We are looking to acquire a SCA to use in conjunction with our CSS11000's. One issue that has come up is the use of sorry-servers should the SCA fail.
One of the suggestions that has been made is that we could use the destination web server on 443 as the sorry server (providing we replicate the pki material) that way if the SCA should fail, the requests could go direct to the web server.
My concerns are:
We're buying the SCA to avoid overloading the server, so if we then define the web server as the sorry server we'll need to limit connections to the web server on 443 to a number too low to be useful.
I haven't heard of anyone doing this.
Any feedback people can supply on the design issue, or their experience with SCA's generally would be appreciated. Particularly where redundancy is concerned.
As an aside, does anyone know whether CSS11000's will do full same-interface routing at layer 3 (and what the peroformance hit is, or whether they will just issue ICMP redirects?
