Jetnexus ALB-X-User-Guide-v2.5

User Manual:
ALB-X: Hardware/Virtual Appliance

jetNEXUS Solutions Limited Suite 2 Anglers Court, 33-44 Spittal Street, Marlow, Buckinghamshire, SL7 1DB UK Phone: Fax: 0870 382 5050 or International +44 (0) 1628 820 630 0870 382 5520 or International +44 (0) 1628 820 647
Author: Version: Updated:
jetNEXUS Solutions Limited 2.5 16/04/2013
Copyright 2005 - 2013 jetNEXUS, Ltd. All Rights Reserved. 2005-2013 jetNEXUS, Ltd. All rights reserved. jetNEXUS and the jetNEXUS logo are registered trademarks of jetNEXUS, Ltd. jetNEXUS, Ltd. reserves all ownership rights for the jetNEXUS ALB-X/ALB-X product line including software and documentation
1
jetNEXUS ALB-X User Manual - Copyright 2013, jetNEXUS Limited. All Rights Reserved
Limitations: This document and all of its contents are provided as-is. jetNEXUS has made efforts to ensure that the information presented herein are correct, but makes no warranty, express or implied, about the accuracy of this information. If any material errors or inaccuracies should occur in this document, jetNEXUS will, if feasible, furnish appropriate correctional notices which Users will accept as the sole and exclusive remedy at law or in equity. Users of the information in this document acknowledge that jetNEXUS cannot be held liable for any loss, injury or damage of any kind, present or prospective, including without limitation any direct, special, incidental or consequential damages (including without limitation lost profits and loss of damage to goodwill) whether suffered by recipient or third party or from any action or inaction whether or not negligent, in the compiling or in delivering or communicating or publishing this document. Microsoft Windows is a registered trademark of Microsoft Corporation in the United States and other countries. All other trademarks and service marks are the property of their respective owners.
2
Table of Contents
jetNEXUS Introduction ............................................................................................................... 7 Scope ...................................................................................................................................... 7 jetNEXUS Platform Availability ............................................................................................... 7 Hardware: ........................................................................................................................... 7 ISO:...................................................................................................................................... 7 Virtual Appliance: ............................................................................................................... 7 What is the jetNEXUS ALB-X? ................................................................................................. 8 jetNEXUS ALB-X Benefits .................................................................................................... 8 How can I deploy jetNEXUS ALB-X ......................................................................................... 9 Single network interface configuration .............................................................................. 9 Multi network interface configuration ............................................................................. 10 Deploying a single network interface configuration ........................................................ 11 Deploying a multiple network interface configuration .................................................... 11 Configuring your jetNEXUS ALB-X ............................................................................................ 12 Installing jetNEXUS ALB-X..................................................................................................... 12 Connecting to the jetNEXUS ALB-X Web Console ................................................................ 12 Getting Started ..................................................................................................................... 14 Setting the IP address ....................................................................................................... 14 Appliance Section ............................................................................................................. 15 Setting the Default Route ................................................................................................. 16 Setting a Static route ........................................................................................................ 16 Setting the network speed ............................................................................................... 17 Advanced Networking .......................................................................................................... 18 Bonding ............................................................................................................................. 18 What is bonding? .............................................................................................................. 18 Bonding Modes ................................................................................................................. 18 Configure bonding ............................................................................................................ 19 Adding a new bonded adapter ......................................................................................... 20 Configuring your adaptor in a VLAN ................................................................................. 21 License your ALB-X ............................................................................................................... 21 3
Configuring your Virtual Services............................................................................................. 22 Adding an IP-Service ............................................................................................................. 22 Adding a new Channel ...................................................................................................... 22 Channel Descriptions ........................................................................................................ 22 Setup Destination Details ..................................................................................................... 24 Content Server Group Name: ........................................................................................... 24 Status: ............................................................................................................................... 24 Activity: ............................................................................................................................. 24 IP Address: ........................................................................................................................ 24 Port: .................................................................................................................................. 24 Notes:................................................................................................................................ 24 Configuring a new Content server .................................................................................... 25 Adding additional Content servers ................................................................................... 25 Actions .................................................................................................................................. 26 Server Monitoring............................................................................................................. 26 Load Balancing Policy ....................................................................................................... 28 Connectivity ...................................................................................................................... 30 Windows ........................................................................................................................... 31 Linux.................................................................................................................................. 32 Windows ........................................................................................................................... 33 Linux.................................................................................................................................. 34 Windows ........................................................................................................................... 35 Linux.................................................................................................................................. 36 Caching Strategy ............................................................................................................... 37 SSL ..................................................................................................................................... 37 Connection Pooling........................................................................................................... 37 Adding another service on the same channel .................................................................. 38 Adding an additional channel IP ....................................................................................... 40 Status lights ...................................................................................................................... 41 Configuring Server Health Monitoring ................................................................................. 42 flightPATH Menu .................................................................................................................. 43 What is flightPATH? .......................................................................................................... 43 4
What can flightPATH Do? ................................................................................................. 43 How do I build a flightPATH rule?..................................................................................... 45 Pre-Built rules: .................................................................................................................. 45 Conditions ......................................................................................................................... 46 Match ................................................................................................................................ 47 Sense ................................................................................................................................. 48 Check ................................................................................................................................ 49 Evaluation ......................................................................................................................... 50 Action Tab ......................................................................................................................... 51 Actions Tab - ............................................................................................................................ 53 How do I apply flightPATH rules? ..................................................................................... 55 Caching ................................................................................................................................. 56 How jetNEXUS Caching Works.......................................................................................... 56 Cache Settings .................................................................................................................. 57 Create a Cache Rule .......................................................................................................... 58 Apply Cache Rule .............................................................................................................. 59 Connection Pooling .............................................................................................................. 60 What is connection pooling? ............................................................................................ 60 Enable connection pooling? ............................................................................................. 60 SSL Offload and Termination................................................................................................ 61 What can jetNEXUS do with SSL? ..................................................................................... 61 Creating a Self Signed Certificate ..................................................................................... 62 Creating Certificate Requests ........................................................................................... 63 Installing Trusted Certificates ........................................................................................... 64 Certificate Management................................................................................................... 65 Importing Certificates ....................................................................................................... 66 Exporting Certificates ....................................................................................................... 67 Failover configuration .......................................................................................................... 68 Why use failover? ............................................................................................................. 68 Failover diagram ............................................................................................................... 69 Failover diagram explained .............................................................................................. 70 Failover Configuration ...................................................................................................... 71 5
Monitoring & Alerting .......................................................................................................... 72 Dashboard......................................................................................................................... 72 Statistics ............................................................................................................................ 74 Logging .............................................................................................................................. 76 Email Events...................................................................................................................... 77 Services ................................................................................................................................. 79 Date and Time................................................................................................................... 79 Ping ................................................................................................................................... 80 SNMP ................................................................................................................................ 80 Capture ............................................................................................................................. 81 Restart .............................................................................................................................. 82 Reboot .............................................................................................................................. 82 Power Off .......................................................................................................................... 82 jetPACK Quick Installation .................................................................................................... 83 Troubleshooting ................................................................................................................... 84 Contact Us ............................................................................................................................ 84
6
jetNEXUS Introduction
Scope
The aim of this document is to provide a user manual and deployment overview for the jetNEXUS Accelerating Load balancer Extreme (ALB-X). If you have any questions about this guide or require any assistance during your setup please do not hesitate to contact support@jetnexus.com or call us on 0870 382 5529 where one of our dedicated support team will be able to help with any questions or queries you have.
jetNEXUS Platform Availability

Hardware: The jetNEXUS Accelerating Load Balancer Extreme (ALB-X) is designed to offer
an Enterprise feature set at an SME price. It is the most effective next generation load balancer (ADC) available on the market today.
ISO: The jetNEXUS ALB-X ISO is an installable version of the jetNEXUS Accelerating Load
Balancer Extreme. It is a fully integrated software product complete with operating system and installer that can be easily used to build jetNEXUS ALB-Xs on supported server hardware platforms.
Virtual Appliance: The Accelerating Load Balancer Extreme VA (ALB-X VA) offers all the
functionality and power of the ALB-X hardware appliance whilst delivering the added virtual appliance benefits of quick deployment, increased flexibility and superb ease of use.
Virtual Platforms:
VMWare 4.0, 4.1, 5.0, 5.1 Microsoft Hyper-V Server 2008 R2 Microsoft Hyper-V 2012 Citrix XenServer 6.0 Amazon EC2,VPC
7
What is the jetNEXUS ALB-X?

