topic Re: clustering configuration in Web Security

clustering configuration

mac.til_ironport — Sat, 17 Jan 2009 13:23:04 GMT

hi,
i m new to Ironport WSA so i need some information....
is there any document which can describe how to configure two WSA in failover or redundancy or clustering mode.

i want to know is any of them can be configured on web security appliance.

thanx,
Mac

Re: clustering configuration

jowolfer — Tue, 20 Jan 2009 01:50:29 GMT

Mac,

There is currently not clustering / failover abilities built into the WSA.

Please be aware that if you are using transparent proxy with WCCP, the WCCP protocol inherently utilizes load balancing and failover if a problem happens on any web-cache devices within the same service ID.

IE: If you have two WSAs in a single service ID, traffic will be load shared between them and if one WSA fails, all traffic will be routed to the working WSA.

Re: clustering configuration

mac.til_ironport — Mon, 02 Feb 2009 13:58:36 GMT

thanks for your reply,

But i have some little information that we can achive this using PAC file hosting facility on the box. Do you have any idea about that.

Re: clustering configuration

jowolfer — Mon, 02 Feb 2009 23:53:31 GMT

Mac,

It is possible utilize multiple WSAs by writing a .pac file script.

We cannot assist in writing, modifying, or maintaining .pac file code, but I have a pac file example that may help.

This is for load balancing between 2 proxies:

------------------------------------------
function FindProxyForURL(url,host){
switch(URLHash(url)%2){
case 1: return "PROXY wsa.proxy1:3128";
default: return "PROXY wsa.proxy2:3128";
}
}

function URLHash(url) {
server_name=url.split("/")[2]
if(!server_name) {return url.length;}
return server_name.length;
}
------------------------------------------

Re: clustering configuration

RBC____CS — Sat, 07 Feb 2009 06:00:19 GMT

What about an example for failover via pac file?

I have looked at using

return "PROXY ironport:8080; PROXY otherproxy:8080";

but I am not clear if traffic will push over to otherproxy randomly or only if ironport1 is not available or times out.

Any thoughts or suggestions?

Re: clustering configuration

jowolfer — Wed, 11 Feb 2009 00:06:15 GMT

The following can be used for a simple failover:

function FindProxyForURL(url,host) {
return "PROXY ironport:8080;
PROXY otherproxy:8080;
DIRECT";
}

Re: clustering configuration

bartknippenberg — Tue, 16 Jun 2009 18:45:23 GMT

Hello josh,

Are there plans to implemented real failover not using wccp or an external loadbalancer? Like for example vrrp as used by bluecoat?

Best regards

Bart

Re: clustering configuration

jowolfer — Wed, 17 Jun 2009 00:10:18 GMT

Bart,

We do have a feature request for this functionality, but I do not have any roadmap information for it.

Enhancement: 38634 Ability to setup WSA as Active-Standby failover in forward proxy mode

I recommend bringing this up with your sales representative as well, so that we can properly log the importance for this feature.

Re: clustering configuration

Tim Jackson — Fri, 19 Jun 2009 00:45:43 GMT

The failover should only occur if the first proxy is no longer pingable. That's my experience anyway. Also, you might need to host the pac file on another webserver. If you host it on say proxy1, and it's the one that goes down, the browser won't know how to get to proxy2. I guess you could host it on both and roundrobin the DNS record. Anyone else doing that?

--Tim

Re: clustering configuration

alisson.santos_ironport — Fri, 31 Jul 2009 05:16:33 GMT

Hi Guys.

I found a very interesting article about Load Balance between Proxies. I did some testing with the script and works well. The problem is always with https connections which are lost in the process of balancing, and management of the workaround is a bit cumbersome.

http://www.isaserver.org/tutorials/Load-Balancing-Web-Proxy-Clients-With-ISA-Server-2004-Standard-Edition-Part1.html

Re: clustering configuration

jowolfer — Fri, 31 Jul 2009 22:25:18 GMT

Alisson,

Thanks for the link!