F5 Herculon SSL Orchestrator, Настройка

Страница: 29 / 58

After creating more than one service, you can now create a service chain.
Creating ICAP services
Before creating ICAP services, complete all areas in General Properties. Refer to the Configuring general
properties section of this document for more information.
ICAP services use the RFC3507 ICAP protocol to refer HTTP traffic to one or more content adaptation
devices to inspect or modify. You can add an ICAP to any TCP service chain, but only HTTP traffic is
sent to the chain. Additionally, you can configure up to ten ICAP services using the Herculon SSL
Orchestrator configuration utility to load balance across them.
1. On the Main tab, click SSL Orchestrator > Configuration , and on the menu bar, click Services >
ICAP Services to view ICAP services settings.
The ICAP Services screen opens.
2. Click Add .
3. In the Name field, type a name for your configuration.
4. In the ICAP Devices field, type an IP address and port number and click Add .
5. For Headers , from the Mode list, select either Default or Custom .
To edit the headers, use Custom .
6. From the TCP Connections list, select F5
®
OneConnect
™
or Separate .
Use OneConnect to reuse the TCP connections to ICAP servers, which processes multiple
transactions. If your ICAP servers do not support multiple ICAP transactions per TCP connection,
select
Separate . OneConnect will then be disabled.
7. From the Type list, select either Load Balanced or Custom .
• If you select Load Balanced , the Request and Response fields are prepopulated with keywords
that will be automatically replaced by the configured active ICAP server and port at the time of
the request. The specific page name for the request and response must be manually entered to
complete the URI. For example, if the request URI for the ICAP servers will be “icap://
10.1.2.3:1344/REQ”, you enter “REQ” in the request field.
• If you select Custom , the Request and Response fields are empty and the entire URI content
must be manually entered. In this case, Herculon SSL Orchestrator will not load balance traffic
across the configured ICAP servers. For example, if the request URI for the ICAP server will be
“icap://icap.example.com/request”, you enter the entire URI into the request field.
8. In the Request and Response fields, type the ICAP request and response URI, defined by RFC3507,
that are related to the ICAP server and based on whether you selected Load Balanced or Custom in
the previous step.
9. In the Preview Max. Length (bytes) field, type the number of bytes that are in the maximum length
for the ICAP preview.
Bytes of content, up to the specified number, are sent to the ICAP server as a preview of each HTTP
request or response. If you set the maximum preview length to zero (0), then requests and responses
are streamed through the ICAP server. The largest value currently supported is 51200 (50KB).
10. From the Server Failure Handling list, select Reset Connection or Next Service Chain .
• Use Reset Connection for the system to reset the connection to the client, discarding the request
and response.
• Use Next Service Chain for the system to let the request or response continue to the next service
in the service chain.
11. From the Send HTTP/1.0 Requests to ICAP list, select how to send requests to the ICAP service.
• Use HTTP/1.0 & HTTP/1.1 to send both HTTP/1.0 and HTTP/1.1 requests to the ICAP service.
F5 Herculon SSL Orchestrator: Setup
29