The jetNEXUS Accelerating Load balancer Extreme (ALB-X) is an advanced load balancing and traffic management solution that enables clients to create and deliver fast, resilient, and scalable online services. The ALB-X is an Application Delivery Controller (ADC) sometimes referred to as a next generation load balancer. The ALB-X is feature rich, delivering the advanced functionality you would expect from a market leading solution at a cost effective price point. Focusing on the features that make the biggest difference to end user experience, the ALB-X combines Layer 7 Load Balancing, Compression, SSL Offload, SSL Re-encryption and Content Caching in one comprehensive solution. Features such as dynamic data compression, SSL offload, connection management and content caching work to reduce server load and optimize application contents for superb performance. The ALB-X is a plug and play solution, available in a variety of formats. The GUI is intuitive with drag and drop functionality. The ALB-X also features flightPATH, a powerful, scriptable Layer7 routing engine for the creation of traffic rules and intelligent service management.
jetNEXUS ALB-X Benefits

The ALB-X negates the costly effects of data center server sprawl, dramatically improving the performance and efficiency of web servers to ensure high application availability and service quality. The ALB-X represents the next generation in web load balancing by delivering advanced ADC features in a comprehensive yet cost effective solution that is flexible to deploy and easy to manage.
High Availability for your Mission Critical Business Applications

The ALB-X is an essential network component, key to guaranteeing server availability and delivering a reliable online service. The ALB-X can be deployed in a high availability pair to enable fail over and remove any single point of failure. The ALB-X server health monitoring feature can detect and route around problem servers to eliminate downtime. Advanced reporting and logging provides real time performance and availability stats for comprehensive monitoring and analysis. Features such as dynamic data compression, SSL offload, connection management and
content caching work to reduce server load and optimize application contents for superb performance. The ALB-X also features flightPATH, a powerful, scriptable Layer7 routing
engine for the creation of traffic rules and intelligent service management.
8
How can I deploy jetNEXUS ALB-X

There are two fundamental ways to deploy jetNEXUS Accelerating Load Balancer.
Single network interface configuration

Enabling only the eth0 (single network interface) and installing your jetNEXUS ALB-X into the same network as your Web server/Applications servers flat network; this is suitable for most scenarios. All inbound and outbound traffic passes over this single network interface. jetNEXUS ALB-X accepts connections on a listening Channel (The combination of IP address and port) and holds this. It then creates a connection of its own to a backend server based on a load balancing policy. When it gets the required data from the server, the jetNEXUS ALB-X then sends it on to the client. In this configuration the web management traffic also goes over the single interface.
Firewall Web Traffic Is sent to the jetNEXUS ALB which is Listening on 10.0.34.100 for ports 80 & 443
jetNEXUS ALB Accepts connections on a Listening Service (IP and port) Eth0 IP: 10.0.34.66
Listening IP: 10.0.34.100 Ports: 80 & 443 ALB then creates a connection of its own to a content server based on the load balancing policy.
Svr_Web_1 Svr_Web_2 Svr_Web_3 Svr_Web_4 10.0.34.11 10.0.34.12 10.0.34.13 10.0.34.14
9
Multi network interface configuration

Enabling the Eth0 interface, and any another interface Eth1/Eth2 & Eth3 etc. The jetNEXUS devices can proxy the traffic between any of the new network interfaces. This is suitable for larger scenarios where network segmentations between web services are needed. jetNEXUS ALB-X accepts connections on a listening Channel (The combination of IP address and port) on any of the following interfaces Eth0/Eth1/Eth2 & Eth3 and holds this information. It then creates a connection of its own to a backend server based on a load balancing policy. In a Multi Network configuration all traffic between the client and the jetNEXUS ALB-X can go over any interface you specify in your channel configuration as the listening IP. All traffic between the jetNEXUS ALB-X and the content servers will go over whatever interface the content servers IP is in.
Firewall Web Traffic Is sent to the jetNEXUS ALB which is Listening on 192.168.100.100 for ports 80 & 443 jetNEXUS ALB Listening IP: 192.168.100.100 Accepts connections on a Ports: 80 & 443 Content server: 10.0.34.11 Listening Service (IP and port) ContentServer: 10.0.34.12 Eth0: 192.168.100.251 Eth1:10.0.34.100 Eth2:10.0.38.100
User User on the 10.0.34.x network accesses the listening IP of 10.0.38.100
Listening IP: 10.0.38.100 Ports: 80 & 443 Content server: 10.0.38.24 ContentServer: 10.0.38.25
ALB then creates a connection of its own to the content servers based on a load balancing policy.
Svr_Web_1 10.0.34.11
Svr_Web_2 10.0.34.12
Svr_Web_24 Svr_Web_25 10.0.38.24 10.0.38.25
10
Deploying a single network interface configuration

Using the Navigation bar on the left of the web interface, go to (Setup Appliance) this will open the tab allowing you to access the adapter settings.
The example below shows that we only have the address of 10.0.34.66 assigned to eth0 and this shows that the device is currently running in a single network interface configuration:
Deploying a multiple network interface configuration

Using the Navigation bar on the left of the web interface, go to (Setup Appliance) this will open the tab allowing you to access the adapter settings.
The example below shows that we only have the address of 10.0.34.66 assigned to eth0 by clicking on the Add Adapter, we can now add the details for the eth1 interface:
Fill in the address and subnet mask for the second (eth1) adapter. Once completed click on Update and ALB-X will raise the interface on the eth1 adapter:
11
Configuring your jetNEXUS ALB-X

Installing jetNEXUS ALB-X
Please refer to the Installation Guide which will include how to set the IP address of eth0 for web console access.
Connecting to the jetNEXUS ALB-X Web Console

The default web interface can be access via the following IP if it has not been able to contact a DHCP server:
https://192.168.100.100:27376
You will be challenged for a username and password:
Username: admin Password: jetnexus
12
Once you have logged in you will be presented with the Dashboard screen:
The Dashboard provides Information on Disk space, Memory Utilization and CPU Performance. It also gives visibility of the status of your services.
Using the Navigation bar on the left you will be able to access all the options to configure your jetNEXUS ALB-X.
13
Getting Started
Setting the IP address
The first item to configure when setting up jetNEXUS ALB-X is the basic networking. Using the Navigation bar on the left of the web interface go to (Setup Appliance). This will open the tab allowing you to set the IP Address for the unit.
Adapter Details
Double click on the IP Address box & Subnet mask to enter the IP and subnet, each section will turn blue allowing you to add IP and subnet information:
Your changes will be highlighted with a red triangle above them, then click on the update button to commit your changes:
14
Appliance Section
Now set the server ref appliance name and enter your DNS server:
Failover is enabled when ticked; this allows the appliance to act as a as part of a HighAvailability cluster. However this will be discussed in more detail later on in this guide:
Advanced Network Setting

Server Nagle and Client Nagle can be enabled to pace connections where content is small. These options are not enabled as default, and should only enable on older slower networks:
This is not required for HTTP communications but can be beneficial with some protocols on a Layer 4 channel. Once all information has been entered please use both update buttons
15
Setting the Default Route

Using the Navigation bar on the left of the web interface, go to (Setup Network) this will open the tab allowing you to add the Gateway and Static routing information. On this screen we configure a default gateway and routing, you must set a Gateway IP Address:
In this example we have configured the Gateway IP of 10.0.0.1 on eth 0 once you have configured your gateway click the update button:
Setting a Static route

Static routes can be added by clicking on the Add Route button:
You will need the destination address and mask, the gateway and adapter. Once the details are filled in, click update to action the settings. A tick is shown in the Active column when the route is implemented:
16
Setting the network speed

Using the Navigation bar on the left of the web interface, go to (Setup Hardware) This will open the tab allowing you to set the Interface speeds.
The settings on this screen control the network access. The defaults are to fix speed at 100 Mbps and full duplex. This avoids any issue with certain networking devices that have autonegotiation which re-negotiates too frequently. The device can support speeds from 10 to 1000, for 1000 this should set to auto/auto. If this does not work, set the exact network hardware values:
To change the values, click on Speed or Duplex: If you have changed any of these settings click the update at the top of the screen. ***Please note that setting network speed is only relevant for Hardware appliances. The Virtual appliance will take the settings from the underlying Virtual Machine settings**
17
Advanced Networking
Bonding
Using the Navigation bar on the left of the web interface, go to (Setup Hardware) this will open the tab. Bonding is not relevant for Virtual Appliances.
What is bonding?
Bonding allows you to aggregate multiple ports into a single group, effectively combining the bandwidth into a single connection. Bonding also allows you to create multi-gigabit pipes to transport traffic through the highest traffic areas of your network. Note this is only relevant for your hardware version of ALB-X. Do not use bonding for the Virtual Appliance.
Bonding Modes Balance-rr

Transmits packets in sequential order from the first available slave to the last.
Active-backup
Has one interface will be live and the second interface will be in standby. This secondary interface only becomes active if the active connection on the first interface fails.
Balance-Xor
Transmits based on (source MAC address XOR'd with destination MAC address) This selects the same slave for each destination Mac address.
Broadcast
Transmits everything on all slave interfaces.
802.3ad
Creates aggregation groups that share the same speed and duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad specification.
Balance-tld
The Adaptive transmit load balancing bonding mode: Provides channel bonding that does not require any special switch support. The outgoing traffic is distributed according to the current load (computed relative to the speed) on each slave. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed receiving slave.
Balance-ALB-X
The Adaptive load balancing bonding mode: also includes balance-tlb plus receive load balancing (rlb) for IPV4 traffic, and does not require any special switch support. The receive load balancing is achieved by ARP negotiation. The bonding driver intercepts the ARP Replies sent by the local system on their way out and overwrites the source hardware address with the unique hardware address of one of the slaves in the bond such that different peers use different hardware addresses for the server.
18
Configure bonding
Use the Navigation bar on the left of the web interface, go to (SetupHardware) this will open the tab Using the Navigation bar on the left of the web interface, go to (Setup Hardware)
Bonding is broken down into two sections bonding and interfaces, you will first need to create a Bond. Click on Add button on the bonding section:
You will then be able to add a new bond and then select your bonding mode:
Adding interfaces to the bond

