jetnexus ALB-X-User-Guide-v2.5

1 jetNEXUS ALB-X User Manual - Copyright © 2013, jetNEXUS Limited. All Rights Reserved

User Manual:

ALB-X: Hardware/Virtual Appliance jetNEXUS Solutions Limited Suite 2 Anglers Court, 33-44 Spittal Street, Marlow, Buckinghamshire, SL7 1DB UK

Phone: 0870 382 5050 or International +44 (0) 1628 820 630

Fax: 0870 382 5520 or International +44 (0) 1628 820 647

Author: jetNEXUS Solutions Limited

Version: 2.5

Updated: 16/04/2013

Copyright © 2005 - 2013 jetNEXUS, Ltd. All Rights Reserved. © 2005-2013 jetNEXUS, Ltd. All rights reserved. jetNEXUS and the jetNEXUS logo are registered trademarks of jetNEXUS, Ltd. jetNEXUS, Ltd. reserves all ownership rights for the jetNEXUS ALB-X/ALB-X product line including software and documentation


Limitations: This document and all of its contents are provided as-is. jetNEXUS has made

efforts to ensure that the information presented herein are correct, but makes no warranty,

express or implied, about the accuracy of this information. If any material errors or

inaccuracies should occur in this document, jetNEXUS will, if feasible, furnish appropriate

correctional notices which Users will accept as the sole and exclusive remedy at law or in

equity. Users of the information in this document acknowledge that jetNEXUS cannot be

held liable for any loss, injury or damage of any kind, present or prospective, including

without limitation any direct, special, incidental or consequential damages (including

without limitation lost profits and loss of damage to goodwill) whether suffered by recipient

or third party or from any action or inaction whether or not negligent, in the compiling or in

delivering or communicating or publishing this document.

Microsoft Windows is a registered trademark of Microsoft Corporation in the United States

and other countries. All other trademarks and service marks are the property of their

respective owners.


Table of Contents jetNEXUS Introduction ............................................................................................................... 7

Scope ...................................................................................................................................... 7

jetNEXUS Platform Availability ............................................................................................... 7

Hardware: ........................................................................................................................... 7

ISO: ...................................................................................................................................... 7

Virtual Appliance: ............................................................................................................... 7

What is the jetNEXUS ALB-X? ................................................................................................. 8

jetNEXUS ALB-X Benefits .................................................................................................... 8

How can I deploy jetNEXUS ALB-X ......................................................................................... 9

Single network interface configuration .............................................................................. 9

Multi network interface configuration ............................................................................. 10

Deploying a single network interface configuration ........................................................ 11

Deploying a multiple network interface configuration .................................................... 11

Configuring your jetNEXUS ALB-X ............................................................................................ 12

Installing jetNEXUS ALB-X ..................................................................................................... 12

Connecting to the jetNEXUS ALB-X Web Console ................................................................ 12

Getting Started ..................................................................................................................... 14

Setting the IP address ....................................................................................................... 14

Appliance Section ............................................................................................................. 15

Setting the Default Route ................................................................................................. 16

Setting a Static route ........................................................................................................ 16

Setting the network speed ............................................................................................... 17

Advanced Networking .......................................................................................................... 18

Bonding ............................................................................................................................. 18

What is bonding? .............................................................................................................. 18

Bonding Modes ................................................................................................................. 18

Configure bonding ............................................................................................................ 19

Adding a new bonded adapter ......................................................................................... 20

Configuring your adaptor in a VLAN ................................................................................. 21

License your ALB-X ............................................................................................................... 21


Configuring your Virtual Services ............................................................................................. 22

Adding an IP-Service ............................................................................................................. 22

Adding a new Channel ...................................................................................................... 22

Channel Descriptions ........................................................................................................ 22

Setup Destination Details ..................................................................................................... 24

Content Server Group Name: ........................................................................................... 24

Status: ............................................................................................................................... 24

Activity: ............................................................................................................................. 24

IP Address: ........................................................................................................................ 24

Port: .................................................................................................................................. 24

Notes: ................................................................................................................................ 24

Configuring a new Content server .................................................................................... 25

Adding additional Content servers ................................................................................... 25

Actions .................................................................................................................................. 26

Server Monitoring ............................................................................................................. 26

Load Balancing Policy ....................................................................................................... 28

Connectivity ...................................................................................................................... 30

Windows ........................................................................................................................... 31

Linux .................................................................................................................................. 32

Windows ........................................................................................................................... 33

Linux .................................................................................................................................. 34

Windows ........................................................................................................................... 35

Linux .................................................................................................................................. 36

Caching Strategy ............................................................................................................... 37

SSL ..................................................................................................................................... 37

Connection Pooling ........................................................................................................... 37

Adding another service on the same channel .................................................................. 38

Adding an additional channel IP ....................................................................................... 40

Status lights ...................................................................................................................... 41

Configuring Server Health Monitoring ................................................................................. 42

flightPATH Menu .................................................................................................................. 43

What is flightPATH? .......................................................................................................... 43


What can flightPATH Do? ................................................................................................. 43

How do I build a flightPATH rule? ..................................................................................... 45

Pre-Built rules: .................................................................................................................. 45

Conditions ......................................................................................................................... 46

Match ................................................................................................................................ 47

Sense ................................................................................................................................. 48

Check ................................................................................................................................ 49

Evaluation ......................................................................................................................... 50

Action Tab ......................................................................................................................... 51

Actions Tab - ............................................................................................................................ 53

How do I apply flightPATH rules? ..................................................................................... 55

Caching ................................................................................................................................. 56

How jetNEXUS Caching Works.......................................................................................... 56

Cache Settings .................................................................................................................. 57

Create a Cache Rule .......................................................................................................... 58

Apply Cache Rule .............................................................................................................. 59

Connection Pooling .............................................................................................................. 60

What is connection pooling? ............................................................................................ 60

Enable connection pooling? ............................................................................................. 60

SSL Offload and Termination ................................................................................................ 61

What can jetNEXUS do with SSL? ..................................................................................... 61

Creating a Self Signed Certificate ..................................................................................... 62

Creating Certificate Requests ........................................................................................... 63

Installing Trusted Certificates ........................................................................................... 64

Certificate Management ................................................................................................... 65

Importing Certificates ....................................................................................................... 66

Exporting Certificates ....................................................................................................... 67

Failover configuration .......................................................................................................... 68

Why use failover? ............................................................................................................. 68

Failover diagram ............................................................................................................... 69

Failover diagram explained .............................................................................................. 70

Failover Configuration ...................................................................................................... 71


Monitoring & Alerting .......................................................................................................... 72

Dashboard......................................................................................................................... 72

Statistics ............................................................................................................................ 74

Logging .............................................................................................................................. 76

Email Events ...................................................................................................................... 77

Services ................................................................................................................................. 79

Date and Time................................................................................................................... 79

Ping ................................................................................................................................... 80

SNMP ................................................................................................................................ 80

Capture ............................................................................................................................. 81

Restart .............................................................................................................................. 82

Reboot .............................................................................................................................. 82

Power Off .......................................................................................................................... 82

jetPACK Quick Installation .................................................................................................... 83

Troubleshooting ................................................................................................................... 84

Contact Us ............................................................................................................................ 84


jetNEXUS Introduction

Scope

The aim of this document is to provide a user manual and deployment overview for the

jetNEXUS Accelerating Load balancer Extreme (ALB-X). If you have any questions about this

guide or require any assistance during your setup please do not hesitate to contact

[email protected] or call us on 0870 382 5529 where one of our dedicated support

team will be able to help with any questions or queries you have.

jetNEXUS Platform Availability

Hardware: The jetNEXUS Accelerating Load Balancer Extreme (ALB-X) is designed to offer

an Enterprise feature set at an SME price. It is the most effective next generation load

balancer (ADC) available on the market today.

ISO: The jetNEXUS ALB-X ISO is an installable version of the jetNEXUS Accelerating Load

Balancer Extreme. It is a fully integrated software product complete with operating system

and installer that can be easily used to build jetNEXUS ALB-Xs on supported server hardware

platforms.

Virtual Appliance: The Accelerating Load Balancer Extreme VA (ALB-X VA) offers all the

functionality and power of the ALB-X hardware appliance whilst delivering the added virtual

appliance benefits of quick deployment, increased flexibility and superb ease of use.

Virtual Platforms:

VMWare 4.0, 4.1, 5.0, 5.1

Microsoft Hyper-V Server 2008 R2

Microsoft Hyper-V 2012

Citrix XenServer 6.0

Amazon EC2,VPC

mailto:[email protected]

http://www.jetnexus.com/accelerating-load-balancer-extreme.html

http://www.jetnexus.com/application-delivery-controllers.html


http://www.jetnexus.com/accelerating-load-balancer-extreme-iso.html

http://www.jetnexus.com/accelerating-load-balancer-extreme-va.html


What is the jetNEXUS ALB-X? The jetNEXUS Accelerating Load balancer Extreme (ALB-X) is an advanced load balancing

and traffic management solution that enables clients to create and deliver fast, resilient,

and scalable online services.

