topic Failover using the PAC file in Web Security

Failover using the PAC file

wkw.bcdomain — Mon, 23 Sep 2013 10:57:51 GMT

Hi,

Is it possible to failover traffic in explicit proxy mode ( without using a dedicated load balancing appliance ) ?

I have seen some PAC file scripts to load balance the traffic between 2 Proxy servers.

but it seems that they are not capable of handling the failover in case of a failure one one proxy server.

As per the testing I did, the clients still attempt to connect the failed appliance since they are not aware about the failure.

Failover using the PAC file

PC Tiya — Tue, 24 Sep 2013 00:56:12 GMT

HI Wipula

You may try return 2 proxy servers at the end of the PAC file

return "PROXY proxy1.domain:8080; PROXY proxy2.domain:8080";

The browser will work that out itself. This will provide you failover from the client side.

If you want to load balance the proxy servers, without using any load-balancer, you may

round-robin/randomly return those 2 proxy servers in different order.

Hope this help

Failover using the PAC file

wkw.bcdomain — Tue, 24 Sep 2013 02:45:23 GMT

Hi Prachid,

Thank you for your response.

I tested it just now with the information provided.

According the packet capure, the browser still attempts to connect to the failed proxy servaral times.

After few failed attempts it sends the traffic to the other proxy.

The browser does this every time so it takes long for a user to get a response.

have you used this setup before and got better outcome ?

The browser I am using is Internet explorer 8.

Thanks,
Wipula.

Failover using the PAC file

PC Tiya — Tue, 24 Sep 2013 03:22:59 GMT

Yes. The browser should keep trying the first proxy. If it failed, it will try the second one.

In our environment, the browsers take a brief seconds before trying the second proxy server.

I have seen some issues with IE9, not sure for IE8.

Have you tried that on other browsers e.g. Chrome, Firefox?

Failover using the PAC file

Vance Kwan — Wed, 25 Sep 2013 07:49:49 GMT

From my experience, a fail over design via a PAC/WPAD file does not work very well. If the proxy blocks the request using a 403, the client will assume this failed, and try the 2nd option.

-Vance