topic ACE 4710 HTTPS load balance configuration in Application Networking

ACE 4710 HTTPS load balance configuration

Andy Johnson — Tue, 17 Apr 2012 12:41:18 GMT

Have two ACE 4710 in HA setup. We would like to setup HTTPS loadbalance(actually just a primary and standby configuration in the serverfarm). Initially this would be for Exchange OWA connections but may expand to more HTTPS connections later.

I know there are several ways to do SSL with the ACE( client, server, end-to-end). I am just wanting to know the easiest way to deploy this? Is a certificate always needed on the ACE for each connection? In HA mode would a certificate be needed for both or does it replicate in some way to the other ACE?

Any configuration examples would be helpful.

Thanks.

ACE 4710 HTTPS load balance configuration

Dan-Ciprian Cicioiu — Tue, 17 Apr 2012 12:52:06 GMT

Hi Andy,

The easy way is to terminate the SSL on ACE just for the clients , and between the ACE and the servers you will have HTTP ( clear ) connection - usually the datacenter traffic is could be clear and is some how not a threat.

As for the certificate , this should be copied on both ACE, it is not replicated and is needed for each client connection.

Regards.

ACE 4710 HTTPS load balance configuration

litrenta — Tue, 17 Apr 2012 12:54:25 GMT

IF you terminate SSL on the ACE you need certificates and key on ace in the context in which you are doing the termination. The certs and keys need to be installed on the active and standby (manually unless using anm to manage).

when speaking of SSL

SSL termination refers to ace terminating SSL and sending to server as clear text

end to end - ACE terminates SSL (to look into payload to make a loadbalance decision or sticky decision) and then re-encrypts to the server, so to the client ACE is an ssl server and to the server the ace is an ssl client.

You can find some config examples at

http://docwiki.cisco.com/wiki/Category:Data_Center_Application_Services_Configuration_Examples

ACE 4710 HTTPS load balance configuration

Andy Johnson — Tue, 17 Apr 2012 12:58:03 GMT

I am not the Exchange admin, but does OWA work without being HTTPS?

So can I use the same CSR from the primary and get the cert, then install the same certificate on both ACE? Or would I need two CSR's and two certs?

ACE 4710 HTTPS load balance configuration

Dan-Ciprian Cicioiu — Tue, 17 Apr 2012 13:01:37 GMT

Yes , you can access OWA on HTTP.

You will need the same certificate on both ACE.

http://docwiki.cisco.com/wiki/SSL_Termination_on_the_Cisco_Application_Control_Engine_Using_an_Existing_Certificate_and_Key_in_Routed_Mode_Configuration_Example

Dan

ACE 4710 HTTPS load balance configuration

Andy Johnson — Tue, 17 Apr 2012 13:09:33 GMT

Thanks for all the help and quick responses.

If the another server requires HTTPS this would require the end-to-end SSL configuration?

ACE 4710 HTTPS load balance configuration

Dan-Ciprian Cicioiu — Tue, 17 Apr 2012 13:14:27 GMT

If the server could not run HTTP , then yes.

Regards

Dan