Quantcast
Channel: Load Balancer - Load Balancing for Applications and Technologies
Viewing all 188 articles
Browse latest View live

AWS GovCloud (US)

$
0
0

Many federal agencies have adopted Kemp Technologies products including the US Department of Defense (DoD), US National Security Agencies, US Federal Civilian Agencies, and US Federal Healthcare Agencies. KEMP offers these AWS Govcloud(US) clients, the features listed below:

 

KEMP Technologies Virtual LoadMaster is now available in AWS GovCloud(US).

KEMP’s Virtual LoadMaster(VLM) for the cloud is a full-featured, advanced Layer 4-7 load balancing, content management engine capable of performing advanced application delivery functions such as Multi-protocol support, Clustering, SSL-Offload & re-encryption, Content Caching & Compression with advanced authentication options, among others. Available in the AWS GovCloud (US), it offers a rich set of features, resulting in an effortless transition of applications from on-premises data centers to the cloud.

Virtual LoadMaster is available in the Aws GovCloud(US) with Free and BYOL licensing options. The Free version delivers 20Mbps throughput and is used in both development and production environments, simplifying DevOps-oriented delivery methodologies. Customers may optionally upgrade this license to one with greater throughput with the purchase of a perpetual license. KEMP’s VLM for BYOL provides a wide range of throughput options ranging from 200Mbps to 10Gbps with varying ranges of SSL TPS, option to include Web Application Firewall and with an option to obtain GSLB multi-site Load Balancing.

KEMP cloud experts are available to help with integration and migration needs at all stages of a project, from inception to production.


Azure for Government

$
0
0

Many federal agencies have adopted Kemp Technologies products including the US Department of Defense (DoD), US National Security Agencies, US Federal Civilian Agencies, and US Federal Healthcare Agencies. KEMP offers these Azure for Governement clients, the features listed below:

 

KEMP Technologies Virtual LoadMaster is now available in Azure for Government

KEMP’s Virtual LoadMaster(VLM) for the cloud is a full-featured, advanced Layer 4-7 load balancing, content management engine capable of performing advanced application delivery functions such as Multi-protocol support, Clustering, SSL-Offload & re-encryption, Content Caching & Compression with advanced authentication options, among others. Available in the Azure for Government, it offers a rich set of features, resulting in an effortless transition of applications from on-premises data centers to the cloud.

Virtual LoadMaster is available in the Azure for Government with Free and BYOL licensing options. The Free version delivers 20Mbps throughput and is used in both development and production environments, simplifying DevOps-oriented delivery methodologies. Customers may optionally upgrade this license to one with greater throughput with the purchase of a perpetual license. KEMP’s VLM for BYOL provides a wide range of throughput options ranging from 200Mbps to 10Gbps with varying ranges of SSL TPS, option to include Web Application Firewall and with an option to obtain GSLB multi-site Load Balancing.

KEMP cloud experts are available to help with integration and migration needs at all stages of a project, from inception to production.

Content Switching

$
0
0

Companies use the AWS cloud to host a variety of applications and services. As organizations expand into the cloud, so does the need to add and modify those services. In doing so it is critical to maintain a cohesive user experience by maintaining a single URL while connecting to the appropriate service based on the content of the request.

With its ability to direct traffic based on the content of a request, and rewrite URLs, a LoadMaster can process Layer 7 traffic, directing requests to the desired service while also providing authentication, caching and compression.

Architecture Highlights

  • Controlled access to cloud based services
  • Service level based on origin of request
  • Seamless service upgrades
  • Reliability and performance
  • Flexibility and customization

Best Practices

Secure Site Connectivity

$
0
0

As companies grow, their infrastructure needs grow proportionally. Corporate IT needs to choose between expanding on-premises or to the Cloud. Expanding on-premises brings with it associated costs related to sizing and purchasing the HW, storage and networking needs, costs for deployment, integration and operation, and additionally, delays before operation is possible. Expanding to SaaS services available in the Cloud seem easier.

The decision, ultimately depends on corporate strategy and OPEX/CAPEX discussions. So, whether the plan is to build part of the business infrastructure in the cloud, or simply rely on using the cloud when demand dictates, it is critical to ensure that corporate data is protected – both in flight and in the cloud.

A Virtual LoadMaster(VLM) running on-premises can easily be configured to establish a tunnel to the AWS Cloud using its built-in IPsec VPN feature. With this secure, seamless access between the local and remote networks, the VLM can be used to balance application instances between the two locations, with the flexibility of the cloud allowing additional cloud-based instances to be spun up or down as needed.

Architecture Highlights

  • Load Balancing
  • Content Switching
  • Connectivity for Iaas, Paas, Saas

Best Practices

  • Compliance
  • Auditing
  • Data Management
  • Cloud Bursting

Web Application Firewall (WAF)

$
0
0

KEMP Virtual LoadMaster (VLM) for AWS includes security features such as SSL Offload SSL Re-encrypt functionality and IPSEC VPN for site to site connectivity. Additionally, VLM also provides Layer 7 protection for secure application-access with the Web Application Firewall functionality.