In the example below I will add eth1 and eth2 to bond0:
Both eth1 and eth2 are now part of bond0:
19
Adding a new bonded adapter

Using the Navigation bar on the left of the web interface, go to (Setup Appliance) this will open the tab.
Click on Add Adapter and select bond0, you will need to configure this with an IP address and subnet mask. In the example I have used 172.16.1.240/24:
Example:
Bond0 now configured with 172.16.1.240/24:
Note:
Bonding should not be used for Virtual Appliances. Bonding in this way is only suitable for Hardware Appliances.
20
Configuring your adaptor in a VLAN

Using the Navigation bar, on the left of the web interface. Go to (SetupAppliance)
tab.
What is a VLAN?
A virtual LAN, commonly known as a VLAN, is a group of hosts with a common set of requirements that communicate as if they were attached to the same broadcast domain, regardless of their physical location.
Add VLAN ID to your adaptor

On the Adapter settings screen you have the ability to add VLAN information into the VLAN box highlighted below:
License your ALB-X

Using the Navigation bar on the left of the web interface. Go to (SetupLicense)
tab.
Please see our short video tutorial of how to license your ALB-X http://www.jetnexus.com/tutoriallicense-the-ALB-X.html
21
Configuring your Virtual Services

Adding an IP-Service
Using the Navigation bar on the left of the web interface, go to (Setup IP Services) this will open the tab allowing you to access the IP Services options.
The IP service page is spilt into 3 sections; each section must be completed after each other to enable a channel IP.
Channel Details Destination Actions Adding a new Channel

To configure a channel click the Add IP button:
This will now add a blank Channel IP service ready for configuration:
Channel Descriptions
Each Channel has a number of configuration options that are described below.
Primary: This is used to configure a channel as a primary or standby channel More information can be found on this in the chapter on Failover. The Tick Box will only appear
for appliances in High Availability Mode
IP Address: The Virtual IP for the channel Subnet Mask: The Subnet mask for the virtual IP Port: The port for the channel to listen on Service Name: Type in a useful name to describe your service
22
Service Type: This is the protocol for your service. Choose from the options below.
Accelerate HTTP HTTP with automatic browser side compression Layer 7 HTTP HTTP(s) Layer 7 FTP FTP application Layer4 Generic TCP Layer 4 traffic SMTP(25) Simple Mail Transfer Protocol POP3(110) Post Office Protocol 3 IMAP(143) Internet Message Access Protocol RDP(3389) Remote Desktop Protocol RPC(135) Remote Procedure Call RPC/ADS(59534) Address Book Service (CAS Exchange 2010) RPC/PF(59535) Public Folders (CAS Exchange 2010) NetBIOS(130) Network Basic Input/Output System TelNet(23) Telnet
Max. Connections: This limits the number of simultaneous content server connections and can
be set per channel. For example if you set this to 1000 and have two content servers then the jetNEXUS ALB-X will only connect 1000 connections simultaneously to each of the two content servers. You may also choose to present a Server too busy page, once this limit is reached on all servers, helping users in the case.
Example
In this example we will configure the following IP details, based on a One-Armed Configuration.
IP Address: Subnet Mask: Port: Service Name: Service Type: Max connections:
192.168.101.100 255.255.255.0 80 Web Servers VIP HTTP 10000
23
Setup Destination Details

When you add a channel IP the first content server is added for you, this blank field allows you to add the IP Address and Port of your backend server:
Content Server Group Name: You can specify a name for the content servers. Status: This service indication light will show if the backend server is available (see Status
Lights later in this guide)
Activity: Each content server can be assigned one of four activities. Online: Any content servers assigned as Online will be part of the primary content
server pool. The status colour will be Green.
Standby: Any content servers assigned as Standby will remain offline until ALL of
the Online group fail, at which point the Standby group will start serving content. If one of the Online groups becomes available they will start serving content and the Standby group will no longer serve content. The status colour will be Yellow.
Offline: Any server assigned as Offline will immediately be taken offline and will
not serve any content. The status colour will be blue
Drain: Any content servers assigned as Drain will honour existing connections but
not accept new connections. This will flash Green/Blue whilst draining. Once the existing connections have been serviced the content servers will be taken offline and the status light will be blue.
IP Address: The IP Address of your backend content server. Port: The port that your backend content server is listening on. Notes: Write some useful notes about the content server
24
Configuring a new Content server

In this example we will configure the following Content server details Destination: Connection Server Group Name: Activity: IP Address: Port: Server Group Online 10.0.34.96 80
Adding additional Content servers

To add additional content servers click on the Add New button to add a server :
You can now add your additional content servers: Click on the Update button next to the Add Content server this enables the new content server: In the example below I have added 4 content servers to my load balanced channel:
Each content server has been assigned one of the four activities for illustrative purposes. You may assign all servers as Online to load balance between all four servers. Alternatively, any combination of activities is allowed.
25
Actions
The default options for Actions allow you to select several different options these are detailed below:
Server Monitoring None

In this mode, the content server is not monitored at all and is assumed to be always up and running correctly. This is useful for situations where monitoring upsets a server and for services that should not join in the fail-over action of ALB-X. It can be viewed as a way of hosting unreliable or legacy systems that are not core to H/A operation. This monitoring method can be used with any service type.
Ping/ICMP Echo
In this mode, ALB-X sends an ICMP echo request to the IP of the content server. If a valid echo response is received, the content server is deemed to be up and running and traffic will be sent to it. It will also then keep the service available on an H/A pair. This monitoring method can be used with any service type
TCP Connection
In this mode, a TCP connection is made to the content server and immediately broken without sending any data. If the connection succeeds, the content server is deemed to be up and running. This monitoring method can be used with any TCP service type. UDP services are the only ones currently not appropriate for TCP Connection monitoring.
26
200 OK
In this mode, a TCP connection is made to the content server as above, but after connection is made, a brief HTTP request is made to the content server. An HTTP response is waited for and it is checked for the "200 OK" response code. If the "200 OK" response code is received, the content server is deemed to be up and running. If, for any reason, the "200 OK" response code is not received, including timeouts, failure to connect, etc, then the content server is regarded as down. This monitoring method can only really be used with HTTP and Accelerate HTTP service types, although if a Layer 4 Service Type is in use for an HTTP server, it could still be used if SSL is not in use on the content server, or is handled appropriately by the "Content SSL" facility.
HTTP Response
In this mode, a connection and HTTP request/response are made/checked for as above, but instead of the "200 OK" response code being checked for, a custom text is searched for in both the HTTP headers, and the body of the HTTP response. The text can be a whole header, part of a header, a line from part of a page, or just one word. If the text is found, the content server is deemed to be up and running. This monitoring method can only really be used with HTTP and Accelerate HTTP service types, although if a Layer 4 Service Type is in use for an HTTP server, it could still be used if SSL is not in use on the content server, or is handled appropriately by the "Content SSL" facility.
DICOM
Digital Imaging and Communications in medicine (DICOM) is a standard for handling, storing, printing and transmitting information is medical imaging. In this mode, a TCP connection is made, after a connection is made, an associate request is made. If the content server is present it will respond with associate accept and a small amount of Echo data is swapped between the ALB and the content server. The ALB then Requests release which will be accepted by the content server in the form of a Release response. This monitoring method only works with Layer 4 Service Types.
27
Load Balancing Policy Round Robin: The simplest method, each back end server takes a turn. Least Connections: The load balancer will keep track of the number of connections a back
end server has and send the next request to the server with the least connections.
IP Bound: In this situation the clients IP address is used to select which back end server
will receive the request. IP session persistence runs at layer 4 as such it can be used when load balancing non HTTP protocols. This method is useful for internal networks where the network topology is known and you can be confident that there are no super proxies upstream. If this is the case the all the requests will look like they are coming from one client, and as such the load would be uneven.
IP List Based: The initial connection to the content server is made using Least
connections then session affinity is achieved based on Clients IP. A list is maintained fo r 2 hours.
Cookie Based: This is the most popular persistence method for HTTP. In this situation,
least connections load balancing is used for each first request. A cookie is inserted into the headers of the first http response. Thereafter, jetNEXUS ALB-X uses the client cookie to route traffic to the same back end server. Again this is used when the client must go to the same back end server each time.
Session Cookie:
Classic ASP Session Cookie: Active Server Pages (ASP) is a Microsoft server-side technology. With this option selected the ALB-X will maintain session persistence to the same server if an ASP cookie is detected and is found in its list of known cookies. If a new ASP cookie is detected then it will be load balanced using the least connections algorithm. ASP.NET Session Cookie: ASP.NET is a Microsoft server-side technology. With this option selected the ALB-X will maintain session persistence to the same server if an ASP.NET cookie is detected and is found in its list of known cookies. If a new ASP.NET cookie is detected then it will be load balanced using the least connections algorithm. JSP Session Cookie: Java Server Pages (JSP) is an Oracle server-side technology. With this option selected the ALB-X will maintain session persistence to the same server if a JSP cookie is detected and is found in its list of known cookies. If a new JSP cookie is detected then it will be load balanced using the least connections algorithm.
28
JAX-WS Session Cookie: Java web services (JAX-WS) is an Oracle server-side technology. With this option selected the ALB-X will maintain session persistence to the same server if a JAX-WS cookie is detected and is found in its list of known cookies. If a new JAX-WS cookie is detected then it will be load balanced using the least connections algorithm. PHP Session Cookie: Personal Home Page (PHP) is an open source server-side technology. With this option selected the ALB-X will maintain session persistence to the same server if a PHP cookie is detected.
29
Connectivity
You can configure your Channel IP services to run in the 4 connectivity modes below, each mode is detailed below. Once you have configured a Channel you will be able to access the Connectivity options:
Managed
This is the default setting for jetNEXUS and works at, Layer7 with compression and Caching and also at layer4 without caching and compression. In this mode the jetNEXUS acts as a proxy and becomes the source address seen on the content servers. How it works
-
Client sends a request to the jetNEXUS Request received by jetNEXUS Request routed to content servers Response sent to jetNEXUS jetNEXUS responds directly to client
Direct Server Return

