Fortinet Gate 60D, Руководство администратора

Страница: 624 / 706

Byte caching WAN optimization and web caching
FortiGate Version 4.0 Administration Guide
624 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Byte caching
FortiGate WAN optimization Byte Caching breaks large units of application data (for
example, a file being downloaded in from a web page) into small chunks of data, labelling
each chunk of data with a hash of the chunk, and storing those chunks and their hashes in
a database. The database is stored on a storage device such s a hard disk or an iSCSI
device. Then, instead of sending the actual data over the WAN tunnel, the FortiGate unit
sends the hashes. The FortiGate unit at the other end of the tunnel receives the hashes
and compares them with the hashes in its local byte caching database. If any hashes
match, that data does not have to be transmitted over the WAN optimization tunnel. The
data for any hashes that does not match is transferred over the tunnel and added to that
byte caching database. Then the unit of application data (the file being downloaded) is
reassembled and sent to its destination.
Byte caching is not application specific. Bytes cached from a file in an email can be used
to optimize downloading that same file, or a similar file from a web page.
The result is less data is transmitted over the WAN. Initially, byte caching may reduce
performance until a large enough byte caching database is built up.
Select Byte caching in a WAN optimization rule to enable byte caching. The Protocol
setting does not affect byte caching. Data is byte cached when it is processed by a WAN
optimization rule that includes byte caching.
Byte caching cannot determine whether a file is compressed (for example a zip file) or not
and caches compressed (for example, zipped) and non-compressed versions of the same
file separately.
SSL offloading for WAN optimization and web caching
WAN optimization SSL offloading uses the FortiGate unit to encrypt and decrypt SSL
sessions. WAN optimization supports SSL offloading for HTTP and HTTPS sessions to
and from web servers. The FortiGate unit intercepts HTTPS traffic from clients and
decrypts it before sending it as HTTP clear text to the web server. The HTTP clear text
response from the web server is encrypted by the FortiGate unit and returned to the client
as an HTTPS session. The result should be a performance improvement because SSL
encryption and decryption is off-loaded from the server to the FortiGate unit FortiASIC
SSL encryption/decryption engine. You can also combine SSL offloading with other WAN
optimization techniques such as HTTP protocol optimization, byte caching, and web
caching to further enhance web server performance.
You enable SSL offloading by selecting Enable SSL in a WAN optimization rule. You must
also add SSL servers to support SSL offloading using the CLI command
config
wanopt ssl-server
.
You must add one WAN optimization SSL server configuration to a FortiGate unit for each
HTTP server that you are configuring SSL offloading for. This SSL server configuration
must also include the HTTP server CA. You load this certificated into the FortiGate unit as
a local certificate and then add the certificate to the SSL server configuration using the
ssl-cert
keyword. The certificate key size must be 1024 or 2048 bits. 4096-bit keys are
not supported.
You can configure one WAN optimization rule to offload SSL encryption/decryption for
multiple HTTP servers. To do this, the WAN optimization rule source and destination
addresses must be configured so that the rule accepts packets destined for all of the
HTTP servers that you want offloading for. Then you must add one SSL server
configuration for each of the HTTP servers.