background image

The WebMux™ Model 480S, 580SG, and 680PG User Guide – Version 7.0.x 

Copyright© 1997-2006 CAI Networks, Inc. 

 

27

SSL Keys 

 

 

WebMux™ model 480S, 580SG, 680PG support SSL termination.  For models 
that do not support SSL termination, please ignore this section.  WebMux™ 
supports SSL V2, SSL V3, and TLS V1 with RSA key length from 512, 1024, and 
2048. 
RSA key length 1024 also called 128bit strong encryption. 
 

Summary of Contents for WebMux 480S

Page 1: ...x 15 Before you Start 15 Hardware Setup Collect Information 16 Hardware Setup Setup the new network 16 Hardware Setup Configuration Summary 17 Initial Configuration 17 NAT Mode Related Configuration 1...

Page 2: ...sheets 59 Contact Information 63 FAQs 64 Regulations 67 Appendix 1 How to Add A Loopback Adapter 68 Appendix 2 How to make route delete reboot persistent 70 Appendix 3 Phone Paging Codes 71 Appendix 4...

Page 3: ...iii Packing List One 1 WebMux unit One 1 Power cord One 1 User Manual One 1 Warranty registration card...

Page 4: ...iv...

Page 5: ...n the cursor location increases or decreases It goes through lower case letters upper case letters numbers and symbols When the cursor is located at the left most position on the LCD the up and down a...

Page 6: ...rk in NAT mode It is the left most RJ45 Socket PLEASE NOTE The Router LAN and Server LAN port are not interchangeable External Modem Connect Port To utilize the phone pager function of the WebMux plea...

Page 7: ...ication level health check to many network protocols on servers Provides Persistent Connections by memorizing the user browser session and the server session and sending the same user to the same serv...

Page 8: ...oblems consider using Out of Path configuration Out of Path load balancing is also called direct routing or one leg operation Layer 7 Load Balancing WebMux can direct traffic to specific groups of ser...

Page 9: ...nd Robin Yes Yes Yes Persistent Round Robin Yes Yes Yes Weighted Round robin Yes Yes Yes Persistent Weighted Round robin Yes Yes Yes Least Connections Yes Yes Yes Persistent Least Connections Yes Yes...

Page 10: ...work Address Translation Yes Yes Yes Network Port Translation Yes Yes Yes TCP SYN protection Yes Yes Yes TCP DoS protection Yes Yes Yes SSL support Yes Yes Yes Device Support Maximum virtual farms 500...

Page 11: ...one WebMux is serving as the primary and the other is serving as the secondary or backup providing a fault tolerant solution In order for the web servers to share the incoming traffic the WebMux must...

Page 12: ...directed to Server 2 by the WebMux In Out of Path mode only one network in the setup that is the server LAN is connected to the Internet through the firewall and router Internet traffic or local conne...

Page 13: ...PG User Guide Version 7 0 x Copyright 1997 2006 CAI Networks Inc 9 Sample Configurations Single WebMux This installation requires one WebMux One WebMux interface connects to the Router LAN The other i...

Page 14: ...ess If on the server there is a service attached to the IP address HTTP S FTP etc please make sure the service will run on the new IP address NOTE Although the WebMux can work with any IP address rang...

Page 15: ...rimary and the other the secondary They connect together with the Ethernet cable that is either cross over or through a hub The primary redundant interface IP address is 192 168 255 253 the secondary...

Page 16: ...1 1 1 as well as the IP addresses to the 10 3 1 10 20 30 addresses If on the server there is a service attached to the IP address HTTP S FTP etc please make sure the service will run on the new IP add...

Page 17: ...at already exist on the network This is particularly helpful when the changing of an existing network of servers causes problems In this configuration all the servers still remain on the same IP netwo...

Page 18: ...the gateway specified Please refer to Appendix 1 and 2 for more details on how to configure the loopback adapter on servers In case the server is running Windows 2003 the route created during adding...

Page 19: ...a network For example http www cainetworks com is one virtual server farm https www cainetworks com is another farm and ftp ftp cainetworks com is the third farm The first farm works on a set of serv...