Direct Server Return, or DSR as its widely known (DR Direct Routing in some circles) allows the server behind the load balancer to respond directly to the client bypassing the jetNEXUS on the response. DSR is suitable for using with Layer 4 load balancing only therefore Caching and Compression are not available when enabled. Layer 7 load balancing with this method will not work therefore there is no persistence support other than source IP. SSL/TLS load balancing with this method is not ideal as there is only source IP persistence support. How it Works
-
Client sends a request to the jetNEXUS Request received by jetNEXUS Request routed to content servers Response sent directly to client without passing through JetNEXUS
30
Diagram DSR
Client Makes a request to the Website
Firewall Web Traffic Is sent to the jetNEXUS ALB. Which has a channel IP Listening on 10.0.34.100:80 jetNEXUS ALB Forwards this request onto the content server.
Content Server The content server then responds directly to the client
Content server: 10.0.34.11:80 loopback: 10.0.34.100
Listening IP: 10.0.34.100:80 Content server: 10.0.34.11:80
Web Server
Required Content Server Configuration The content server default gateway should be configured as normal. (Not via the jetNEXUS) The content server needs to have a loopback or Alias configure with the IP address of the Channel or VIP. Network metric must be 254 to prevent response to ARP requests. The content server and the load balancer must be in the same subnet.
Windows
On windows the following commands must be run at the command prompt running in administrator mode. Where net is the name of the name of the interface.
netsh interface ipv4 set interface net weakhostreceive=enable netsh interface ipv4 set interface loopback weakhostreceive=enable netsh interface ipv4 set interface loopback weakhostsend=enable
31
Linux
1. Add a permanent loopback interface 2. /etc/sysconfig/network-scripts
ifcfg-lo:1 DEVICE=lo:1 IPADDR=x.x.x.x NETMASK=255.255.255.255 BROADCAST=x.x.x.x ONBOOT=yes

3. edit /etc/sysctl.conf
net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eht1.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth1.arp_announce = 2 4. sysctl - p
32
Transparency
Transparency is suitable for Service Type Layer 4 load balancing only, Caching and Compression are not available when transparency is enabled. Transparency is used when you need the source address of the client making the request. How it works
-
Client sends a request to the jetNEXUS Request is received by jetNEXUS MAC address is changed. Request forwarded to content servers Response sent to jetNEXUS jetNEXUS routes the response to the client
Required Content Server Configuration Content servers need to be configured to use the jetNEXUS Eth0 IP address as their default gateway for single arm configuration. Content server need to be configured to use the jetNEXUS Eth1 IP address as their default gateway for dual arm configuration. The content server needs to have a loopback or Alias configure with the IP address of the Channel or VIP. Network metric must be 254 to prevent response to ARP requests. The content server and the load balancer must be in the same subnet.
Windows
33
Linux

34
Gateway
Gateway mode allows you to route all traffic through the jetNEXUS, this allows traffic originating from the content servers to be routed via the jetNEXUS to other networks via the interfaces on the jetNEXUS unit. Using the device as a gateway device for content servers should be used when running in multi interface mode. How it works
-
Client sends a request to the jetNEXUS Request is received by jetNEXUS Request sent to content servers Response sent to jetNEXUS jetNEXUS routes the response to the client
Required Content Server Configuration Content servers need to be configured to use the jetNEXUS Eth0 IP address as their default gateway. Content servers need to be configured to use the jetNEXUS Eth1 IP address as their default gateway for dual arm configuration. The content server needs to have a loopback or Alias configure with the IP address of the Channel or VIP. Network metric must be 254 to prevent response to ARP requests. The content server and the load balancer must be in the same subnet.
Windows
35
Linux

36
Caching Strategy Off:

No caching is applied
By Host:
Caching is applied on a per hostname basis. A separate Cache will exist for each hostname. Ideal for web servers that can serve multiple websites depending on the hostname.
By Channel:
Caching is applied to the whole channel. Only one Cache will exist so this is for a web server that only serves one website.
SSL Client Side SSL:

-
No SSL SSL Off. This should be selected if No SSL is required Default SSL On. This is the Default Certificate provided for test purposes User Certificate Name SSL On. Once you have created or imported a certificate then you can select it here to apply SSL to the Client/Browser side of the Channel No SSL SSL Bridging/Re-encryption Off Any SSL Bridging/Re-encryption On. Select this to accept any certificate provided by the content server User Certificate Name SSL Bridging/Re-encryption On. Select this to accept only the named certificate which should be the same as presented by the content server.
Content Server Side SSL:

-
Connection Pooling
When this is ticked the ALB-X maintains connections to the content server so they can be reused when future requests to the content servers are requested. This setting is only valid for Service Type HTTP and should only be used for stateless web connections only.
Connection Pool Size

Set the number of connections to maintain.
37
Adding another service on the same channel

To set up another service on the same IP address and a different port click the Add Port: This will add another grouping of settings similar to the first set . This time you dont need to specify the listening IP or subnet as it has already been added:
This now allows you to set up the new port and a set of web servers. These can be the same as, or different from the first ones.
Example:
IP Address: Subnet mask: Port: Service Type: Max. Connections: Content Server group Name: Content Servers 10.0.34.100* 255.255.0.0* 443 Accelerate HTTP 10000 Traffic-Test 10.0.34.96 10.0.34.97 10.0.34.98 443
Port:
*(Automatically propagated from the first rule)
38
In the example below I have added my 3 content servers to my existing load balanced channel but this time for port 443:
The original channel is still in place and active, these rules now services port 80 & 443 to the content servers. Via the virtual IP of 10.0.34.100:
39
Adding an additional channel IP

To add another listening IP addresses, click on the Add IP button: This will bring up a new section including the option for the second IP address and port:
You can now type in the Details for your new channel IP service and configure the content servers and actions for this new service:
40
Status lights
There are two groups of status lights: There is only ONE status light per VIP in the Channel Details section. Each Content Server will have its own status light.
VIP:
Online Content servers unreachable or no content servers enabled Indicates a secondary is holding off for a primary Failover-Standby Finding Status Unit not licensed
Content Servers:
Connected Unreachable Fall-back Standby Offline. This will flash Green/Blue whilst draining. Finding Status Unit not licensed
41
Configuring Server Health Monitoring

Using the Navigation bar on the left of the web interface, go to (Configure Content-Server Monitoring) this will open the monitoring options. tab allowing you to access the
Name:
Give the new method a useful name
Description:
Give the new method a useful description
Monitoring Method:
HTTP 200 OK: In this mode, a TCP connection is made to the content server as above, but after connection is made, a brief HTTP request is made to the content server. An HTTP response is waited for and it is checked for the "200 OK" response code. If the "200 OK" response code is received, the content server is deemed to be up and running HTTP Response: In this mode, a connection and HTTP request/response are made/checked for as above, but instead of the "200 OK" response code being checked for, a custom text is searched for in both the HTTP headers, and the body of the HTTP response. The text can be a whole header, part of a header, a line from part of a page, or just one word. If the text is found, the content server is deemed to be up and running. DICOM: In this mode, a TCP connection is made, after a connection is made, a DICOM associate request is made. If the content server is present it will respond with associate accept and a small amount of Echo data is swapped between the ALB and the content server. The ALB then Requests release which will be accepted by the content server in the form of a Release response. The content server will be deemed capable of service upon successful completion of this exchange. This is a Layer 7 monitoring method that works with Layer 4 Service Type only.
Page Location:
This is the location of the directory, header, and body to check or script to run.
Required Content:
Enter the custom text that is required for a match (Only relevant for HTTP Response). For DICOM you can enter the Application Entity Title (AET).
42
flightPATH Menu
Using the Navigation bar on the left of the web interface, go to (Configure flightPATH) this will open the tab allowing you access the flightPATH configuration menus:
What is flightPATH?
flightPATH is a rule engine developed by jetNEXUS to intelligently manipulate and route HTTP and HTTPS traffic. It is highly configurable, very powerful and yet very easy to use. A flightPATH rule has three components:
Condition: Evaluation: Action:
Set multiple criteria to trigger the rule. Variables that can be used in the Action The behaviour once the rule has triggered
What can flightPATH Do?