Virtual LoadMaster for AWS incorporates KEMP’s Application Firewall Pack (AFP). It combines Layer 7 Web Application Firewall protection, with other application delivery services including intelligent load balancing, intrusion detection, intrusion prevention as well as edge security and authentication. Built on ModSecurity, the world’s most deployed web application firewall engine, and augmented by constantly updated threat intelligence from Trustwave, applications are protected from known and emerging threats.

Architecture Highlights

  • Protects applications from SQL injections, Cross-Site Scripting
  • Prevents exfiltration of sensitive data
  • Complements caching, compression and other traffic optimizations

Best Practices

  • OWASP Top 10 Remediation
  • PCI-DSS Compliance
  • Data Loss Prevention (DLP)

Authentication and SSO in AWS

$
0
0

KEMP Virtual LoadMaster (VLM) Edge Security Pack (ESP) provides security features such as single sign on, pre-authentication and the ability to assign permitted groups applications running in AWS. In addition, ESP can be configured to allow only specific URLs and virtual directories to be published through the VLM.

KEMP VLM for AWS integrated with both Active Directory Federation Services and Active Directory Domain Services from Microsoft, provides both access and single sign-on to applications published in the Cloud. As Microsoft adds new functionality to the Active Directory offering, customers can benefit from advanced functionality offered by KEMP VLM to control access to applications across on-premises, AWS or Hybrid environments.

Architecture Highlights

  • Multifactor Authentication
  • Hybrid Cloud Integration
  • Integration with Microsoft workloads
  • Protect internet-facing applications

Best Practices

  • Microsoft TMG Replacement
  • Mobile Workforce Management
  • Security and Compliance

Policy Based Traffic Management

$
0
0

High availability and disaster recovery are of highest importance for application infrastructures since other factors such as capacity and performance although important, are negated if service either is not available or cannot quickly be recovered in the event of an instance failure or degradation. In such environments where around the clock, around the world service delivery is required, it's crucial to be able to direct traffic to efficiently use available resources.

KEMP Virtual LoadMaster’ a true layer 7 Application Delivery Controller, when combined with KEMP’s GSLB functionality known as GEO, high availability and intelligent global traffic distribution across on-premises, AWS based application pools, multiple private cloud infrastructures, becomes possible to support highly resilient, scalable and smart application deployments.

Architecture Highlights

  • Site level health checking
  • Policy based traffic steering
  • Optimal use of geographically distributed resources
  • Support multiple cloud regions and datacenters
  • Geographical awareness

Best Practices

  • Disaster Recovery
  • Site level failover
  • Quality of Experience

Business Continuity (DR-as-a-Service)

$
0
0

Business Continuity encompasses a variety of different concepts. At the simplest level, there may just be a requirement to meet unexpected peaks in demand for web based services – cloud bursting. There might even be a need to add and remove services as part of an application upgrade – while maintaining the ability to fall back to a previous known-good version if any problems arise. Another example might be the need to absorb and merge infrastructure and services should one company acquire another and need to present a single face to their customers. There is the worst-case scenario, where applications servers might become unavailable.

These in turn can form part of a broader strategy when planning for outages. There are many possible scenarios to consider, and many products and services available to provide disaster recovery. Scenarios can range from simple bursting to the cloud to maintain service levels, to policy-based traffic steering across AWS regions to a comprehensive active-active failover configuration.

KEMP’s Virtual LoadMaster provides some of these capabilities thanks to its built-in load balancing and High Availability (HA) features. It can also form a component of protected application workloads when deployed in conjunction with services protected by AWS Site Recovery.

Architecture Highlights

  • Span on-premises and multiple cloud environments
  • Advanced application health checking
  • Content Switching and traffic management
  • Support for Microsoft and key enterprise applications

Best Practices

  • High Availability with LoadMaster
  • Capacity planning
  • Multiple deployment sites
  • Secure connectivity
  • Application firewalling
  • User Authentication

AWS Application Load Balancer Features Guide

$
0
0

While the AWS Cloud provides many additional components and services beyond what is offered by Application Load Balancer(ALB), KEMP’s Virtual LoadMaster VLM for AWS has additional and enhanced features and capabilities that provide a rich set of integrated functionality, easily configured and managed via the Web User Interface. The same set of capabilities are available when LoadMaster, as an appliance or virtual machine, is used on premises. Having a common interface across all environments is a big advantage and provides a simpler, consistent management experience when deploying hybrid or heterogeneous cloud environments.

