Two IS instances really are sufficient (with an external load balancer). The instances do indeed need to have a bit of breathing room in case one of them fails. The key is to do proper load analysis and build enough instances to handle the load in case of failure (a four-engine plane can fly with just one engine, at least for a little while).
They can indeed coexist on a single box. To work, they must use independent IP addresses/hostnames. Thus, HACMP (or whatever your fave OS clustering solution is) can cut the Broker IP/hostname over to another box and leave the IS IP alone. Doing this at my current project (was in place before I got here) and works just dandy.
IMO, noone should ever use the IS-supplied load balancing. It becomes a single point of failure. External LB solutions are the way to go.
#webMethods-General#webMethods#Integration-Server-and-ESB#webMethods-Architecture