flightPATH can be used to modify Incoming and Outgoing HTTP(s) content and requests. As well as using simple string matches such as Starts with, Ends With etc. For more complete control powerful Perl Compatible Regular Expressions can be implemented. In addition, custom variables can be created and used in the Action enabling many different possibilities. Due to the configurable nature of flightPATH the options are infinite but some common uses are as follows.
43
Application firewalling and Security

Block unwanted IPs Force user to HTTPs for specific (or all) content Block or redirect spiders Prevent and alert cross site scripting Prevent and alert SQL injection Hide internal directory structure Rewrite cookies Secure directory for particular users Redirect users based on path Provide Single sign on across multiple systems Segment users bases on User ID or Cookie Add headers for SSL offload Language detection Rewrite user request Fix broken URLs Log and Email Alert 404 response codes Prevent directory access/ browsing Send spiders different content
Features
44
How do I build a flightPATH rule?

A flight path rule consists of conditions and actions. Multiple conditions can be added and are always added together. To add a new rule click the Add New button on Details, this enables you to give the flightPATH rule a name and also a Description:
Multiple actions can also be created and are all executed if the conditions are met. Variables can also be created to set values to be dynamically included on the action response. flightPATH is preloaded with example rules for you to use these are listed below with the definitions.
Pre-Built rules: 1. HTML Extension: Changes all .htm requests to .html 2. Index.html: Force to use index.html in requests to folders 3. Close Folders: Deny requests to folders 4. Hide CGI-BBIN: Hides cgi-bin catalogue in requests to CGI scripts 5. Log Spider: Log spider requests of popular search engines 6. Force HTTPS: Force to use HTTPS for certain directory 7. Media Stream: Redirects Flash Media Stream to appropriate channel 8. Swap HTTP to HTTPS: Change any hardcoded HTTP:// to HTTPs:// 9. Blank out Credit Cards: Check that there are no credit cards in the response and
if one is found, blank it out 10. Content Expiry: Add a sensible content expiry date to the page to reduce the number of requests and 304s 11. Spoof Server Type: Get the Server type and change it to something else 12. Never Send Errors: Client never gets any errors from your site 13. Redirect on Language: Find the language code and redirect to the related country domain 14. Google Analytics: Insert the code required by Google for the analytics - Please change the value MYGOOGLECODE to your Google UA ID
45
Conditions
New conditions can be added by clicking, Add New button:
Multiple conditions can be used but all must be met for the rule to execute. These are called AND rules. To use an OR you would need to create an additional flightPATH rule. Each condition contains three elements and a value or not depending on the condition. The conditions are listed below:
Condition
Host Language
Description
This is the host extracted from the URL This is the Language extracted from the language HTTP header This is the path of the website The is the name of a cookie This is the name and Value of a Query as such it can either accept the query name or a value also. The whole query string after the ? char This is a drop down of HTTP methods This is the HTTP version This can be any HTTP Header POST request method
Example
www.mywebsite.com or 192.168.1.1 This condition will produce a dropdown with a list of Languages /mywebsite/index.asp
Path Cookie Query
Best=jetNEXUS Where the Match is Best and the Value is jetNEXUS Best=jetNEXUS&Name=Me This is a dropdown that includes GET, POST etc HTTP/1.0 OR HTTP/1.1 Referrer, User-Agent, From, Date Check data being uploaded to a website
Query String Method Version Header POST <form> Response Body Response Code Source IP
A user defined string in the response body
The http code for the response
200 OK, 304 Not Modified
This is either the origin IP, proxy server IP or some other aggregator IP address
Client IP, Proxy IP, Firewall IP. Can also use multiple IPs and subnets. You must escape the dots as these are RegEX. Example 10\.1\.2\.3 is 10.1.2.3 Client IP. Can also use multiple IPs or subnets. 10\.1\.2\..* is 10.1.2.0 /24 subnet 10\.1\.2\.3|10\.1\.2\.4 Use | for multiple IPs
Origin IP
Same as above except that if upstream proxy supports XForwarded-for (XFF) it will use the true Origin address
46
Match
The match will depend on the Condition chosen. So if Path is chosen then the Match will be blank as it is not relevant. Choosing Request or Response Header will give you the option below.
Match
Accept Accept-Encoding Accept-Language Accept-Ranges
Description
Content-Types that are acceptable Acceptable encodings Acceptable languages for response What partial content range types this server supports Authentication credentials for HTTP authentication The type of encoding used on the data The length of the response body in Octets (8-bit bytes) The MIME type of the body of the request an HTTP cookie previously sent by the server with Set-Cookie An identifier for a specific version of a resource, often a message digest The last modified date for the requested objec Implementation-specific headers that may have various effects anywhere along the request-response chain
Example
Accept: text/plain Accept-Encoding: gzip Accept-Language: en-US Accept-Ranges: bytes
Authorization
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== Content-Encoding: gzip Content-Length: 348
Content-Encoding Content-Length
Content-Type Cookie
Content-Type: application/x-www-form-urlencoded Cookie: MS_WSMAN=afYfb1CDqqCDqCVii
ETag
ETag: "aed6bdb8e090cd1:0"
Last Modified
Last-Modified: Tue, 15 Nov 1994 12:45:26 GMT
Pragma
Pragma: no-cache
47
Referer
This is the address of the previous web page from which a link to the currently requested page was followed. Used to instruct a browser to use this cookie on subsequent transactions A name for the server The user agent string of the user Tells downstream proxies how to match future request headers to decide whether the cached response can be used rather than requesting a fresh one from the origin server. specifies the technology (e.g. ASP.NET, PHP, JBoss) supporting the web application
Referer: http://www.jetnexus.com
Set-Cookie
Set-Cookie: MS_WSMAN=afYfb1CDqqCDqCVii
Server User-Agent Vary
Server: Apache/2.4.1 (Unix) User-Agent: Mozilla/5.0 Vary: User-Agent
X-Powered-By
X-Powered-By: PHP/5.4.0
Sense
The sense allows you to create a positive match or a negative match:
Does Does not Value is true Value is not true
48
Check
This sets the condition for the rule being fired:
Check Description
Exist Start Check that the Match Item is present Check that the Match starts with the value in specified in the Value column
Example
Value = N/A Value = www www.jetNEXUS.com = TRUE jetNEXUS.com = FALSE Value = com www.jetNEXUS.com = TRUE www.jetNEXUS.co.uk = FALSE Value = jetNEXUS www.jetNEXUS.com = TRUE www.jetNEXUS.co.uk = TRUE www.mywebsite.com = FALSE Value = jetNEXUS www.jetNEXUS.com = FALSE jetNEXUS = TRUE Value=16 www.jetNEXUS.com = TRUE www.jetNEXUS.co.uk = FALSE
End
Check that the Match Ends with the value in specified in the Value column
Contain Checks any part of the Match for the Value
Equal
Check the Mach for an exact match
Have Length
Check the length of the match
Match RegEX
This enables you to enter a full Perl compatible regular expression.
Test for IP Address ^(25[0-5]|2[0-4][0-9]|[0-1]{1}[09]{2}|[1-9]{1}[0-9]{1}|[1-9])\.(25[05]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[19]{1}[0-9]{1}|[1-9]|0)\.(25[05]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[19]{1}[0-9]{1}|[1-9]|0)\.(25[05]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[19]{1}[0-9]{1}|[0-9])$
Example: We can create the Condition if the Path Does Contain the IP Address 10.0.34.100, the Actions and Evaluations can be applied to it:
49
Evaluation
Adding a Variable is a very powerful feature that will allow you to extract data from the request and include this in the actions. For example you could log a user username or send an email if there is a security problem. New Variables can be added by clicking, Add New button:
A variable name has to be in the following format $name$ So for example we would like to create a variable of the file extension $fileextension$ = Path (From the drop down) = (.*\.)+(.+) (RegEx)
Evaluation Tab - Source

Source Description Example
Host Language Path Cookie Query
This is the hostname extracted from the URL This is the Language extracted from the language HTTP header This is the path of the website The is the name of a cookie This is the name and Value of a Query as such it can either accept the query name or a value also. The whole query string after the ? char This is a drop down of HTTP methods This is the HTTP version This can be any HTTP Header POST request method
www.mywebsite.com or 192.168.1.1 This condition will produce a dropdown with a list of Languages /mywebsite/index.asp
Best=jetNEXUS Where the Match is Best and the Value is jetNEXUS Best=jetNEXUS&Name=Me This is a dropdown that includes GET, POST etc HTTP/1.0 OR HTTP/1.1 Referrer, User-Agent, From, Date Check data being uploaded to a website
Query String Method Version Header POST
50
Action Tab
New actions can be added by clicking, Add New button:
Actions Tab - Actions

