Radware Alteon, Инструкция по применению

Страница: 596 / 842

Alteon Application Switch Operating System Application Guide
Persistence
596
Document ID: RDWR-ALOS-V2900_AG1302
Proxy Support for Insert Cookie
When the insert cookie persistence mode is enabled, Alteon parses through every HTTP request
within the same TCP connection to look for the configured cookie name to use for persistency. If the
client request arrives without a cookie, the request is forwarded to the existing binded server. When
cookie insert persistence mode is enabled, Alteon needs to insert a cookie in the server-returned
response for those client requests without a cookie.
If the client request arrives with a cookie, then the cookie is used to check against the persistence
binding table.
SSL Session ID-Based Persistence
SSL is a set of protocols built on top of TCP/IP that allows an application server and client to
communicate over an encrypted HTTP session, providing authentication, non-repudiation, and
security. The SSL protocol handshake is performed using clear (unencrypted) text. The content data
is then encrypted, using an algorithm exchanged during the handshake, prior to being transmitted.
Using the SSL session ID, Alteon forwards the client request to the same real server to which it was
bound during the last session. Because the SSL protocol allows many TCP connections to use the
same session ID from the same client to a server, the key exchange needs to be done only when the
session ID expires. This reduces server overhead and provides a mechanism, even when the client
IP address changes, to send all sessions to the same real server.
Notes
•
The SSL session ID can only be read after the TCP three-way handshake. In order to make a
forwarding decision, Alteon must terminate the TCP connection to examine the request.
• SSL session ID persistence is not supported when SSL offloading is enabled and other more
advanced persistency features, such as cookie persistency, are available.
Some versions of Web browsers allow the session ID to expire every two minutes, thereby breaking
the SSL ID persistence. To resolve this issue, use persistency with metric
hash
or
pbind
clientip
.
Note: The destination port number to monitor for SSL traffic is user-configurable.
Alteon also has set of SSL offloading features for manipulating SSL traffic. For more information, see
Offloading SSL Encryption and Authentication, page 337 .
How SSL Session ID-Based Persistence Works
• All SSL sessions that present the same session ID (32 random bytes chosen by the SSL server)
are directed to the same real server.
• New sessions are sent to the real server based on the metric selected (hash, roundrobin,
leastconns, minmisses, response, and bandwidth).
• If no session ID is presented by the client, Alteon picks a real server based on the metric for the
real server group and waits until a connection is established with the real server and a session
ID is received.
• The session ID is stored in a session hash table. Subsequent connections with the same session
ID are sent to the same real server. This binding is preserved even if the server changes the
session ID midstream. A change of session ID in the SSL protocol causes a full three-way
handshake to occur.