The ALB-X is an Application Delivery Controller (ADC) sometimes referred to as a next

generation load balancer. The ALB-X is feature rich, delivering the advanced functionality

you would expect from a market leading solution at a cost effective price point. Focusing on

the features that make the biggest difference to end user experience, the ALB-X combines

Layer 7 Load Balancing, Compression, SSL Offload, SSL Re-encryption and Content Caching

in one comprehensive solution.

Features such as dynamic data compression, SSL offload, connection management and

content caching work to reduce server load and optimize application contents for superb

performance.

The ALB-X is a plug and play solution, available in a variety of formats. The GUI is intuitive

with drag and drop functionality. The ALB-X also features flightPATH, a powerful, scriptable

Layer7 routing engine for the creation of traffic rules and intelligent service management.

jetNEXUS ALB-X Benefits The ALB-X negates the costly effects of data center server sprawl, dramatically improving

the performance and efficiency of web servers to ensure high application availability and

service quality. The ALB-X represents the next generation in web load balancing by

delivering advanced ADC features in a comprehensive yet cost effective solution that is

flexible to deploy and easy to manage.

High Availability for your Mission Critical Business Applications The ALB-X is an essential network component, key to guaranteeing server availability and

delivering a reliable online service. The ALB-X can be deployed in a high availability pair to

enable fail over and remove any single point of failure.

The ALB-X server health monitoring feature can detect and route around problem

servers to eliminate downtime. Advanced reporting and logging provides real time

performance and availability stats for comprehensive monitoring and analysis. Features

such as dynamic data compression, SSL offload, connection management and

content caching work to reduce server load and optimize application contents for superb

performance. The ALB-X also features flightPATH, a powerful, scriptable Layer7 routing

engine for the creation of traffic rules and intelligent service management.



How can I deploy jetNEXUS ALB-X There are two fundamental ways to deploy jetNEXUS Accelerating Load Balancer.

Single network interface configuration Enabling only the eth0 (single network interface) and installing your jetNEXUS ALB-X into the

same network as your Web server/Applications servers flat network; this is suitable for most

scenarios. All inbound and outbound traffic passes over this single network interface.

jetNEXUS ALB-X accepts connections on a listening Channel (The combination of IP address

and port) and holds this. It then creates a connection of its own to a backend server based

on a load balancing policy. When it gets the required data from the server, the jetNEXUS

ALB-X then sends it on to the client. In this configuration the web management traffic also

goes over the single interface.

Firewall

Web Traffic Is sent to the jetNEXUS ALB which is

Listening on 10.0.34.100 for ports 80 & 443

jetNEXUS ALBAccepts connections on a

Listening Service (IP and port)

Listening IP: 10.0.34.100

Ports: 80 & 443ALB then creates a connection of its own to a content server based on the load balancing policy.

Svr_Web_1

10.0.34.11

Svr_Web_2

10.0.34.12

Svr_Web_3

10.0.34.13

Svr_Web_4

10.0.34.14

Eth0 IP: 10.0.34.66


Multi network interface configuration Enabling the Eth0 interface, and any another interface Eth1/Eth2 & Eth3 etc. The jetNEXUS

devices can proxy the traffic between any of the new network interfaces. This is suitable for

larger scenarios where network segmentations between web services are needed.

jetNEXUS ALB-X accepts connections on a listening Channel (The combination of IP address

and port) on any of the following interfaces Eth0/Eth1/Eth2 & Eth3 and holds this

information. It then creates a connection of its own to a backend server based on a load

balancing policy.

In a Multi Network configuration all traffic between the client and the jetNEXUS ALB-X can

go over any interface you specify in your channel configuration as the listening IP. All traffic

between the jetNEXUS ALB-X and the content server’s will go over whatever interface the

content server’s IP is in.

FirewallWeb Traffic Is sent to the jetNEXUS ALB which is Listening on 192.168.100.100 for ports 80 & 443

ALB then creates a connection of its own to the content servers based on a load

balancing policy.

jetNEXUS ALBAccepts connections on a

Listening Service (IP and port)

Listening IP: 192.168.100.100Ports: 80 & 443Content server: 10.0.34.11ContentServer: 10.0.34.12

Svr_Web_110.0.34.11

Svr_Web_210.0.34.12 Svr_Web_24

10.0.38.24Svr_Web_2510.0.38.25

Eth0: 192.168.100.251

Eth1:10.0.34.100 Eth2:10.0.38.100 Listening IP: 10.0.38.100Ports: 80 & 443Content server: 10.0.38.24ContentServer: 10.0.38.25

UserUser on the 10.0.34.x network accesses the listening IP of 10.0.38.100


Deploying a single network interface configuration Using the Navigation bar on the left of the web interface, go to (Setup Appliance) this will

open the tab allowing you to access the adapter settings.

The example below shows that we only have the address of 10.0.34.66 assigned to eth0 and

this shows that the device is currently running in a single network interface configuration:

Deploying a multiple network interface configuration Using the Navigation bar on the left of the web interface, go to (Setup Appliance) this will

open the tab allowing you to access the adapter settings.

The example below shows that we only have the address of 10.0.34.66 assigned to eth0 by

clicking on the “Add Adapter”, we can now add the details for the eth1 interface:

Fill in the address and subnet mask for the second (eth1) adapter. Once completed click on

Update and ALB-X will raise the interface on the eth1 adapter:


Configuring your jetNEXUS ALB-X

Installing jetNEXUS ALB-X Please refer to the Installation Guide which will include how to set the IP address of eth0 for

web console access.

Connecting to the jetNEXUS ALB-X Web Console The default web interface can be access via the following IP if it has not been able to contact

a DHCP server:

https://192.168.100.100:27376

You will be challenged for a username and password:

Username: admin Password: jetnexus

https://192.168.100.100:27376/


Once you have logged in you will be presented with the Dashboard screen:

The Dashboard provides Information on Disk space, Memory Utilization and CPU

Performance. It also gives visibility of the status of your services.

Using the Navigation bar on the left you will be able to access all the options to configure

your jetNEXUS ALB-X.


Getting Started Setting the IP address The first item to configure when setting up jetNEXUS ALB-X is the basic networking.

Using the Navigation bar on the left of the web interface go to (Setup Appliance). This will

open the tab allowing you to set the IP Address for the unit.

Adapter Details

Double click on the IP Address box & Subnet mask to enter the IP and subnet, each section

will turn blue allowing you to add IP and subnet information:

Your changes will be highlighted with a red triangle above them, then click on the update

button to commit your changes:


Appliance Section Now set the server ref appliance name and enter your DNS server:

Failover is enabled when ticked; this allows the appliance to act as a as part of a High-

Availability cluster. However this will be discussed in more detail later on in this guide:

Advanced Network Setting Server Nagle and Client Nagle can be enabled to pace connections where content is small.

These options are not enabled as default, and should only enable on older slower networks:

This is not required for HTTP communications but can be beneficial with some protocols on

a Layer 4 channel.

Once all information has been entered please use both update buttons


Setting the Default Route Using the Navigation bar on the left of the web interface, go to (Setup Network) this will

open the tab allowing you to add the Gateway and Static routing

information.

On this screen we configure a default gateway and routing, you must set a Gateway IP

Address:

In this example we have configured the Gateway IP of 10.0.0.1 on eth 0 once you have

configured your gateway click the update button:

Setting a Static route Static routes can be added by clicking on the “Add Route” button:

You will need the destination address and mask, the gateway and adapter. Once the details

are filled in, click update to action the settings. A tick is shown in the “Active” column when

the route is implemented:


Setting the network speed Using the Navigation bar on the left of the web interface, go to (Setup Hardware) This will

open the tab allowing you to set the Interface speeds.

The settings on this screen control the network access. The defaults are to fix speed at 100

Mbps and full duplex. This avoids any issue with certain networking devices that have auto-

negotiation which re-negotiates too frequently.

The device can support speeds from 10 to 1000, for 1000 this should set to auto/auto. If this

does not work, set the exact network hardware values:

To change the values, click on Speed or Duplex:

If you have changed any of these settings click the update at the top of the screen.

***Please note that setting network speed is only relevant for Hardware appliances. The

Virtual appliance will take the settings from the underlying Virtual Machine settings**


Advanced Networking Bonding Using the Navigation bar on the left of the web interface, go to (Setup Hardware) this will

open the tab. Bonding is not relevant for Virtual Appliances.

What is bonding? Bonding allows you to aggregate multiple ports into a single group, effectively combining

the bandwidth into a single connection. Bonding also allows you to create multi-gigabit

pipes to transport traffic through the highest traffic areas of your network. Note this is only

relevant for your hardware version of ALB-X. Do not use bonding for the Virtual Appliance.

Bonding Modes Balance-rr Transmits packets in sequential order from the first available slave to the last.