The action is the task or tasks that are enabled once the rule is fired. All actions are fired:
Action Rewrite Path Description This will allow you to redirect the request to new URL based on the condition This will issue a temporary redirect Example Target= /test/path/index.html Data= N/A Target= http://www.jetnexus.com Data= N/A Log Event This will log an event to the System log Will send an email. You can use a variable as the address or the message This will drop the connection Target= flightPATH has logged this in syslog Data= N/A e-Mail Target= flightPATH has emailed this event Data= N/A Target= N/A Data= N/A Use Server Select which server or channel to use Search the Response Body and replace first instance only Search the Response Body and replace last instance only Search the Response Body and replace all instances Target= 192.168.101:80 Data= N/A Target= http:// (Search string) Data= https:// (Replacement string) Body Replace Last Target= http:// (Search string) Data= https:// (Replacement string) Target= http:// (Search string) Data= https:// (Replacement string)
Redirect 301
Drop
Body Replace First
Body Replace All
51
Replace Request Header Add Request Header
Replace request header in the Target with Data value Add a request header of Target type with value in Data section Replace the response header detailed in Target section with value in Data section Remove the response header detailed in Target section Add request header detailed in the Target section with value in the Data section Replace request cookie detailed in the Target section with value in the Data section Remove request cookie detailed in the Target section Add request cookie detailed in the Target section with value in Data section
Target= Connection Data= keep-alive Target= Accept Data= image/png
Replace Response Header
Target= Server Data= Withheld for Security Target= Etag Data= N/A
Remove Response Header Add Response Header
Target= Cache-Control Data= max-age=8888888 Target= Cookie Data= MS-WSMAN=afYfn1CDqqCDqCVii Target= Cookie Data= MS-WSMAN=afYfn1CDqqCDqCVii
Replace Request Cookie
Remove Request Cookie Add Request cookie
Target= Cookie Data= MS-WSMAN=afYfn1CDqqCDqCVii
52
Actions Tab - Target

Target Description Data From: user@example.com
From
The email address of the user making the request Content-Types that are acceptable Acceptable encodings
Accept
Accept: text/plain
Accept-Encoding
Accept-Encoding: <compress | gzip | deflate | sdch | identity>

Accept-Language: en-US
Accept-Language
Acceptable languages for response The user agent string of the user agent
User-Agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Referer: http://www.jetnexus.com
Referer
This is the address of the previous web page from which a link to the currently requested page was followed an HTTP cookie previously sent by the server with Set-Cookie (below) an HTTP cookie Authentication credentials for HTTP authentication Contains account information for the costs of the application of the method requested Allows a 304 Not Modified to be returned if content is unchanged Implementation-specific headers that may have various
Cookie
Cookie: $Version=1; Skin=new;
Set-Cookie Authorisation
Set-Cookie: UserID=JohnDoe; Max-Age=3600; Version=1 Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
Charge-To
If-Modified-Since
If-Modified-Since: Sat, 29 Oct 1994 19:43:31 GMT
Pragma
Pragma: no-cache
53
effects anywhere along the request-response chain. Content-Type The mime type of the body of the request (used with POST and PUT requests) The type of encoding used on the data. The last modified date for the requested object, in RFC 2822 format What partial content range types this server supports
Content-Type: application/xwww-form-urlencoded
Content-Encoding
Content-Encoding: gzip
Last-Modified
Last-Modified: Tue, 15 Nov 1994 12:45:26 GMT
Accept-Ranges
Accept-Ranges: bytes
NOTE:
Content substitution uses a powerful Perl Compatible Regular Expression language. If you want to include special characters such as . $ ^ ( ) + * [ ] they must be escaped. Do this by simply putting \ in front for example \$ \. or even a double escape \\ Compression is switched off per channel when using flightPATH rules with Body Replace as an action in Software Build 1475 and earlier.
54
How do I apply flightPATH rules?

flightPATH rules are designed to manipulate HTTP(s) traffic as such the option for flightPATH is not visible for non HTTP protocols. To enable a flightPATH rule go to (Setup IP Services) page. This will open the IP Service tab
flightPATH rules can be applied in the IP services screen under Action:
The list of available rules is on the right and the current rules in use are on the left. To add a new rule drag and drop the rule into position:
ADD RULE
REMOVE RULE
The order for execution is important and will start with the top rule being executed fist. To change the order simple drag and drop into the correct location. To remove a rule simply drag and drop it back to the rule inventory.
55
Caching
Using the Navigation bar on the left of the web interface go to (Configure Cache). This will open the tab allowing you to access the caching configuration screen.
How jetNEXUS Caching Works

Upon receipt of a request, the cache is searched for the requested page. The request is forwarded to a local content server group if the page cannot be found in the cache. If it is in cache, but expired, a revalidation request is used with the most recent If-ModifiedSince value. If the cache entry is OK (i.e. if the content matches If -Modified-Since) a cache local 304 Not Modified is returned, otherwise a cache local full response is sent. Upon filling the cache, the oldest (least recently used) content is retired from cache in order to make room for the new content. When the cache size meets the maximum size, or when the timer triggers a check, or when the check cache button is clicked, a cache ch eck is performed. Whilst the size of the cache is greater than the desired, content is removed from the cache as described above. Once the desired size is reached, the cache is left to grow naturally until the next check is triggered. The Caching screen is divided into three parts: Cache Settings Create Cache Rule Apply Cache Rule
56
Cache Settings
Maximum Cache Size (MB): Maximum RAM that the Cache can consume.
The jetNEXUS Cache is an in-memory cache that is also periodically backed onto hard disk to maintain cache persistence after restarts, reboots and shutdowns. This means that the maximum cache size must fit within the memory footprint of the appliance (rather than disk space) and should be no more than half of available memory.
Desired Cache Size (MB): Optimum RAM that the Cache will be trimmed to.
While the maximum cache size represents the absolute upper boundary of the cache, the desired cache size is intended as the optimum size that the cache should attempt to attain whenever an automatic or manual check on the cache size is made. The gap between the maximum and desired cache size exists to accommodate the arrival and overlap of new content between periodic checks on cache size for the purpose of trimming expired content. Once again, it may be more effective to accept the default value (30 MB) and periodically review the size of the cache under Monitor -> Statistics for appropriate sizing.
Default Caching Time (D/HH:MM): Life of content without an explicit expiry value.
The default caching time is the period content will be stored in the cache for items that dont have a no-store directive, but also have no explicit expiry time in the traffic header. The field entry takes the form D/HH:MM - so an entry of 1/00:00 (the default) means to store the item for one day, 01:00 for one hour and 00:01 for one minute.
Cacheable HTTP Response Codes: HTTP responses that will be cached.

This field should be edited with caution as the most common cacheable response codes are already listed:
200 - Standard response for successful HTTP requests. 203 - Headers are not definitive, but are gathered from a local or a 3rd party copy. 301 - The requested resource has been assigned a new permanent URL. 304 - Not modified since the last request & locally cached copy should be used instead. 410 - Resource is no longer available at the server and no forwarding address is known. Cache Checking Timer (D/HH:MM): Interval between cache trim operation Cache-Fill Count: Count of 304s for a cached item before re-fetching
57
Create a Cache Rule
Our example rule will be called Cache Graphics and will restrict content to the known graphic types already shown in the dropdown list (see below):
Pressing the
will add the Cache Graphics rulebase.
Our next example rule will be called apps in URL and will restrict caching to content whose text contains /apps/ anywhere in the URL:
If there's a mistake in any of the values, you can either edit or delete the line later. Click the button to make the changes take effect.
58
Apply Cache Rule

If you have traffic flowing through your ALB-X then your domain name should appear in the Domain Name drop down box. Below we see demo.jetnexus.com
Click Add Domain
Then choose your Caching Rulebase called Cache Graphics.
Click
to apply.
You can monitor caching behaviour via the (Monitor Cache) screen:
Content Statistics
59
Connection Pooling
Using the Navigation bar on the left of the web interface, go to (Setup IP Services) page. This will open the tab.
What is connection pooling?

Connection pooling minimises the connections to the content servers, recycling these connections as fast as possible to service client requests.
Enable connection pooling?

