Coyote Point Systems Equalizer GX Series, Руководство администратора

Страница: 378 / 866

Working with Clusters and Match Rules
3. Log into the GUI using a login that has add/del access for the cluster (See
"Logging In"
on
page 230.)
4. In the left frame, click the name of the cluster to be configured.
5. In the right frame, select the
Configuration Required
tab.
6. Type the following in the
custom header
field:
Front-End-Https: on
7. Select
commit
to modify the cluster.
Performance Considerations for HTTPS Clusters
Layer 7 HTTPS clusters have several options that can have a significant impact on the
performance and behavior of the cluster:
1. The injection of a
customheader
to provide transaction-specific information to the server. For
example, to tell the server that Equalizer terminated the HTTPS connection and performed
SSL processing on the incoming request (see the previous section, above).
2. The "munging", or translation, of HTTP redirects to HTTPS redirects (see the description of
the
no header rewrite
flag under Modifying a Layer 7 Virtual Cluster).
3. The
once only
flag. This flag is present to speed up processing of HTTP requests by only look-
ing at the first request, but since HTTPS has a lot of overhead associated with it anyway,
turning this flag off does not reduce HTTPS performance. Furthermore, having this flag on
for HTTPS clusters causes some applications to not function as needed.
In general, it is recommended to turn the
once only
flag off for HTTPS clusters. In order to inject
custom headers and rewrite headers in every transaction in a connection, turning off
once only
is
required.
HTTPS Performance and Xcel SSL Acceleration
The E650GX and E450GX include the Xcel SSL Accelerator Card. Equalizer models without Xcel
(E250GX and E350GX) performs all SSL processing in software using the system CPU. Equalizers
with Xcel perform all SSL processing using the dedicated processor on the Xcel card. This allows
the system CPU to concentrate on non-SSL traffic. For most applications, Xcel will process several
hundred HTTPS transactions per second with no noticeable degradation in performance either for
the HTTPS cluster or for Equalizer as a whole.
In terms of bulk data throughput, the theoretical maximum throughput for Xcel/HTTPS is roughly
50% of that for the Equalizer in HTTP mode: Equalizer models with gigabit Ethernet can move
HTTP traffic at wire speed (1Gbit/s) for large transfers, while Xcel can encrypt only approximately
400Mbit/s with 3DES/SHA1 or 600Mbit/s with RC4/MD5. This reflects the fact that Xcel is primarily
a transaction accelerator, not a bulk data encryption device. It is noteworthy, however, that even
when moving bulk data at 600Mbit/s, Xcel removes the entire load of HTTPS/SSL processing from
the server pool in the cluster.
One final issue to be aware of is that Xcel supports only 3DES and RC4 encryption; it does not
support AES. It also does not support SSL or TLS cipher suites that use ephemeral or anonymous
Diffie-Hellman exchange (cipher suites whose names contain "EDH", "DHE", or "ADH").
378 Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.