Page 20: ...ebMux one can create one or more Virtual Farms on top of physical hardware Hardware Setup Collect Information Make a drawing of the existing network and note all the configuration settings This will h...

Page 21: ...e Check Mark button on the WebMux until the LCD displays the first question Enter WebMux host name During the initial configuration you will be asked to provide names and IP addresses See next section...

Page 22: ...ovides the best security for isolating servers from any other part of the networks Out of Path provides better performance when huge amounts of data need to go back to clients up to 100X more than on...

Page 23: ...aster name resolution especially on Linux Unix In an installation with a primary and secondary WebMux one unique IP address is required for each WebMux interface that connects to the Server LAN Those...

Page 24: ...st be unique It is highly recommended to add this IP address to your servers etc hosts file along with the gateway IP address to allow faster name resolution especially on Linux Unix Please also refer...

Page 25: ...Primary answer Yes If this is the Secondary WebMux answer No The secondary WebMux automatically gets configuration information from the Primary once it sets up If this is the only WebMux answer Yes P...

Page 26: ...rt number can be used Factory default port number is 24 one could choose to use any unused port below 10214 or port number above 1024 for this Using port number above 1024 will need to setup an admin...

Page 27: ...You will see This option will clear all current settings and reset the WebMux to original factory settings Press and hold the check mark button for at least 20 seconds to activate the factory reset T...

Page 28: ...gin Start Login Page Start a web browser from your management workstation Set URL to https webmuxip webmuxport cgi bin login o webmuxip is the IP address of the WebMux on the server LAN o webmuxport i...

Page 29: ...Password Fill in the correct password for the selected User ID The password is case sensitive The default passwords are ID Password superuser superuser WebMux WebMux It is recommended to change the pa...

Page 30: ...the farm display to add servers Click on Save button to save the farm server configuration Click on services on each farm to adjust the timeout for each kind of services Note that same protocol servic...

Page 31: ...works Inc 27 SSL Keys WebMux model 480S 580SG 680PG support SSL termination For models that do not support SSL termination please ignore this section WebMux supports SSL V2 SSL V3 and TLS V1 with RSA...

Page 32: ...r than none will enable SSL termination on the HTTP farm All the HTTPS incoming traffic will be sent terminated to farms on port 80 Please set the port to a clear port since after the WebMux terminate...

Page 33: ...y and public key pair must match to be able to work properly If you plan to generate new keys click on the drop down box above the private key window to select key length and then click on the Confirm...

Page 34: ...newly created private and public keys You will then copy and save both private and public keys submit the public key to the CA of your choice to sign Once they send you back the signed public key you...

Page 35: ...dows IIS server or a Linux server you can transfer them into the WebMux and continue using them until they expire Please contact us for how to convert your existing keys Download Upload This button wi...

Page 36: ...cking on the service type on each farm will allow you to change the timeout value of layer 7 testing for each different service Please note this change is global and will affect all the farms using th...

Page 37: ...ion You can access from more than one IP address by specifying all the allowed IP addresses separated by a Netmask following the IP address specify the range of hosts can access management console For...

Page 38: ...email notifications Enter the IP address of the email server that will forward the notifications Please note Because the WebMux does not resolve names this entry must be an IP address Changes to the...

Page 39: ...t push buttons can also change this WebMux https control port Since the WebMux is load balancing incoming HTTPS traffic the HTTPS port for the management console must be set to a different port By def...

Page 40: ...it will defeat the load balancing function of the WebMux Another way to address AOL proxy problem is to use the layer 7 cookie based load balancing ICMP Packet input policy Accept The WebMux will allo...

Page 41: ...er functions The default value is 15 minutes This function has no effect in Out of Path mode Server Scan Mode The WebMux talks to the real servers in the farm through the layer 4 7 protocols every few...

Page 42: ...t it points to a tier 2 NTP server You can also set it to your Internet NTP server or wipe out the entry to not sync to any NTP server Reset Stranded TCP Connections When a server failed to function t...

Page 43: ...ct the login name for which the password is to be changed New Password Enter the new password This is the password to which the login will be changed New Password Again Enter the same password as in t...