To access the pooling, select the Channel IP you wish to modify and click on actions:
Tick the Enable connection pooling box, and enter the pool size which is normally set to 2000 or less:
Once the simultaneous requests on each server reach the pool size, the connections are capped. Additional client requests will use the next free connection. The content servers will service requests quickly leaving ALB-X to maintain scalability on the client-side.
60
SSL Offload and Termination

What can jetNEXUS do with SSL? jetNEXUS ALB-X has the ability to offload the SSL encryption and decryption work load from your backend servers and also becoming the termination point for your SSL certificates. jetNEXUS ALB-X also has the ability to re-encrypt traffic to the back-end content servers for more secure environments. SSL Tasks that can be completed on the jetNEXUS ALB-X
Create Self Signed Certificates Create Certificate Requests for Certificate Authorities Install Trusted Certificates supplied by a Certificate Authority Importing certificate from an IIS server Importing certificates from an Apache Web server Importing certificates from another jetNEXUS Accelerator Export Certificates to be used another jetNEXUS ALB-X or web Server Configure Listening Interfaces as SSL interfaces Configure content server for SSL
61
Creating a Self Signed Certificate

Using the Navigation bar on the left of the web interface, go to (Configure SSL) Click on this will open the create certificate tab. You will then be presented with the Create Certificate screen:
Certificate Name: A unique name which will identify the certificate when it is created
Avoid use of $ / . * ? < > - & and all types of quotes.
Organization: Organization information for the certificate. Organizational Unit: Add the appropriate information for the certificate. City /Locality: Location information for the certificate. State/Province: Location information for the certificate. Country: Location information for the certificate. Domain Name: Domain name information for the certificate. Key Length: Key Length indicates the length of the RSA key which will be used to generate
the certificate. Period (Days): Period is only required for Self Signed certificates and indicates the duration of the certificate. Once the certificate information has been entered, to generate the self-signed certificate, click Create Local Certificate. A completed self-signed certificate is below.
62
Creating Certificate Requests

Using the Navigation bar on the left of the web interface, go to (Configure SSL) Click on , this will open the create certificate tab Once the certificate request information has been entered, to generate the certificate request, click Create Certificate Request:
The certificate request is displayed in a popup window, as shown below, so it can be copied into the Certificate Authority Request form:
63
Installing Trusted Certificates

Using the Navigation bar on the left of the web interface, go to (Configure SSL) (and select , this will open the manage certificate tab Select the corresponding certificate request from the list box on the left hand side of the screen:
Select the certificate you wish to manage using the drop down:
Copy and paste the certificate supplied by the Certificate Authority into the certificate text box on the right hand side of the screen. You may also need to paste the intermediate certificates in here too AFTER the certificate signed by the CA. The order to paste your Begin Cert------End Cert is as below Top---------Signed Certificate back from the Certificate Authority 2nd----------Intermediate1 Closest to Signed Certificate 3rd----------Intermediate2 Bottom----------Intermediate3 Closest to the Root Certificate The ALB-X contains a Root Certificate bundle so it is not necessary to paste the root certificate below the last intermediate Finally to install the certificate, click 64
Certificate Management
Using the Navigation bar on the left of the web interface, go to (Configure SSL) and select , this will open the manage certificate tab (You can manage your certificates from this screen):
You have 4 options for each certificate:
Renew
The Renew button performs the same functions as the Create Local Certificate and Create Certificate Request buttons on the Certificate Creation screen. If a self-signed certificate has been selected, when the Renew button is clicked, the selfsigned certificate will be created with the same information supplied on the Certificate Creation screen. If a certificate request or installed trusted certificate is selected the certificate request will be recreated and displayed in a popup window.
65
Show
The Show button will display the details of the selected self-signed certificate, pending certificate request or installed trusted certificate in a popup window, as shown below:
Delete
The Delete button allows a self-signed certificate, pending certificate request or trusted certificate to be completely removed from the jetNEXUS ALB-X.
Install
The Install button allows a certificate to be installed copy and paste the certificate into the field.
Importing Certificates
Using the Navigation bar on the left of the web interface, go to (Configure SSL) and , this will open the Import certificate tab
The imported certificate should be a PKCS#12 file and should include an exported private key. The Certificate Name is the name to be used to reference the import certificate. It should be a unique name:
The Password is the password supplied when the certificate was exported, either from another jetNEXUS ALB-X or from an Apache or IIS web Server. Click browse to locate your certificate, click go to upload it:
66
Exporting Certificates
Using the Navigation bar on the left of the web interface, go to (Configure SSL) and click on , This will open the Export certificate tab
Select the certificate to be exported using the Certificate Name drop down:
The supplied Password will be required when the certificate is imported to another jetNEXUS ALB-X or to an Apache or IIS web server: The password must be secure but one you are able to remember, this password should never be sent with the PFX file. Click Export to export the certificate you will then be asked where to save the file:
67
Failover configuration
Using the Navigation bar on the left of the web interface, go to (Setup Appliance) page, this will open the tab.
For fail over operation, you will need to configure multiple jetNEXUS ALB-Xs with the same listening interface information. Why use failover?
Failover is used for high availability of your application or web service and also providing hardware redundancy. You have 2 main ways to configure jetNEXUS failover
Active/Passive For the same Channel (Virtual IP:Port)

Using 2 ALB-Xs which work as an Active/Passive cluster where you have 1 unit as Primary serving all connections, and 1 unit as a Secondary/Slave waiting to take the incoming connections if the primary unit fail.
Active/Active For different Channels (Virtual IP:Port)

Using 2 ALB-Xs which work as an Active/Active cluster where both units are able to serve different Channel IPs and become the secondary for each service not marked as primary on that unit.
Enabling failover?
You will need to first tick the enable the failover function on the ALB-X, click update:
Complete this step on each unit you wish to be part of the cluster.
68
Failover diagram
Firewall Web Traffic Is sent to the jetNEXUS ALBs which are Listening on 10.0.34.100 for ports 80 & 443
jetNEXUS ALB-1 Accepts connections on the same Listening Service (IP and port) Base IP: 10.0.34.251
jetNEXUS ALB-2 Accepts connections on the same Listening Service (IP and port)
Svr_Web_1 Svr_Web_2 Svr_Web_3 Svr_Web_4 10.0.34.11 10.0.34.12 10.0.34.13 10.0.34.14
Both units have failover enabled but are using channels to enable failover for services.
69
Failover diagram explained

Both units have different Base IPs but the configuration for Channels are the same:
Base IP: 10.0.34.251
Base IP: 10.0.34.252 Listening IP: 10.0.34.100 Ports: 80 & 443 ALB then creates a connection of its own to a content server based on the load balancing policy.
On ALB-X-1 we have ticked the Primary box on the following channel making this the Primary unit.
On ALB-X-2 we have not ticked the Primary box on the same channel making this unit the Failover:
70
Failover Configuration
To setup load balancing on a channel click (Setup IP Services). This will open the IP Service tab. A new tick box to enable this unit as the Primary box is now shown on each channel; click this box and then update:
This unit is now the primary ALB-X on this Channel. Different jetNEXUS ALB-Xs can be primary on different IP addresses. If the primary jetNEXUS ALB-X is unable to support any of the listening interfaces associated with the IP address, e.g. the primary is powered down or it loses contact with all content servers associated with the listening interface, a secondary jetNEXUS ALB-X will take over. If jetNEXUS ALB-X loses contact with all content servers, it removes support for that Virtual IP address. In a fail over configuration, another jetNEXUS ALB-X will step into the breach.
Failover status lights

The coloured lights to the left of the listening interface shows the status:
Application server and or channel are providing service Secondary channel is assessing primary service state Listening interface is inactive, but in failover standby ready to support it
71
Monitoring & Alerting

Using the Navigation bar on the left of the web interface, click on the will open the tab: button, this
Dashboard
Disk Space
This section gives an indication on how much disk space is being used by the jetNEXUS ALBX.
Memory Indication Bar

This section gives an indication on how much system memory the jetNEXUS ALB-X is using.
CPU Indication Bar

The section gives an indication of the current CPU load on the jetNEXUS ALB-X.
Events
Under the graphics is a rolling log the highlight of the system log. Information such as content server coming on and off line and services starting and stopping are displayed:
72
73
Statistics
Using the Navigation bar on the left of the web interface, go to (Monitor Statistics), this will open the tab:
Default statistics screen
Compression Statistics
The Content Compression to Date percentage is the amount by which jetNEXUS ALB-X has reduced compressible content (e.g. Text, HTML, Style sheets). A higher figure indicates better compression rates. The Throughput before compression figure shows the number of bytes that WOULD have been transmitted if jetNEXUS had not compressed the data. The Throughput after Compression figure show the ACTUAL number of bytes transmitted. The Overall Compression to Date percentage is the amount by which jetNEXUS has reduced all output from the server including the overhead of those items that it did not compress. Note: The jetNEXUS ALB-X counts compression statistics only for requests from browsers that accept compression.
74
Overall Hits Counted

The number of requests received by jetNEXUS ALB-X whether or not content was compressed:
Overall Hit Counted: The total number of hits since the last reset. On the right hand side the number of current hits/second. Total Connections: The total number of TCP connections since the last reset. On the right hand side the current number of new TCP connections per second from the client to the ALB-X. Also on the far right the current number of new TCP connections per second from the ALB-X to the Content Servers. Peak Connections: The maximum number of concurrent connections attained since last reset. On the right hand side shows the current number of concurrent connections.
Caching
If content caching is enabled then additional statistics will be displayed
From Cache: Number of hits and bytes that are served from the jetNEXUS ALB-X. Also included is the percentage of the overall hits/bytes that are being served by the jetNEXUS ALB-X cache. From server: Number of hits and bytes that are served from the content servers. Also included is the percentage of the overall hits/bytes that are being served by the content servers. Cache Contents: The number of cached objects and the size in bytes if the total cached objects. On the far right is the percentage of the maximum cache used by the current cached objects.
Hardware
Disk Usage: Percentage of disk spaced used. Memory usage: Percentage indicates how much memory jetNEXUS ALB-X is currently using. CPU usage: Percentage indicates the loading on jetNEXUS Accelerators CPU. 75
Logging
Using the Navigation bar on the left of the web interface, go to (Monitor Logging), this will open the tab.
As discussed earlier in the manual W3C Logging mode will start jetNEXUS ALB-X recording a W3C compatible log file of activity.
Download W3C Log

This will download the W3C compatible log from ALB-X. The format of the file name is: w3cyyyymmdd.log where (yyyy = year 2000 onwards, mm = month 1-12, dd = day 1-31)
jetNEXUS W3C logs are compatible with the w3c draft standard for web server logs and should be compatible with most analysis tools.
Download System Log

This will download the event log for the appliance. The format of the file name is: sysyyyymmdd.log where (yyyy = year 2000 onwards, mm = month 1-12, dd = day 1-31)
76
Email Events
Using the Navigation bar on the left of the web interface, go to (Configure Email Events) this will open the tab
What can you set?