Active-backup

Has one interface will be live and the second interface will be in standby. This secondary interface only becomes active if the active connection on the first interface fails.

Balance-Xor Transmits based on (source MAC address XOR'd with destination MAC address) This selects the same slave for each destination Mac address.

Broadcast

Transmits everything on all slave interfaces.

802.3ad

Creates aggregation groups that share the same speed and duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad specification.

Balance-tld The Adaptive transmit load balancing bonding mode: Provides channel bonding that does not require any special switch support. The outgoing traffic is distributed according to the current load (computed relative to the speed) on each slave. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed receiving slave.

Balance-ALB-X The Adaptive load balancing bonding mode: also includes balance-tlb plus receive load balancing (rlb) for IPV4 traffic, and does not require any special switch support. The receive load balancing is achieved by ARP negotiation. The bonding driver intercepts the ARP Replies sent by the local system on their way out and overwrites the source hardware address with the unique hardware address of one of the slaves in the bond such that different peers use different hardware addresses for the server.


Configure bonding Use the Navigation bar on the left of the web interface, go to (SetupHardware) this will

open the tab

Using the Navigation bar on the left of the web interface, go to (SetupHardware)

Bonding is broken down into two sections bonding and interfaces, you will first need to

create a Bond. Click on Add button on the bonding section:

You will then be able to add a new bond and then select your bonding mode:

Adding interfaces to the bond In the example below I will add eth1 and eth2 to bond0:

Both eth1 and eth2 are now part of bond0:


Adding a new bonded adapter Using the Navigation bar on the left of the web interface, go to (Setup Appliance) this will

open the tab.

Click on Add Adapter and select bond0, you will need to configure this with an IP address

and subnet mask. In the example I have used 172.16.1.240/24:

Example: Bond0 now configured with 172.16.1.240/24:

Note: Bonding should not be used for Virtual Appliances. Bonding in this way is only suitable for

Hardware Appliances.


Configuring your adaptor in a VLAN Using the Navigation bar, on the left of the web interface.

Go to (SetupAppliance) tab.

What is a VLAN? A virtual LAN, commonly known as a VLAN, is a group of hosts with a common set of

requirements that communicate as if they were attached to the same broadcast domain,

regardless of their physical location.

Add VLAN ID to your adaptor On the Adapter settings screen you have the ability to add VLAN information into the VLAN

box highlighted below:

License your ALB-X Using the Navigation bar on the left of the web interface.

Go to (SetupLicense) tab.

Please see our short video tutorial of

how to license your ALB-X

http://www.jetnexus.com/tutorial-

license-the-ALB-X.html

http://www.jetnexus.com/tutorial-license-the-ALB-X.html

http://www.jetnexus.com/tutorial-license-the-ALB-X.html


Configuring your Virtual Services

Adding an IP-Service Using the Navigation bar on the left of the web interface, go to (Setup IP Services) this will

open the tab allowing you to access the IP Services options.

The IP service page is spilt into 3 sections; each section must be completed after each other

to enable a channel IP.

Channel Details Destination

Actions Adding a new Channel To configure a channel click the “Add IP” button:

This will now add a blank Channel IP service ready for configuration:

Channel Descriptions Each Channel has a number of configuration options that are described below.

Primary: This is used to configure a channel as a primary or standby channel – More

information can be found on this in the chapter on Failover. The Tick Box will only appear

for appliances in High Availability Mode

IP Address: The Virtual IP for the channel

Subnet Mask: The Subnet mask for the virtual IP

Port: The port for the channel to listen on

Service Name: Type in a useful name to describe your service


Service Type: This is the protocol for your service. Choose from the options below.

Accelerate HTTP – HTTP with automatic browser side compression Layer 7

HTTP – HTTP(s) Layer 7

FTP – FTP application

Layer4 – Generic TCP Layer 4 traffic

SMTP(25) – Simple Mail Transfer Protocol

POP3(110) – Post Office Protocol 3

IMAP(143) – Internet Message Access Protocol

RDP(3389) – Remote Desktop Protocol

RPC(135) – Remote Procedure Call

RPC/ADS(59534) – Address Book Service (CAS Exchange 2010)

RPC/PF(59535) – Public Folders (CAS Exchange 2010)

NetBIOS(130) – Network Basic Input/Output System

TelNet(23) – Telnet

Max. Connections: This limits the number of simultaneous content server connections and can

be set per channel. For example if you set this to 1000 and have two content servers then the jetNEXUS ALB-X will only connect 1000 connections simultaneously to each of the two content servers. You may also choose to present a “Server too busy” page, once this limit is reached on all servers, helping users in the case.

Example In this example we will configure the following IP details, based on a One-Armed

Configuration.

IP Address: 192.168.101.100

Subnet Mask: 255.255.255.0

Port: 80

Service Name: Web Servers VIP

Service Type: HTTP

Max connections: 10000


Setup Destination Details When you add a channel IP the first content server is added for you, this blank field allows

you to add the IP Address and Port of your backend server:

Content Server Group Name: You can specify a name for the content servers.

Status: This service indication light will show if the backend server is available (see Status

Lights later in this guide)

Activity: Each content server can be assigned one of four activities.

Online: Any content servers assigned as “Online” will be part of the primary content

server pool. The status colour will be Green.

Standby: Any content servers assigned as “Standby” will remain offline until ALL of

the “Online” group fail, at which point the “Standby” group will start serving content.

If one of the “Online” groups becomes available they will start serving content and

the “Standby” group will no longer serve content. The status colour will be Yellow.

Offline: Any server assigned as “Offline” will immediately be taken offline and will

not serve any content. The status colour will be blue

Drain: Any content servers assigned as “Drain” will honour existing connections but

not accept new connections. This will flash Green/Blue whilst draining. Once the

existing connections have been serviced the content servers will be taken offline and

the status light will be blue.

IP Address: The IP Address of your backend content server.

Port: The port that your backend content server is listening on.

Notes: Write some useful notes about the content server


Configuring a new Content server In this example we will configure the following Content server details

Destination:

Connection Server Group Name: Server Group

Activity: Online

IP Address: 10.0.34.96

Port: 80

Adding additional Content servers To add additional content servers click on the “Add New” button to add a server:

You can now add your additional content servers:

Click on the Update button next to the “Add Content server” this enables the new content

server:

In the example below I have added 4 content servers to my load balanced channel:

Each content server has been assigned one of the four activities for illustrative purposes.

You may assign all servers as Online to load balance between all four servers. Alternatively,

any combination of activities is allowed.


Actions The default options for Actions allow you to select several different options these are

detailed below:

Server Monitoring

None In this mode, the content server is not monitored at all and is assumed to be always up and

running correctly. This is useful for situations where monitoring upsets a server and for

services that should not join in the fail-over action of ALB-X. It can be viewed as a way of

hosting unreliable or legacy systems that are not core to H/A operation. This monitoring

method can be used with any service type.

Ping/ICMP Echo In this mode, ALB-X sends an ICMP echo request to the IP of the content server. If a valid

echo response is received, the content server is deemed to be up and running and traffic

will be sent to it. It will also then keep the service available on an H/A pair. This monitoring

method can be used with any service type

TCP Connection In this mode, a TCP connection is made to the content server and immediately broken

without sending any data. If the connection succeeds, the content server is deemed to be

up and running. This monitoring method can be used with any TCP service type. UDP

services are the only ones currently not appropriate for TCP Connection monitoring.


200 OK In this mode, a TCP connection is made to the content server as above, but after connection

is made, a brief HTTP request is made to the content server. An HTTP response is waited for

and it is checked for the "200 OK" response code. If the "200 OK" response code is received,

the content server is deemed to be up and running. If, for any reason, the "200 OK"

response code is not received, including timeouts, failure to connect, etc, then the content

server is regarded as down. This monitoring method can only really be used with HTTP and

Accelerate HTTP service types, although if a Layer 4 Service Type is in use for an HTTP

server, it could still be used if SSL is not in use on the content server, or is handled

appropriately by the "Content SSL" facility.

HTTP Response

In this mode, a connection and HTTP request/response are made/checked for as above, but

instead of the "200 OK" response code being checked for, a custom text is searched for in

both the HTTP headers, and the body of the HTTP response. The text can be a whole

header, part of a header, a line from part of a page, or just one word. If the text is found,

the content server is deemed to be up and running. This monitoring method can only really

be used with HTTP and Accelerate HTTP service types, although if a Layer 4 Service Type is in

use for an HTTP server, it could still be used if SSL is not in use on the content server, or is

handled appropriately by the "Content SSL" facility.

DICOM Digital Imaging and Communications in medicine (DICOM) is a standard for handling,

storing, printing and transmitting information is medical imaging. In this mode, a TCP

connection is made, after a connection is made, an “associate request” is made. If the

content server is present it will respond with “associate accept” and a small amount of

“Echo” data is swapped between the ALB and the content server. The ALB then “Requests

release” which will be accepted by the content server in the form of a “Release response”.

This monitoring method only works with Layer 4 Service Types.