Page 44: ...uide Version 7 0 x Copyright 1997 2006 CAI Networks Inc 40 Change PIN To protect the WebMux from unauthorized changes from front push buttons a PIN can be entered here to prevent saving any change fro...

Page 45: ...HTTP protocol If the timezone is not set correctly the browser access could be denied due to cookie time out If the UDP NTP server is set up correctly there is no need to set the clock anymore since...

Page 46: ...t is recommended to set the WebMux clock to UTC GMT time Time Zone Select the time or hour offset to the UTC GMT time You can set the WebMux to your local time if your time zone is selected here Confi...

Page 47: ...ent line Upload Upload allows a configuration file that has been saved at the browser workstation to be uploaded to the WebMux Enter the full path of the configuration file or click on Browse to searc...

Page 48: ...each farm must have its own IP address The farm address could be the Internet known address or the address has been translated by your firewall For example if you want to create an http farm for www...

Page 49: ...IP address as your farm address You can add multiple farms to this IP address as long as the port number is different So you can save real IP address In this mode NAT the WebMux acts as a firewall als...

Page 50: ...protocol checks for the known ports in the list For Custom Defined TCP Service custom health check please specify the URL for the CGI code in the setup screen CAUTION Once a farm is created the port n...

Page 51: ...d directing Layer 7 scheduling methods can only be used with the HTTP Hypertext Transfer Protocol TCP service These scheduling methods allow you to direct traffic to a specific group of servers depend...

Page 52: ...HTTP port 80 HTTPS traffic from port 443 being terminated and send to the same port 80 The default is no blocking Tag SSL Terminated HTTP traffic Sometimes operators wants to identify the traffic fro...

Page 53: ...r These numbers are displayed here for reference purposes These fields are set in the Add Farm screen Once set they are not changeable If they must be changed delete the farm and then add a new one La...

Page 54: ...only with the following scheduling methods Layer 7 HTTP URI load directing Layer 7 HTTP URI load directing with cookies this method also checks the host MIME header against the specified match patter...

Page 55: ...entify the server in the farm It has nothing to do with the name resolution of the server Although label can be anything it is always better to have meaningful and unique label for each server CAUTION...

Page 56: ...ro then the farm would be down because none of the servers are accepting new connections Run State Active The server will be put into service immediately after it is added However once it is failed it...

Page 57: ...tch Pattern This is the pattern the URI will be compared to It is stated in extended regular expressions format Please refer to Appendix 7 for some examples Pattern is Anchored An anchored pattern has...

Page 58: ...and add a new one Label The label can be changed at any time The change will not affect how server is performing in the farm rather it is for description purpose only Weight Scheduling priority weight...

Page 59: ...The WebMux Model 480S 580SG and 680PG User Guide Version 7 0 x Copyright 1997 2006 CAI Networks Inc 55 Active Favorite Active Standby Last Resort Standby...

Page 60: ...1 24 cgi bin rec The first screen in rec reconfiguration asks for the superuser s password The default superuser s password is superuser however the actual superuser s password may had been changed b...

Page 61: ...optional the continue button will bring up this screen When the mouse moved over a field the current value will be automatically filled The user may change it based on new information obtained from IS...

Page 62: ...Routing Router LAN Information NAT ONLY Router LAN WebMux Proxy IP Address Router LAN Network IP Address Mask Router LAN Network IP Address Router LAN Broadcast IP Address Server LAN Information Serve...

Page 63: ...6 255 Server LAN Information Server LAN WebMux IP Address 192 168 199 251 Server LAN Gateway IP Address 192 168 199 1 Server LAN Network IP Address Mask 255 255 255 0 Server LAN Network IP Address 192...

Page 64: ...0 205 133 156 200 Router LAN Network IP Address Mask 255 255 255 0 255 255 255 0 Router LAN Network IP Address 205 133 156 0 205 133 156 0 Router LAN Broadcast IP Address 205 133 156 255 205 133 156 2...

