authentication. If the domain controller goes down then that service stops working.
I'm interested in using a Citrix Netscaler to load balance authentication requests.
What I want to know is, "Does Microsoft support the use of an external load balancer", not from the perspective of third party device support obviously, rather functionally. Will AD work and be supported when using the Netscaler.
IT Manager

Answer 1

If you simply plan to use the Citrix NetScaler to load balance say, reading LDAP on port 389 as an example, you will be OK.  
Rather than pointing the app to a single DC, why not create multiple DNS records with the same host name, different IPs and use Round Robin.  Not as sophistacted, but it isnt going to cost you tens of thousands of dolllars in load balancing.
Visit: anITKB.com, an IT Knowledge Base.
Have you actually tested and used this in a production environment? If I understand correctly, what you are suggesting is to take existing (hypothetical) domain controller DNS entries:
A record: dc1.contosso.com, 10.1.1.10
A record: dc2.contosso.com, 10.1.1.11
And add the following entries to create quasi fault tolerance?
A record: dc3.contosso.com, 10.1.1.10
A record: dc3.contosso.com, 10.1.1.11 
I honestly don't think it will work, because of a few things, such as DC registration occurs every 60 min, including the netlogon service overwriting whatever static entries created for the quasi load balancing, and possibly Kerberos auth failing due to a different
IP authenticating from a different SPN. I know the hardware load balancers have options to preserve session cookies, which work fine for IIS implementations, such as Exchange HUB, and especially for CAS access, otherwise Outlook will not accept it if it sends
an auth request on one IP and another backend responds, which the LB help preserve this, however with AD LDAP, RPC, etc, I *don't* think it will work, due to Kerberos failing it thinking it's a spoof. If you get it working, I would be very curious to see the
documented implementation, settings, results, etc.
Ace
Ace Fekay
MVP, MCT, MCITP Enterprise Administrator, MCTS Windows 2008 & Exchange 2007 & Exchange 2010, Exchange 2010 Enterprise Administrator, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.