Load Balancing Policy

Round Robin: The simplest method, each back end server takes a turn.

Least Connections: The load balancer will keep track of the number of connections a back

end server has and send the next request to the server with the least connections.

IP Bound: In this situation the clients IP address is used to select which back end server

will receive the request. IP session persistence runs at layer 4 as such it can be used when

load balancing non HTTP protocols. This method is useful for internal networks where the

network topology is known and you can be confident that there are no “super proxies”

upstream. If this is the case the all the requests will look like they are coming from one

client, and as such the load would be uneven.

IP List Based: The initial connection to the content server is made using “Least

connections” then session affinity is achieved based on Clients IP. A list is maintained for 2

hours.

Cookie Based: This is the most popular persistence method for HTTP. In this situation,

least connections load balancing is used for each first request. A cookie is inserted into the

headers of the first http response. Thereafter, jetNEXUS ALB-X uses the client cookie to

route traffic to the same back end server. Again this is used when the client must go to the

same back end server each time.

Session Cookie:

Classic ASP Session Cookie: Active Server Pages (ASP) is a Microsoft server-side

technology. With this option selected the ALB-X will maintain session persistence to

the same server if an ASP cookie is detected and is found in its list of known cookies.

If a new ASP cookie is detected then it will be load balanced using the least

connections algorithm.

ASP.NET Session Cookie: ASP.NET is a Microsoft server-side technology. With this

option selected the ALB-X will maintain session persistence to the same server if an

ASP.NET cookie is detected and is found in its list of known cookies. If a new ASP.NET

cookie is detected then it will be load balanced using the least connections

algorithm.

JSP Session Cookie: Java Server Pages (JSP) is an Oracle server-side technology. With

this option selected the ALB-X will maintain session persistence to the same server if

a JSP cookie is detected and is found in its list of known cookies. If a new JSP cookie

is detected then it will be load balanced using the least connections algorithm.


JAX-WS Session Cookie: Java web services (JAX-WS) is an Oracle server-side


the same server if a JAX-WS cookie is detected and is found in its list of known

cookies. If a new JAX-WS cookie is detected then it will be load balanced using the

least connections algorithm.

PHP Session Cookie: Personal Home Page (PHP) is an open source server-side


the same server if a PHP cookie is detected.


Connectivity

You can configure your Channel IP services to run in the 4 connectivity modes below, each

mode is detailed below.

Once you have configured a Channel you will be able to access the Connectivity options:

Managed This is the default setting for jetNEXUS and works at, Layer7 with compression and Caching

and also at layer4 without caching and compression. In this mode the jetNEXUS acts as a

proxy and becomes the source address seen on the content servers.

How it works

- Client sends a request to the jetNEXUS - Request received by jetNEXUS

- Request routed to content servers

- Response sent to jetNEXUS

- jetNEXUS responds directly to client

Direct Server Return Direct Server Return, or DSR as it’s widely known (DR – Direct Routing in some circles)

allows the server behind the load balancer to respond directly to the client bypassing the

jetNEXUS on the response. DSR is suitable for using with Layer 4 load balancing only

therefore Caching and Compression are not available when enabled.

Layer 7 load balancing with this method will not work therefore there is no persistence

support other than source IP. SSL/TLS load balancing with this method is not ideal as there

is only source IP persistence support.

How it Works

- Client sends a request to the jetNEXUS

- Request received by jetNEXUS

- Request routed to content servers

- Response sent directly to client without passing through JetNEXUS


Diagram – DSR

Firewall

Web Traffic Is sent to the

jetNEXUS ALB. Which has a

channel IP Listening on

10.0.34.100:80

Web Server

Client

Makes a request to the

Website

jetNEXUS ALBForwards this request onto the content server.

Listening IP: 10.0.34.100:80Content server: 10.0.34.11:80

Content Server

The content server then

responds directly to the

client

Content server: 10.0.34.11:80loopback: 10.0.34.100

Required Content Server Configuration

The content server default gateway should be configured as normal. (Not via the jetNEXUS)

The content server needs to have a loopback or Alias configure with the IP address of the

Channel or VIP. Network metric must be 254 to prevent response to ARP requests.

The content server and the load balancer must be in the same subnet.

Windows

On windows the following commands must be run at the command prompt running in

administrator mode. Where net is the name of the name of the interface.

netsh interface ipv4 set interface “net” weakhostreceive=enable

netsh interface ipv4 set interface “loopback” weakhostreceive=enable

netsh interface ipv4 set interface “loopback” weakhostsend=enable


Linux

1. Add a permanent loopback interface

2. /etc/sysconfig/network-scripts

ifcfg-lo:1 DEVICE=lo:1 IPADDR=x.x.x.x NETMASK=255.255.255.255 BROADCAST=x.x.x.x ONBOOT=yes

3. edit /etc/sysctl.conf

net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eht1.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth1.arp_announce = 2

4. sysctl - p


Transparency

Transparency is suitable for Service Type Layer 4 load balancing only, Caching and

Compression are not available when transparency is enabled. Transparency is used when

you need the source address of the client making the request.

How it works


- Request is received by jetNEXUS

- MAC address is changed. Request forwarded to content servers


- jetNEXUS routes the response to the client


Content servers need to be configured to use the jetNEXUS Eth0 IP address as their default

gateway for single arm configuration.

Content server need to be configured to use the jetNEXUS Eth1 IP address as their default

gateway for dual arm configuration.




Windows







Linux






4. sysctl - p


Gateway Gateway mode allows you to route all traffic through the jetNEXUS, this allows traffic

originating from the content servers to be routed via the jetNEXUS to other networks via the

interfaces on the jetNEXUS unit. Using the device as a gateway device for content servers

should be used when running in multi interface mode.

How it works


- Request is received by jetNEXUS

- Request sent to content servers


- jetNEXUS routes the response to the client



gateway.


gateway for dual arm configuration.




Windows







Linux






4. sysctl - p


Caching Strategy Off:

No caching is applied

By Host:

Caching is applied on a per hostname basis. A separate Cache will exist for each hostname.

Ideal for web servers that can serve multiple websites depending on the hostname.

By Channel:

Caching is applied to the whole channel. Only one Cache will exist so this is for a web server

that only serves one website.

SSL

Client Side SSL:

- “No SSL”

SSL Off. This should be selected if No SSL is required

- “Default”

SSL On. This is the Default Certificate provided for test purposes

- “User Certificate Name”

SSL On. Once you have created or imported a certificate then you can select it here

to apply SSL to the Client/Browser side of the Channel

Content Server Side SSL:

- “No SSL”

SSL Bridging/Re-encryption Off

- “Any”

SSL Bridging/Re-encryption On. Select this to accept any certificate provided by the

content server

- “User Certificate Name”

SSL Bridging/Re-encryption On. Select this to accept only the named certificate

which should be the same as presented by the content server.

Connection Pooling When this is ticked the ALB-X maintains connections to the content server so they can be

reused when future requests to the content servers are requested. This setting is only valid

for Service Type “HTTP” and should only be used for stateless web connections only.

Connection Pool Size

Set the number of connections to maintain.


Adding another service on the same channel To set up another service on the same IP address and a different port click the “Add Port”:

This will add another grouping of settings similar to the first set. This time you don’t need to

specify the listening IP or subnet as it has already been added:

This now allows you to set up the new port and a set of web servers. These can be the same

as, or different from the first ones.

Example:

IP Address: 10.0.34.100*

Subnet mask: 255.255.0.0*

Port: 443

Service Type: Accelerate HTTP

Max. Connections: 10000

Content Server group Name: Traffic-Test

Content Servers 10.0.34.96

10.0.34.97

10.0.34.98

Port: 443

*(Automatically propagated from the first rule)


In the example below I have added my 3 content servers to my existing load balanced

channel but this time for port 443:

The original channel is still in place and active, these rules now services port 80 & 443 to the

content servers. Via the virtual IP of 10.0.34.100:


Adding an additional channel IP To add another listening IP addresses, click on the “Add IP” button:

This will bring up a new section including the option for the second IP address and port:

You can now type in the Details for your new channel IP service and configure the content

servers and actions for this new service:


Status lights There are two groups of status lights: There is only ONE status light per VIP in the Channel

Details section.

Each Content Server will have its own status light.

VIP:

Online

Content servers unreachable or no content servers enabled

Indicates a “secondary” is holding off for a “primary”

Failover-Standby

Finding Status

Unit not licensed

Content Servers:

Connected

Unreachable

Fall-back Standby

Offline. This will flash Green/Blue whilst draining.

Finding Status

Unit not licensed


Configuring Server Health Monitoring

Using the Navigation bar on the left of the web interface, go to (Configure Content-Server

Monitoring) this will open the tab allowing you to access the

monitoring options.

