Coyote Point Systems E350GX, Installation And Administration Manual

Page: 137 / 344

Configuring a Cluster’s Load-Balancing Options
Equalizer Installation and Administration Guide 137
Two things are necessary when running OWA behind Equalizer:
• configure OWA to watch HTTP traffic for requests containing a custom header that indicates that the
request was originally an SSL request that was processed by SSL offloading hardware (i.e., Equalizer)
before reaching OWA (see the above article for instructions)
• configure the Equalizer cluster to add the custom header to all requests before sending them on to the OWA
server (this is explained below)
Equalizer provides the ability to specify a custom header for HTTPS clusters. The following procedure shows you
how to add a custom header to a new or existing HTTPS cluster definition, using the header required for an OWA
server as an example.
1. Log into the Administrative Interface using a login that has
add/del
access for the cluster (see “Logging In” on
page 52).
2. In the left frame, click the name of the cluster to be configured. The cluster’s parameters appear in the right
frame.
3. Select the
Networking
tab in the right frame.
4. Type the following in the
custom header
field:
Front-End-Https: on
5. Set other parameters and flags for the cluster as desired; see “Adding a Layer 7 Virtual Cluster” on page 113 for
more details.
6. Select
commit
to create or modify the cluster.
Performance Considerations for HTTPS Clusters
Layer 7 HTTPS clusters have several options that can have a significant impact on the performance and behavior of
the cluster:
• The injection of a
custom header
to provide transaction-specific information to the server. For example, to
tell the server that Equalizer terminated the HTTPS connection and performed SSL processing on the
incoming request (see the previous section, above).
• The "munging", or translation, of HTTP redirects to HTTPS redirects (see the description of the
no header
rewrite
flag under Modifying a Layer 7 Virtual Cluster).
• The
once only
flag. This flag is present to speed up processing of HTTP requests by only looking at the
first request, but since HTTPS has a lot of overhead associated with it anyway, turning this flag off does not
reduce HTTPS performance. Furthermore, having this flag on for HTTPS clusters causes some applications
to not function as needed.
In general, it is recommended to turn the
once only
flag off for HTTPS clusters. In order to inject custom headers
and rewrite headers in every transaction in a connection, turning off
once only
is required.
HTTPS Performance and Xcel SSL Acceleration
The E650GX and E450GX include the Xcel SSL Accelerator Card. Equalizer models without Xcel (E250GX and
E350GX) performa all SSL processing in software using the system CPU. Equalizers with Xcel perform all SSL
processing using the dedicated processor on the Xcel card. This allows the system CPU to concentrate on non-SSL
traffic. For most applications, Xcel will process several hundred HTTPS transactions per second with no noticeable
degradation in performance either for the HTTPS cluster or for Equalizer as a whole.
In terms of bulk data throughput, the theoretical maximum throughput for Xcel/HTTPS is roughly 50% of that for
the Equalizer in HTTP mode: Equalizer models with gigabit Ethernet can move HTTP traffic at wire speed (1Gbit/s)
for large transfers, while Xcel can encrypt only approximately 400Mbit/s with 3DES/SHA1 or 600Mbit/s with RC4/
MD5. This reflects the fact that Xcel is primarily a transaction accelerator, not a bulk data encryption device. It is