The ALB-X can be configure to automatically send email alerts on key events such as losing service, Overheating, device rebooting, interfaces being raised or lowered, contents servers coming on and off line etc.
Mail Server [SMTP] Setup:
Send E-Mail Events To E-Mail: Return E-Mail Address: Host address: Port: Send Timeout: Use Authentication: Security: Mail Server Account Name: Mail Server Password:
support@jetNEXUS.com support@jetNEXUS.com IP or FQDN 25 2 If required by your mail server If required by your mail server username password
77
Alerts & Notifications:
All Values below can be modified you meet your specific message requirements: IP Service Notice: IP Service Alert: Channel Notice: Channel Alert: Content server Notice: Content server Alert: flightPATH: Group notifications together: Grouped mail description: Send grouped mail every: Disk Space warning: Warn if free space less than: License renewal warning: Service Alert Message title Service Stopped Alert Channel Alert Message title Channel Stopped Alert Content Message title Content Server Alert flightPATH Message title All alerts into a single e-mail alert Grouped Message title Time for alerts to be sent Disk near full message Percentage of disk before alert License renewal required
78
Services
Date and Time
Simply enter the new time (UTC format and Click on update):
Time Server URL:

Timeserver URL allows jetNEXUS ALB-X to connect to an SNTP time server. If jetNEXUS ALBX has a gateway that also provides a DNS facility, a URL works too. In most circumstances, it is better to resolve the DNS name into an IP Address and use it instead.
Update at [hh:mm]:
Update at is the time of day that jetNEXUS ALB-X contacts the SNTP time server. This controls what time of day the time corrections will happen.
Update period [hours]:

Update period states how often jetNEXUS ALB-X should consult the SNTP time server. This might be 24, 6 or 1 as required. Fractional hours are valid too if needed.
NTP Type:
The SNTP time server protocol standard is selected using the drop-down box. Supported settings are:
You will see time corrections carried out in the System Log. JetNEXUS ALB-X logs both successful and unsuccessful attempts. Successful updates also show any time discrepancy.
79
Ping
The ping tool can be used to check network connectivity:
IP Address is where to enter the IP Address of the device to contact with an echo test. Click Ping to perform the echo test. Four attempts are made to contact the device. The text area displays the results on completion.
SNMP
Setting up the jetNEXUS ALB-X to provide a Simple Network Management Protocol:
SNMP v1/2c Enabled allows SNMP version 1 and version 2c access using the specified
Community String. The default community string is jetNEXUS.
SNMPV3 Enabled allows SNMP V3 for a single user admin with the default Passphrase
jetNEXUS. To change the Passphrase, enter the old Passphrase, the new Passphrase twice and click Update. **JetNEXUS ALB-X SNMP security settings are separate from other security settings on ALBX. Set them independently to values required by the management infrastructure.
80
Capture
Capture is a useful debugging tool, you may be asked to use this by the jetNEXUS support team when trying to troubleshoot an issue:
Adapter: Packets: Duration:
The adapter from where you want the trace The number of packets you want collected The duration in seconds of the trace
Click the Generate button:
The file will be returned to the browser in a GZ form.
81
Restart
To initiate the restart operation click Restart:
Note: It can take up to 30 seconds for jetNEXUS ALB-X to restart.
Reboot
To initiate a reboot, click Reboot. Note: It can take a couple of minutes for the jetNEXUS to reboot:
Power Off
To initiate power-off, click Power Off:
Note: To restart jetNEXUS, a hardware power on will be required.
Note: In the event of power supply loss, jetNEXUS ALB-X will automatically power on again when power is reconnected.
82
jetPACK Quick Installation

The jetNEXUS ALB-X can be configured automatically with a Lync 2010 jetPACK, template which is fully-tuned with all of the application-specific settings that you need in order to enjoy optimised service delivery from your ALB-X. If you supply the VIP and real server and proxy server IP addresses to support@jetnexus.com we will send you a custom jetPACK that you simply upload to the jetNEXUS ALB-X. The upload can be done via the GUI and will be fully configured in less than 2 minutes. The relevant jetPACK can be applied to multiple jetNEXUS ALB-X appliances saving valuable time and eliminating simple mistakes.
For more information please go to our website http://www.jetnexus.com/jetpack.html
83
Troubleshooting
Further help can be found on the jetNEXUS websites
http://www.jetNEXUS.com/support.html http://forum.jetNEXUS.com/ http://www.jetnexus.com/load-balance-microsoft-lync2010-tutorial.html
Contact Us
I hope you have found this User Guide informative, but if you need any clarification or further information, please do not hesitate to get in contact with jetNEXUS Support: E-mail Support Phone support@jetNEXUS.com +44 (0870) 382 5529 +44 (0870) 382 5550
Check out our blog http://jetNEXUS.blogspot.com/
84

Jetnexus ALB-X-User-Guide-v2.5

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Jetnexus ALB-X-User-Guide-v2.5

Transféré par

Droits d'auteur :

Formats disponibles

User Manual:

ALB-X: Hardware/Virtual Appliance

Author: Version: Updated:

jetNEXUS Solutions Limited 2.5 16/04/2013

jetNEXUS Platform Availability

What is the jetNEXUS ALB-X?

jetNEXUS ALB-X Benefits

High Availability for your Mission Critical Business Applications

How can I deploy jetNEXUS ALB-X

Single network interface configuration

Svr_Web_1 Svr_Web_2 Svr_Web_3 Svr_Web_4 10.0.34.11 10.0.34.12 10.0.34.13 10.0.34.14

Multi network interface configuration

User User on the 10.0.34.x network accesses the listening IP of 10.0.38.100

Svr_Web_24 Svr_Web_25 10.0.38.24 10.0.38.25

Deploying a single network interface configuration

Deploying a multiple network interface configuration

Configuring your jetNEXUS ALB-X

Connecting to the jetNEXUS ALB-X Web Console

You will be challenged for a username and password:

Username: admin Password: jetnexus

Advanced Network Setting

Setting the Default Route

Setting a Static route

Setting the network speed

Bonding Modes Balance-rr

Adding interfaces to the bond

Both eth1 and eth2 are now part of bond0:

Adding a new bonded adapter

Configuring your adaptor in a VLAN

Add VLAN ID to your adaptor

License your ALB-X

Configuring your Virtual Services

Channel Details Destination Actions Adding a new Channel

192.168.101.100 255.255.255.0 80 Web Servers VIP HTTP 10000

Setup Destination Details

Configuring a new Content server

Adding additional Content servers

Server Monitoring None

Direct Server Return

Client Makes a request to the Website

Listening IP: 10.0.34.100:80 Content server: 10.0.34.11:80

ifcfg-lo:1 DEVICE=lo:1 IPADDR=x.x.x.x NETMASK=255.255.255.255 BROADCAST=x.x.x.x ONBOOT=yes

net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eht1.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth1.arp_announce = 2 4. sysctl - p

ifcfg-lo:1 DEVICE=lo:1 IPADDR=x.x.x.x NETMASK=255.255.255.255 BROADCAST=x.x.x.x ONBOOT=yes

net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eht1.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth1.arp_announce = 2 4. sysctl - p

ifcfg-lo:1 DEVICE=lo:1 IPADDR=x.x.x.x NETMASK=255.255.255.255 BROADCAST=x.x.x.x ONBOOT=yes

net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eht1.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth1.arp_announce = 2 4. sysctl - p

Caching Strategy Off:

SSL Client Side SSL:

Content Server Side SSL:

Connection Pool Size

Adding another service on the same channel

*(Automatically propagated from the first rule)

Adding an additional channel IP

Configuring Server Health Monitoring

Condition: Evaluation: Action:

What can flightPATH Do?

Application firewalling and Security

How do I build a flightPATH rule?

Path Cookie Query

A user defined string in the response body

The http code for the response

200 OK, 304 Not Modified