Name: Give the new method a useful name

Description: Give the new method a useful description

Monitoring Method: HTTP 200 OK: In this mode, a TCP connection is made to the content server as above,

but after connection is made, a brief HTTP request is made to the content server. An

HTTP response is waited for and it is checked for the "200 OK" response code. If the

"200 OK" response code is received, the content server is deemed to be up and

running

HTTP Response: In this mode, a connection and HTTP request/response are

made/checked for as above, but instead of the "200 OK" response code being

checked for, a custom text is searched for in both the HTTP headers, and the body of

the HTTP response. The text can be a whole header, part of a header, a line from

part of a page, or just one word. If the text is found, the content server is deemed to

be up and running.

DICOM: In this mode, a TCP connection is made, after a connection is made, a

DICOM “associate request” is made. If the content server is present it will respond

with “associate accept” and a small amount of “Echo” data is swapped between the

ALB and the content server. The ALB then “Requests release” which will be accepted

by the content server in the form of a “Release response”. The content server will

be deemed capable of service upon successful completion of this exchange. This is a

Layer 7 monitoring method that works with Layer 4 Service Type only.

Page Location: This is the location of the directory, header, and body to check or script to run.

Required Content: Enter the custom text that is required for a match (Only relevant for HTTP Response).

For DICOM you can enter the Application Entity Title (AET).


flightPATH Menu Using the Navigation bar on the left of the web interface, go to (Configure flightPATH) this

will open the tab allowing you access the flightPATH configuration menus:

What is flightPATH? flightPATH is a rule engine developed by jetNEXUS to intelligently manipulate and route

HTTP and HTTPS traffic. It is highly configurable, very powerful and yet very easy to use.

A flightPATH rule has three components:

Condition: Set multiple criteria to trigger the rule.

Evaluation: Variables that can be used in the Action

Action: The behaviour once the rule has triggered

What can flightPATH Do? flightPATH can be used to modify Incoming and Outgoing HTTP(s) content and requests. As

well as using simple string matches such as “Starts with”, “Ends With” etc. For more

complete control powerful Perl Compatible Regular Expressions can be implemented.

In addition, custom variables can be created and used in the Action enabling many different

possibilities.

Due to the configurable nature of flightPATH the options are infinite but some common uses

are as follows.


Application firewalling and Security Block unwanted IP’s

Force user to HTTPs for specific (or all) content

Block or redirect spiders

Prevent and alert cross site scripting

Prevent and alert SQL injection

Hide internal directory structure

Rewrite cookies

Secure directory for particular users

Features Redirect users based on path

Provide Single sign on across multiple systems

Segment users bases on User ID or Cookie

Add headers for SSL offload

Language detection

Rewrite user request

Fix broken URL’s

Log and Email Alert 404 response codes

Prevent directory access/ browsing

Send spiders different content


How do I build a flightPATH rule?

A flight path rule consists of conditions and actions. Multiple conditions can be added and are

always added together.

To add a new rule click the Add New button on Details, this enables you to give the

flightPATH rule a name and also a Description:

Multiple actions can also be created and are all executed if the conditions are met. Variables

can also be created to set values to be dynamically included on the action response.

flightPATH is preloaded with example rules for you to use these are listed below with the

definitions.

Pre-Built rules:

1. HTML Extension: Changes all .htm requests to .html

2. Index.html: Force to use index.html in requests to folders

3. Close Folders: Deny requests to folders

4. Hide CGI-BBIN: Hides cgi-bin catalogue in requests to CGI scripts

5. Log Spider: Log spider requests of popular search engines

6. Force HTTPS: Force to use HTTPS for certain directory

7. Media Stream: Redirects Flash Media Stream to appropriate channel

8. Swap HTTP to HTTPS: Change any hardcoded HTTP:// to HTTPs://

9. Blank out Credit Cards: Check that there are no credit cards in the response and

if one is found, blank it out

10. Content Expiry: Add a sensible content expiry date to the page to reduce the

number of requests and 304s

11. Spoof Server Type: Get the Server type and change it to something else

12. Never Send Errors: Client never gets any errors from your site

13. Redirect on Language: Find the language code and redirect to the related country

domain

14. Google Analytics: Insert the code required by Google for the analytics - Please

change the value MYGOOGLECODE to your Google UA ID


Conditions New conditions can be added by clicking, “Add New” button:

Multiple conditions can be used but all must be met for the rule to execute. These are called

AND rules. To use an OR you would need to create an additional flightPATH rule.

Each condition contains three elements and a value or not depending on the condition.

The conditions are listed below:

Condition Description Example

Host This is the host extracted from the URL www.mywebsite.com or 192.168.1.1

Language This is the Language extracted from the language HTTP

header

This condition will produce a dropdown with a list of

Languages

Path This is the path of the website /mywebsite/index.asp

Cookie The is the name of a cookie

Query This is the name and Value of a Query as such it can either

accept the query name or a value also.

“Best=jetNEXUS” Where the Match is Best and the

Value is jetNEXUS

Query String The whole query string after the ? char Best=jetNEXUS&Name=Me

Method This is a drop down of HTTP methods This is a dropdown that includes GET, POST etc

Version This is the HTTP version HTTP/1.0 OR HTTP/1.1

Header This can be any HTTP Header Referrer, User-Agent, From, Date

POST POST request method Check data being uploaded to a website

<form>

Response

Body

A user defined string in the response body

Response

Code

The http code for the response 200 OK, 304 Not Modified

Source IP This is either the origin IP, proxy server IP or some other

aggregator IP address

Client IP, Proxy IP, Firewall IP. Can also use multiple IP’s

and subnets. You must escape the dots as these are

RegEX. Example 10\.1\.2\.3 is 10.1.2.3

Origin IP Same as above except that if upstream proxy supports X-

Forwarded-for (XFF) it will use the true Origin address

Client IP. Can also use multiple IP’s or subnets.

10\.1\.2\..* is 10.1.2.0 /24 subnet

10\.1\.2\.3|10\.1\.2\.4 Use | for multiple IP’s

http://www.mywebsite.com/


Match The match will depend on the Condition chosen. So if Path is chosen then the Match will

be blank as it is not relevant. Choosing Request or Response Header will give you the

option below.

Match Description Example

Accept Content-Types that are acceptable Accept: text/plain

Accept-Encoding Acceptable encodings Accept-Encoding: gzip

Accept-Language Acceptable languages for response Accept-Language: en-US

Accept-Ranges What partial content range types this server

supports

Accept-Ranges: bytes

Authorization Authentication credentials for HTTP

authentication

Authorization: Basic

QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Content-Encoding The type of encoding used on the data Content-Encoding: gzip

Content-Length The length of the response body in Octets

(8-bit bytes)

Content-Length: 348

Content-Type The MIME type of the body of the request Content-Type: application/x-www-form-urlencoded

Cookie an HTTP cookie previously sent by the

server with Set-Cookie Cookie: MS_WSMAN=afYfb1CDqqCDqCVii

ETag An identifier for a specific version of a

resource, often a message digest

ETag: "aed6bdb8e090cd1:0"

Last Modified The last modified date for the requested

objec

Last-Modified: Tue, 15 Nov 1994 12:45:26 GMT

Pragma Implementation-specific headers that may

have various effects anywhere along the

request-response chain

Pragma: no-cache


Referer This is the address of the previous web page

from which a link to the currently requested

page was followed.

Referer: http://www.jetnexus.com

Set-Cookie Used to instruct a browser to use this

cookie on subsequent transactions

Set-Cookie: MS_WSMAN=afYfb1CDqqCDqCVii

Server A name for the server

Server: Apache/2.4.1 (Unix)

User-Agent The user agent string of the user User-Agent: Mozilla/5.0

Vary Tells downstream proxies how to match

future request headers to decide whether

the cached response can be used rather

than requesting a fresh one from the origin

server.

Vary: User-Agent

X-Powered-By specifies the technology (e.g. ASP.NET, PHP,

JBoss) supporting the web application

X-Powered-By: PHP/5.4.0

Sense The sense allows you to create a positive match or a negative match:

Does Value is true

Does not Value is not true


Check This sets the condition for the rule being fired:

Check Description Example

Exist Check that the Match Item is present Value = N/A

Start Check that the Match starts with the value in specified in the Value column

Value = www www.jetNEXUS.com = TRUE jetNEXUS.com = FALSE

End Check that the Match Ends with the value in specified in the Value column

Value = com www.jetNEXUS.com = TRUE www.jetNEXUS.co.uk = FALSE

Contain Checks any part of the Match for the Value Value = jetNEXUS www.jetNEXUS.com = TRUE www.jetNEXUS.co.uk = TRUE www.mywebsite.com = FALSE

Equal Check the Mach for an exact match Value = jetNEXUS www.jetNEXUS.com = FALSE jetNEXUS = TRUE

Have Length

Check the length of the match Value=16 www.jetNEXUS.com = TRUE www.jetNEXUS.co.uk = FALSE

Match RegEX

This enables you to enter a full Perl compatible regular expression.