Page 65: ...nation or Layer 7 load balancing 10 1 1 253 Server add loopback adapter 10 1 1 200 Route Deletion Refer to Appendix 2 10 1 1 200 WebMux Server LAN Information Server LAN WebMux IP Address 10 1 2 254 a...

Page 66: ...next paragraph There is need to add a loopback adapter to each server and assign the farm address to the loopback adapter For MS Windows it always adds a route for the loopback adapter which will nee...

Page 67: ...1997 2006 CAI Networks Inc 63 Contact Information For latest product and support information please visit our web site at http www cainetworks com To reach us by e mail Support support cainetworks com...

Page 68: ...meets or exceeds the server that is unavailable Q Will a server with weight 0 act as a STANDBY R No A weight of 0 indicates that the server will not accept any new connections The state is considered...

Page 69: ...on initiated from the internal or private network the WebMux will substitute the IP address of its router LAN interface for the IP address of the host initiating the conversation Any service that requ...

Page 70: ...hen I powered down Primary WebMux R 1 Two WebMux not on the same version of firmware Or 2 Secondary WebMux monitors primary WebMux as well as few other things Before it takes over it makes sure it can...

Page 71: ...ment and the receiver Plug the equipment into an outlet on a circuit different from that of the receiver Consult the dealer or an experienced radio television technician for help Notice for Canada Thi...

Page 72: ...n 3 You should be at the Microsoft TCP IP Properties dialog box Be sure the MS Loopback Adapter is the Adapter selected Enter your farm IP address for IP address Subnet should be match your servers ch...

Page 73: ...o the bootup script Ifconfig lo0 1 farm_ip_address up For FreeBSD ifconfig lo0 inet farm_ip_address netmask 255 255 255 255 alias For Solaris ifconfig lo0 1 FARM_IP_ADDR ifconfig lo0 1 FARM_IP_ADDR FA...

Page 74: ...sk then next 6 Browse to the bat file we created like WebMux bat under c 7 Choose Perform this task when my computer starts That will delete the route every time the Windows computer reboots Please ma...

Page 75: ...its represent the port number of the server 00IIIIIIIIIIIIPPPP A downed server went back up This 18 digit code no spaces starts with 00 followed by 12 digits of the IP address without the periods of t...

Page 76: ...ide Version 7 0 x Copyright 1997 2006 CAI Networks Inc 72 For WebMux Primary Only 66 Secondary is not responding For WebMux Secondary Only 71 Primary failed Secondary took over from Primary 72 Primary...

Page 77: ...arm setup the label for the farm could be one of the virtual farm s base URL say www mydomain com the WebMux actually periodically reads a page from this URL If server that serves that URL does not re...

Page 78: ...nk line if ps C sshd dev null then echo OK response from server goes here see list below echo SSH service available else echo NOT OK echo SSH daemon not running fi The following is a list of valid CGI...

Page 79: ...this session Following are commands available in CLI arp manipulate the system ARP cache arping ping address on device interface by ARP packets using source address source factory_reset reset WebMux s...

Page 80: ...rs D stra An item with either Compiler or compiler in it cC ompiler String like bananas banananas bananananas etc bana na s Items with the strings regular and expression on the same line with anything...

Page 81: ...46 Compliance 67 cookie expire 47 cookies 4 5 24 47 50 53 64 Cooling 6 CSR 29 Custom Defined 46 D Default Gateway 10 12 19 58 59 60 61 diagnostic ports 35 Download 31 43 E email notification 4 34 expi...

Page 82: ...3 24 33 35 65 Modify 24 49 54 N NAT 4 7 16 18 20 21 See netmask 10 33 62 NTP 38 41 46 O Out of Path 4 7 8 13 14 18 20 21 37 OVERLOAD 74 Overview 3 7 P pager 4 32 34 71 paging 34 passwd 22 58 59 60 61...

Page 83: ...9 S scheduling 47 49 secondary 11 Server LAN 2 7 9 10 11 12 16 18 19 20 58 59 60 61 64 SSL 3 5 6 21 27 28 46 superuser 25 33 syslogd 34 T Tag SSL Terminated 48 timeout 26 32 34 37 Timeout 32 37 TLS 27...

Reviews: