Exinda EXNV-10063, Руководство администратора

Страница: 478 / 623

Exinda Network Orchestrator 4 Settings | 478
When enabled and the traffic falls into an acceleration policy, multi-path TCP flows are not accelerated. The
multi-path TCP options are not stripped and the flows will continue to work in a multi-path TCP fashion.
When disabled and the traffic falls into an acceleration policy, the multi-path TCP options will be stripped
and acceleration will be attempted.
When the traffic does not fall into an acceleration policy (regardless of this setting), the multi-path TCP
options with not be stripped and the flows will work in a multi-path TCP fashion.
End Acceleration (no acceleration on the LAN)
– Forces acceleration to end on this appliance.
When enabled, any incoming acceleration connections on the WAN will be terminated at this appliance and
no attempt will be made to find another appliance on the LAN interface. This has no effect on accelerated con-
nections arriving on the LAN.
Consider traffic passing from the client to the server through two accelerated Exinda appliances:
Client -> (LAN-side) Exinda (WAN-side) -> WAN -> (WAN-side) Exinda (LAN-
side) -> Server
Normally, the server side Exinda would send out an option 30 packet to the server. However, if the server does not know
how to handle with an option 30, it will return a SYN/ACK without an option 30. Enabling this setting allows the server-
side Exinda to know that it is the last appliance in the chain and so it will not send out a SYN with option 30 and it
terminates the acceleration connection.
In addition to stopping this appliance from sending option 30 packets to servers that are known to not handle them, it
also reduces the timeouts that happen with protocol 139 when attempting to accelerate past the last appliance. It allows
servers/firewalls that refuse options to work. It prevents sending random options out to the Internet, which is the case in
an accelerated backhauled traffic environment with only a single pair of Exinda appliances. If you have a hub-and-spoke
topology then you will not want to enable this setting.
Configure SSL Acceleration Servers
SSL Acceleration provides acceleration of SSL encrypted TCP sessions by intercepting SSL connections to configured
servers by decrypting these sessions, performing acceleration techniques, and then re-encrypting them. Only traffic to
the configured servers is SSL accelerated. Any SSL traffic that the Exinda appliance sees that does not belong to a
configured server is ignored.
By configuring the SSL Acceleration Server, you are specifying:
The location of the server (IPv4 address and port)
The SNI (Server Name Indication) which is the hostname of a virtual host when multiple secure websites are hosted
on a single host where you want each website to use its own certificate
Which certificate is used to re-encrypt the traffic
Which certificate is used to authenticate the traffic and what type of validation to perform using that certificate
If any CA validation is chosen, then you can choose whether to check if that CA certificate is still valid or whether it
has been revoked.
NOTE
If the revocation check cannot be done or the certificate has been revoked, then the SSL Acceleration Server is
disabled. If the OCSP Responder is offline, the server is disabled. The appliance periodically tests the connection
and re-enables the server when it is back up. If the OCSP response verification fails or if the certificate has been
revoked, then the connection is reset and the server is disabled.