Test for IP Address ^(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9])\.(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9]|0)\.(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9]|0)\.(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[0-9])$

Example: We can create the Condition if the Path Does Contain the IP Address

10.0.34.100, the Actions and Evaluations can be applied to it:

http://www.jetnexus.com/


http://www.jetnexus.co.uk/








Evaluation Adding a Variable is a very powerful feature that will allow you to extract data from the

request and include this in the actions. For example you could log a user username or send

an email if there is a security problem.

New Variables can be added by clicking, “Add New” button:

A variable name has to be in the following format $name$

So for example we would like to create a variable of the file extension

$fileextension$ = Path (From the drop down) = (.*\.)+(.+) (RegEx)

Evaluation Tab - Source

Source Description Example

Host This is the hostname extracted from the URL www.mywebsite.com or 192.168.1.1

Language This is the Language extracted from the language HTTP header

This condition will produce a dropdown with a list of Languages

Path This is the path of the website /mywebsite/index.asp

Cookie The is the name of a cookie

Query This is the name and Value of a Query as such it can either accept the query name or a value also.

“Best=jetNEXUS” Where the Match is Best and the Value is jetNEXUS

Query String

The whole query string after the ? char Best=jetNEXUS&Name=Me

Method This is a drop down of HTTP methods This is a dropdown that includes GET, POST etc

Version This is the HTTP version HTTP/1.0 OR HTTP/1.1

Header This can be any HTTP Header Referrer, User-Agent, From, Date

POST POST request method Check data being uploaded to a website



Action Tab

New actions can be added by clicking, “Add New” button:

Actions Tab - Actions The action is the task or tasks that are enabled once the rule is fired. All actions are fired:

Action Description Example

Rewrite Path This will allow you to redirect the

request to new URL based on the

condition

Target= /test/path/index.html

Data= N/A

Redirect 301 This will issue a temporary redirect Target= http://www.jetnexus.com

Data= N/A

Log Event This will log an event to the System

log

Target= “flightPATH has logged this in syslog”

Data= N/A

e-Mail Will send an email. You can use a

variable as the address or the

message

Target= “flightPATH has emailed this event”

Data= N/A

Drop This will drop the connection Target= N/A

Data= N/A

Use Server Select which server or channel to

use

Target= 192.168.101:80

Data= N/A

Body Replace First Search the Response Body and

replace first instance only

Target= http:// (Search string)

Data= https:// (Replacement string)

Body Replace Last Search the Response Body and

replace last instance only



Body Replace All Search the Response Body and

replace all instances





Replace Request

Header

Replace request header in the

Target with Data value

Target= Connection

Data= keep-alive

Add Request Header Add a request header of Target type

with value in Data section

Target= Accept

Data= image/png

Replace Response

Header

Replace the response header

detailed in Target section with value

in Data section

Target= Server

Data= Withheld for Security

Remove Response

Header

Remove the response header

detailed in Target section

Target= Etag

Data= N/A

Add Response Header Add request header detailed in the

Target section with value in the

Data section

Target= Cache-Control

Data= max-age=8888888

Replace Request

Cookie

Replace request cookie detailed in

the Target section with value in the

Data section

Target= Cookie

Data= MS-WSMAN=afYfn1CDqqCDqCVii

Remove Request

Cookie

Remove request cookie detailed in

the Target section

Target= Cookie


Add Request cookie Add request cookie detailed in the

Target section with value in Data

section

Target= Cookie



Actions Tab - Target

Target Description Data

From The email address of the user

making the request

From: [email protected]

Accept Content-Types that are

acceptable

Accept: text/plain

Accept-Encoding Acceptable encodings Accept-Encoding: <compress |

gzip | deflate | sdch | identity>

Accept-Language Acceptable languages for

response

Accept-Language: en-US

User-Agent The user agent string of the user

agent

User-Agent: Mozilla/5.0

(compatible; MSIE 9.0; Windows

NT 6.1; WOW64; Trident/5.0)

Referer

This is the address of the

previous web page from which

a link to the currently

requested page was followed

Referer:

http://www.jetnexus.com

Cookie an HTTP cookie previously sent

by the server with Set-Cookie

(below)

Cookie: $Version=1; Skin=new;

Set-Cookie an HTTP cookie Set-Cookie: UserID=JohnDoe;

Max-Age=3600; Version=1

Authorisation Authentication credentials for

HTTP authentication

Authorization: Basic

QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Charge-To Contains account information

for the costs of the application

of the method requested

If-Modified-Since Allows a 304 Not Modified to be

returned if content is

unchanged

If-Modified-Since: Sat, 29

Oct 1994 19:43:31 GMT

Pragma Implementation-specific

headers that may have various

Pragma: no-cache

http://en.wikipedia.org/wiki/Compress

http://en.wikipedia.org/wiki/Gzip

http://en.wikipedia.org/wiki/Deflate

http://en.wikipedia.org/wiki/Shared_Dictionary_Compression_Over_HTTP

http://en.wikipedia.org/wiki/User_agent_string

http://en.wikipedia.org/wiki/HTTP_cookie


effects anywhere along the

request-response chain.

Content-Type The mime type of the body of

the request (used with POST

and PUT requests)

Content-Type: application/x-

www-form-urlencoded

Content-Encoding The type of encoding used on

the data.

Content-Encoding: gzip

Last-Modified The last modified date for the

requested object, in RFC 2822

format

Last-Modified: Tue, 15 Nov

1994 12:45:26 GMT

Accept-Ranges What partial content range

types this server supports

Accept-Ranges: bytes

NOTE:

Content substitution uses a powerful Perl Compatible Regular Expression language.

If you want to include special characters such as . $ ^ ( ) + * [ ] they must be escaped.

Do this by simply putting \ in front for example \$ \. or even a double escape \\

Compression is switched off per channel when using flightPATH rules with Body

Replace as an action in Software Build 1475 and earlier.

http://en.wikipedia.org/wiki/Mime_type

http://tools.ietf.org/html/rfc2822


How do I apply flightPATH rules? flightPATH rules are designed to manipulate HTTP(s) traffic as such the option for flightPATH

is not visible for non HTTP protocols.

To enable a flightPATH rule go to (Setup IP Services) page. This will open the IP Service tab

flightPATH rules can be applied in the IP services screen under Action:

The list of available rules is on the right and the current rules in use are on the left. To add a

new rule drag and drop the rule into position:

ADD RULE

REMOVE RULE

The order for execution is important and will start with the top rule being executed fist. To

change the order simple drag and drop into the correct location. To remove a rule simply

drag and drop it back to the rule inventory.


Caching Using the Navigation bar on the left of the web interface go to (Configure Cache). This will

open the tab allowing you to access the caching configuration screen.

How jetNEXUS Caching Works Upon receipt of a request, the cache is searched for the requested page. The request is

forwarded to a local content server group if the page cannot be found in the cache.

If it is in cache, but expired, a revalidation request is used with the most recent “If-Modified-

Since” value. If the cache entry is OK (i.e. if the content matches “If-Modified-Since”) a

cache local “304 Not Modified” is returned, otherwise a cache local “full response” is sent.

Upon filling the cache, the oldest (least recently used) content is retired from cache in order

to make room for the new content. When the cache size meets the maximum size, or when

the timer triggers a check, or when the “check cache” button is clicked, a cache check is

performed.

Whilst the size of the cache is greater than the desired, content is removed from the cache

as described above. Once the desired size is reached, the cache is left to grow naturally

until the next check is triggered.

The Caching screen is divided into three parts:

Cache Settings

Create Cache Rule

Apply Cache Rule


Cache Settings

Maximum Cache Size (MB): Maximum RAM that the Cache can consume.

The jetNEXUS Cache is an in-memory cache that is also periodically backed onto hard disk to

maintain cache persistence after restarts, reboots and shutdowns. This means that the

maximum cache size must fit within the memory footprint of the appliance (rather than disk

space) and should be no more than half of available memory.

Desired Cache Size (MB): Optimum RAM that the Cache will be trimmed to.

While the maximum cache size represents the absolute upper boundary of the cache, the

desired cache size is intended as the optimum size that the cache should attempt to attain

whenever an automatic or manual check on the cache size is made.

The gap between the maximum and desired cache size exists to accommodate the arrival

and overlap of new content between periodic checks on cache size for the purpose of

trimming expired content. Once again, it may be more effective to accept the default value

(30 MB) and periodically review the size of the cache under “Monitor -> Statistics” for

appropriate sizing.

Default Caching Time (D/HH:MM): Life of content without an explicit expiry value.

The default caching time is the period content will be stored in the cache for items that

don’t have a “no-store” directive, but also have no explicit expiry time in the traffic header.

The field entry takes the form “D/HH:MM” - so an entry of “1/00:00” (the default) means to

store the item for one day, “01:00” for one hour and “00:01” for one minute.

Cacheable HTTP Response Codes: HTTP responses that will be cached.

This field should be edited with caution as the most common cacheable response codes are

already listed:

200 - Standard response for successful HTTP requests.

203 - Headers are not definitive, but are gathered from a local or a 3rd party copy.

301 - The requested resource has been assigned a new permanent URL.

304 - Not modified since the last request & locally cached copy should be used instead.

410 - Resource is no longer available at the server and no forwarding address is known.

Cache Checking Timer (D/HH:MM): Interval between cache trim operation

Cache-Fill Count: Count of 304s for a cached item before re-fetching


Create a Cache Rule

Our example rule will be called “Cache Graphics” and will restrict content to the known

graphic types already shown in the dropdown list (see below):

Pressing the will add the “Cache Graphics” rulebase.

Our next example rule will be called “apps in URL” and will restrict caching to content whose

text contains “/apps/” anywhere in the URL:

If there's a mistake in any of the values, you can either edit or delete the line later. Click the

button to make the changes take effect.


Apply Cache Rule If you have traffic flowing through your ALB-X then your domain name should appear in the

“Domain Name” drop down box. Below we see demo.jetnexus.com

Click “Add Domain”

Then choose your “Caching Rulebase” called Cache Graphics.

Click to apply.

You can monitor caching behaviour via the (Monitor Cache) screen:

Content Statistics


Connection Pooling

Using the Navigation bar on the left of the web interface, go to (Setup IP Services) page.

This will open the tab.

What is connection pooling? Connection pooling minimises the connections to the content servers, recycling these

connections as fast as possible to service client requests.

Enable connection pooling? To access the pooling, select the Channel IP you wish to modify and click on actions:

Tick the Enable connection pooling box, and enter the pool size which is normally set to

2000 or less:

Once the simultaneous requests on each server reach the pool size, the connections are

capped. Additional client requests will use the next free connection. The content servers

will service requests quickly leaving ALB-X to maintain scalability on the client-side.


SSL Offload and Termination

What can jetNEXUS do with SSL? jetNEXUS ALB-X has the ability to offload the SSL encryption and decryption

work load from your backend servers and also becoming the termination point

for your SSL certificates. jetNEXUS ALB-X also has the ability to re-encrypt

traffic to the back-end content servers for more secure environments.

SSL Tasks that can be completed on the jetNEXUS ALB-X

Create Self Signed Certificates

Create Certificate Requests for Certificate Authorities

Install Trusted Certificates supplied by a Certificate Authority

Importing certificate from an IIS server

Importing certificates from an Apache Web server

Importing certificates from another jetNEXUS Accelerator

Export Certificates to be used another jetNEXUS ALB-X or web Server

Configure Listening Interfaces as SSL interfaces

Configure content server for SSL


Creating a Self Signed Certificate Using the Navigation bar on the left of the web interface, go to (Configure SSL) Click on

this will open the create certificate tab.

You will then be presented with the Create Certificate screen:

Certificate Name: A unique name which will identify the certificate when it is created

Avoid use of £ $ / . * ? < > - & and all types of quotes.

Organization: Organization information for the certificate.

Organizational Unit: Add the appropriate information for the certificate.

City /Locality: Location information for the certificate.

State/Province: Location information for the certificate.

Country: Location information for the certificate.

Domain Name: Domain name information for the certificate.

Key Length: Key Length indicates the length of the RSA key which will be used to generate

the certificate.

Period (Days): Period is only required for Self Signed certificates and indicates the duration

of the certificate.

Once the certificate information has been entered, to generate the self-signed certificate,

click “Create Local Certificate”.

A completed self-signed certificate is below.


Creating Certificate Requests Using the Navigation bar on the left of the web interface, go to (Configure SSL) Click on

, this will open the create certificate tab

Once the certificate request information has been entered, to generate the certificate

request, click “Create Certificate Request”:

The certificate request is displayed in a popup window, as shown below, so it can be copied

into the Certificate Authority Request form:


Installing Trusted Certificates Using the Navigation bar on the left of the web interface, go to (Configure SSL) (and select

, this will open the manage certificate tab

Select the corresponding certificate request from the list box on the left hand side of the

screen:

Select the certificate you wish to manage using the drop down:

Copy and paste the certificate supplied by the Certificate Authority into the certificate text

box on the right hand side of the screen.

You may also need to paste the intermediate certificates in here too AFTER the certificate

signed by the CA.

The order to paste your Begin Cert------End Cert is as below

Top---------“Signed Certificate” back from the Certificate Authority

2nd----------“Intermediate1” Closest to “Signed Certificate”

3rd----------“Intermediate2”

Bottom----------“Intermediate3” Closest to the Root Certificate

The ALB-X contains a Root Certificate bundle so it is not necessary to paste the root

certificate below the last intermediate

Finally to install the certificate, click


Certificate Management Using the Navigation bar on the left of the web interface, go to (Configure SSL) and select

, this will open the manage certificate tab (You can manage your

certificates from this screen):

You have 4 options for each certificate:

Renew

The “Renew” button performs the same functions as the “Create Local Certificate” and

“Create Certificate Request” buttons on the “Certificate Creation” screen.

If a self-signed certificate has been selected, when the “Renew” button is clicked, the self-

signed certificate will be created with the same information supplied on the “Certificate

Creation” screen.

If a certificate request or installed trusted certificate is selected the certificate request will

be recreated and displayed in a popup window.


Show

The “Show” button will display the details of the selected self-signed certificate, pending

certificate request or installed trusted certificate in a popup window, as shown below:

Delete

The “Delete” button allows a self-signed certificate, pending certificate request or trusted

certificate to be completely removed from the jetNEXUS ALB-X.

Install

The “Install” button allows a certificate to be installed copy and paste the certificate into the

field.

Importing Certificates Using the Navigation bar on the left of the web interface, go to (Configure SSL) and

, this will open the Import certificate tab

The imported certificate should be a PKCS#12 file and should include an exported private

key.

The Certificate Name is the name to be used to reference the import certificate. It should be

a unique name:

The Password is the password supplied when the certificate was exported, either from

another jetNEXUS ALB-X or from an Apache or IIS web Server.

Click browse to locate your certificate, click go to upload it:


Exporting Certificates Using the Navigation bar on the left of the web interface, go to (Configure SSL) and click

on , This will open the Export certificate tab

Select the certificate to be exported using the “Certificate Name” drop down:

The supplied Password will be required when the certificate is imported to another

jetNEXUS ALB-X or to an Apache or IIS web server:

The password must be secure but one you are able to remember, this password should

never be sent with the PFX file.

Click Export to export the certificate you will then be asked where to save the file:


Failover configuration Using the Navigation bar on the left of the web interface, go to (Setup Appliance) page,

this will open the tab.

For fail over operation, you will need to configure multiple jetNEXUS ALB-X’s with the same listening interface information.

Why use failover? Failover is used for high availability of your application or web service and also providing

hardware redundancy.

You have 2 main ways to configure jetNEXUS failover

Active/Passive – For the same Channel (Virtual IP:Port)

Using 2 ALB-X’s which work as an Active/Passive cluster where you have 1 unit as Primary

serving all connections, and 1 unit as a Secondary/Slave waiting to take the incoming

connections if the primary unit fail.

Active/Active – For different Channels (Virtual IP:Port)

Using 2 ALB-X’s which work as an Active/Active cluster where both units are able to serve

different Channel IP’s and become the secondary for each service not marked as primary on

that unit.

Enabling failover?

You will need to first tick the enable the failover function on the ALB-X, click update:

Complete this step on each unit you wish to be part of the cluster.


Failover diagram

Firewall

Web Traffic Is sent to the jetNEXUS ALB’s which are

Listening on 10.0.34.100 for ports 80 & 443

jetNEXUS ALB-2Accepts connections

on the same Listening Service (IP and port)



Svr_Web_1

10.0.34.11

Svr_Web_2

10.0.34.12

Svr_Web_3

10.0.34.13

Svr_Web_4

10.0.34.14

jetNEXUS ALB-1Accepts connections

on the same Listening Service (IP and port)


Ports: 80 & 443ALB then creates a connection of its

own to a content server based on the load balancing policy.

Base IP: 10.0.34.251

Both units have failover enabled but are using channels to enable failover for services.


Failover diagram explained Both units have different Base IP’s but the configuration for Channels are the same:




Ports: 80 & 443ALB then creates a connection of its

own to a content server based on the load balancing policy.

Base IP: 10.0.34.251 Base IP: 10.0.34.252

On ALB-X-1 we have ticked the Primary box on the following channel making this the

Primary unit.

On ALB-X-2 we have not ticked the Primary box on the same channel making this unit the

Failover:


Failover Configuration To setup load balancing on a channel click (Setup IP Services). This will open the IP

Service tab.

A new tick box to enable this unit as the Primary box is now shown on each channel; click

this box and then update:

This unit is now the primary ALB-X on this Channel.

Different jetNEXUS ALB-X’s can be primary on different IP addresses.

If the primary jetNEXUS ALB-X is unable to support any of the listening interfaces associated

with the IP address, e.g. the primary is powered down or it loses contact with all content

servers associated with the listening interface, a secondary jetNEXUS ALB-X will take over.

If jetNEXUS ALB-X loses contact with all content servers, it removes support for that Virtual

IP address. In a fail over configuration, another jetNEXUS ALB-X will step into the breach.

Failover status lights The coloured lights to the left of the listening interface shows the status:

Application server and or channel are providing service

Secondary channel is assessing primary service state

Listening interface is inactive, but in failover standby ready to support it


Monitoring & Alerting

Using the Navigation bar on the left of the web interface, click on the button, this

will open the tab:

Dashboard

Disk Space

This section gives an indication on how much disk space is being used by the jetNEXUS ALB-

X.

Memory Indication Bar

This section gives an indication on how much system memory the jetNEXUS ALB-X is using.

CPU Indication Bar

The section gives an indication of the current CPU load on the jetNEXUS ALB-X.

Events Under the graphics is a rolling log the highlight of the system log. Information such as

content server coming on and off line and services starting and stopping are displayed:



Statistics Using the Navigation bar on the left of the web interface, go to (Monitor Statistics), this

will open the tab:

Default statistics screen

Compression Statistics The Content Compression to Date percentage is the amount by which jetNEXUS ALB-X has

reduced compressible content (e.g. Text, HTML, Style sheets…). A higher figure indicates

better compression rates.

The Throughput before compression figure shows the number of bytes that WOULD have

been transmitted if jetNEXUS had not compressed the data.

The Throughput after Compression figure show the ACTUAL number of bytes transmitted.

The Overall Compression to Date percentage is the amount by which jetNEXUS has reduced

all output from the server including the overhead of those items that it did not compress.

Note: The jetNEXUS ALB-X counts compression statistics only for requests from browsers

that accept compression.


Overall Hits Counted

The number of requests received by jetNEXUS ALB-X whether or not content was

compressed:

Overall Hit Counted: The total number of hits since the last reset. On the right hand side the

number of current hits/second.

Total Connections: The total number of TCP connections since the last reset. On the right

hand side the current number of new TCP connections per second from the client to the

ALB-X. Also on the far right the current number of new TCP connections per second from

the ALB-X to the Content Servers.

Peak Connections: The maximum number of concurrent connections attained since last

reset. On the right hand side shows the current number of concurrent connections.

Caching If content caching is enabled then additional statistics will be displayed

From Cache: Number of hits and bytes that are served from the jetNEXUS ALB-X. Also

included is the percentage of the overall hits/bytes that are being served by the jetNEXUS

ALB-X cache.

From server: Number of hits and bytes that are served from the content servers. Also

included is the percentage of the overall hits/bytes that are being served by the content

servers.

Cache Contents: The number of cached objects and the size in bytes if the total cached

objects. On the far right is the percentage of the maximum cache used by the current

cached objects.

Hardware

Disk Usage: Percentage of disk spaced used. Memory usage: Percentage indicates how much memory jetNEXUS ALB-X is currently using. CPU usage: Percentage indicates the loading on jetNEXUS Accelerator’s CPU.


Logging Using the Navigation bar on the left of the web interface, go to (Monitor Logging), this will

open the tab.

As discussed earlier in the manual W3C Logging mode will start jetNEXUS ALB-X recording a

W3C compatible log file of activity.

Download W3C Log

This will download the W3C compatible log from ALB-X. The format of the file name is:

w3cyyyymmdd.log where (yyyy = year 2000 onwards, mm = month 1-12, dd = day 1-31)

jetNEXUS W3C logs are compatible with the w3c draft standard for web server logs and

should be compatible with most analysis tools.

Download System Log

This will download the event log for the appliance. The format of the file name is:

sysyyyymmdd.log where (yyyy = year 2000 onwards, mm = month 1-12, dd = day 1-31)


Email Events Using the Navigation bar on the left of the web interface, go to (Configure Email Events)

this will open the tab

What can you set? The ALB-X can be configure to automatically send email alerts on key events such as losing

service, Overheating, device rebooting, interfaces being raised or lowered, contents servers

coming on and off line etc.

Mail Server [SMTP] Setup:

Send E-Mail Events To E-Mail: [email protected]

Return E-Mail Address: [email protected]

Host address: IP or FQDN

Port: 25

Send Timeout: 2

Use Authentication: If required by your mail server

Security: If required by your mail server

Mail Server Account Name: username

Mail Server Password: password


Alerts & Notifications:

All Values below can be modified you meet your specific message requirements:

IP Service Notice: Service Alert Message title

IP Service Alert: Service Stopped Alert

Channel Notice: Channel Alert Message title

Channel Alert: Channel Stopped Alert

Content server Notice: Content Message title

Content server Alert: Content Server Alert

flightPATH: flightPATH Message title

Group notifications together: All alerts into a single e-mail alert

Grouped mail description: Grouped Message title

Send grouped mail every: Time for alerts to be sent

Disk Space warning: Disk near full message

Warn if free space less than: Percentage of disk before alert

License renewal warning: License renewal required


Services Date and Time Simply enter the new time (UTC format and Click on update):

Time Server URL:

Timeserver URL allows jetNEXUS ALB-X to connect to an SNTP time server. If jetNEXUS ALB-

X has a gateway that also provides a DNS facility, a URL works too. In most circumstances, it

is better to resolve the DNS name into an IP Address and use it instead.

Update at [hh:mm]:

Update at is the time of day that jetNEXUS ALB-X contacts the SNTP time server. This

controls what time of day the time corrections will happen.

Update period [hours]:

Update period states how often jetNEXUS ALB-X should consult the SNTP time server. This

might be 24, 6 or 1 as required. Fractional hours are valid too if needed.

NTP Type:

The SNTP time server protocol standard is selected using the drop-down box. Supported

settings are:

You will see time corrections carried out in the System Log. JetNEXUS ALB-X logs both

successful and unsuccessful attempts. Successful updates also show any time discrepancy.


Ping The ping tool can be used to check network connectivity:

IP Address is where to enter the IP Address of the device to contact with an echo test.

Click Ping to perform the echo test. Four attempts are made to contact the device. The text

area displays the results on completion.

SNMP Setting up the jetNEXUS ALB-X to provide a Simple Network Management Protocol:

SNMP v1/2c Enabled allows SNMP version 1 and version 2c access using the specified

Community String. The default community string is jetNEXUS.

SNMPV3 Enabled allows SNMP V3 for a single user admin with the default Passphrase

jetNEXUS. To change the Passphrase, enter the old Passphrase, the new Passphrase twice

and click Update.

**JetNEXUS ALB-X SNMP security settings are separate from other security settings on ALB-

X. Set them independently to values required by the management infrastructure.


Capture Capture is a useful debugging tool, you may be asked to use this by the jetNEXUS support

team when trying to troubleshoot an issue:

Adapter: The adapter from where you want the trace

Packets: The number of packets you want collected

Duration: The duration in seconds of the trace

Click the Generate button:

The file will be returned to the browser in a GZ form.


Restart To initiate the restart operation click Restart:

Note: It can take up to 30 seconds for jetNEXUS ALB-X to restart.

Reboot To initiate a reboot, click Reboot.

Note: It can take a couple of minutes for the jetNEXUS to reboot:

Power Off To initiate power-off, click Power Off:

Note: To restart jetNEXUS, a hardware power on will be required.

Note: In the event of power supply loss, jetNEXUS ALB-X will automatically power on again when power is reconnected.


jetPACK Quick Installation

The jetNEXUS ALB-X can be configured automatically with a Lync 2010 “jetPACK”, template which is

fully-tuned with all of the application-specific settings that you need in order to enjoy optimised

service delivery from your ALB-X.

If you supply the VIP and real server and proxy server IP addresses to [email protected] we will

send you a custom jetPACK that you simply upload to the jetNEXUS ALB-X.

The upload can be done via the GUI and will be fully configured in less than 2 minutes.

The relevant jetPACK can be applied to multiple jetNEXUS ALB-X appliances saving valuable time and

eliminating simple mistakes.

For more information please go to our website http://www.jetnexus.com/jetpack.html


http://www.jetnexus.com/jetpack.html


Troubleshooting Further help can be found on the jetNEXUS websites

http://www.jetNEXUS.com/support.html

http://forum.jetNEXUS.com/

http://www.jetnexus.com/load-balance-microsoft-lync2010-tutorial.html

Contact Us I hope you have found this User Guide informative, but if you need any clarification or

further information, please do not hesitate to get in contact with jetNEXUS Support:

E-mail [email protected]

Support +44 (0870) 382 5529

Phone +44 (0870) 382 5550

Check out our blog

http://jetNEXUS.blogspot.com/

http://www.jetnexus.com/support.html

http://forum.jetnexus.com/

http://www.jetnexus.com/load-balance-microsoft-lync2010-tutorial.html


http://jetnexus.blogspot.com/

jetnexus ALB-X-User-Guide-v2.5

Documents

jetnexus limited

jetnexus logo

jetnexus albxalb

jetnexus albx benefits

jetnexus platform availability

rights reserved user

rights reserved limitations

ownership rights