FeaturesApplication Load Balancer (ELB)Virtual LoadMaster (VLM)
Pre-configured application templates  
Clustering  
Content Based RoutingURL Path based RoutingURL path, Header info & Payload
Round Robin Scheduling MethodRound Robin & Weighted Round RobinRound Robin & Weighted Round Robin
Least Connections Scheduling MethodLeast Connections OnlyLeast Connections & Weighted Least Connections
Fixed Weighting & Weighted Response Time Based Scheduling Method  
Source IP based scheduling Methods  
Server Cookie (Passive) Persistence  
Server Cookie (Active) Persistence  
Source IP Persistence  
Advanced Session Persistence (Super HTTP, URL Hash, HTTP host Header, SSL Session ID, SIP, etc.)  
Multi-protocol SupportHttp & Https onlySupport L4 & L7 TCP & UDP Protocols
SSL Offload/re-encryptionOff Load OnlyBoth
Content Caching/Compression  
Advanced Authentication * 
(Advanced Options)
Multi-Application Support  (1 ALB/App) 
Web Application Firewall Protection  

* Supported by other services with AWS

AWS Classic Elastic Load Balancer Features Guide

$
0
0

While the AWS Cloud provides many additional components and services beyond what is offered by Elastic Load Balancer(ELB), KEMP’s Virtual LoadMaster VLM for AWS has additional and enhanced features and capabilities that provide a rich set of integrated functionality, easily configured and managed via the Web User Interface. The same set of capabilities are available when LoadMaster, as an appliance or virtual machine, is used on premises. Having a common interface across all environments is a big advantage and provides a simpler, consistent management experience when deploying hybrid or heterogeneous cloud environments.

FeaturesElastic Load Balancer (ELB)Virtual LoadMaster (VLM)
Layer 4 Load Balancing  
Layer 7 Load Balancing  
Pre-configured application templates  
High Availability  
Clustering  
Scheduling MethodsRound Robin OnlyAdvanced Scheduling Methods
Server PersistenceL4 OnlyL4/L7 (Advanced options)
SSL Termination/Offload  
Content Caching/Compression  
VM Resource Availability Awareness  
Header Content Switching  
Header Manipulation  
Health Check Aggregation  
TCP multiplexing  
Reverse Proxy  
Advanced Authentication * 
(Advanced Options)
Web Application Firewall Protection  

* Supported by other services with AWS

AWS GovCloud (US)

$
0
0

Many federal agencies have adopted Kemp Technologies products including the US Department of Defense (DoD), US National Security Agencies, US Federal Civilian Agencies, and US Federal Healthcare Agencies. KEMP offers these AWS Govcloud(US) clients, the features listed below:

 

KEMP’s Virtual LoadMaster(VLM) for the cloud is a full-featured, advanced Layer 4-7 load balancing, content management engine capable of performing advanced application delivery functions such as Multi-protocol support, Clustering, SSL-Offload & re-encryption, Content Caching & Compression with advanced authentication options, among others. Available in the AWS GovCloud (US), it offers a rich set of features, resulting in an effortless transition of applications from on-premises data centers to the cloud.

Virtual LoadMaster is available in the Aws GovCloud(US) with Free and BYOL licensing options. The Free version delivers 20Mbps throughput and is used in both development and production environments, simplifying DevOps-oriented delivery methodologies. Customers may optionally upgrade this license to one with greater throughput with the purchase of a perpetual license. KEMP’s VLM for BYOL provides a wide range of throughput options ranging from 200Mbps to 10Gbps with varying ranges of SSL TPS, option to include Web Application Firewall and with an option to obtain GSLB multi-site Load Balancing.

KEMP cloud experts are available to help with integration and migration needs at all stages of a project, from inception to production.

Azure for Government

$
0
0

Many federal agencies have adopted Kemp Technologies products including the US Department of Defense (DoD), US National Security Agencies, US Federal Civilian Agencies, and US Federal Healthcare Agencies. KEMP offers these Azure for Governement clients, the features listed below:

 

KEMP Technologies now available in Azure for Government Offers

KEMP’s Virtual LoadMaster(VLM) for the cloud is a full-featured, advanced Layer 4-7 load balancing, content management engine capable of performing advanced application delivery functions such as Multi-protocol support, Clustering, SSL-Offload & re-encryption, Content Caching & Compression with advanced authentication options, among others. Available in the Azure for Government, it offers a rich set of features, resulting in an effortless transition of applications from on-premises data centers to the cloud.

Virtual LoadMaster is available in the Azure for Government with Free and BYOL licensing options. The Free version delivers 20Mbps throughput and is used in both development and production environments, simplifying DevOps-oriented delivery methodologies. Customers may optionally upgrade this license to one with greater throughput with the purchase of a perpetual license. KEMP’s VLM for BYOL provides a wide range of throughput options ranging from 200Mbps to 10Gbps with varying ranges of SSL TPS, option to include Web Application Firewall and with an option to obtain GSLB multi-site Load Balancing.

KEMP cloud experts are available to help with integration and migration needs at all stages of a project, from inception to production.

Load Balancing NGINX

$
0
0

NGINX is a high performance webserver designed to handle thousands of simultaneous requests and has become one of the most deployed web server platforms on the Internet. KEMP LoadMaster can bring resilience and scalability to your NGINIX environment with an easily deployable load balancer that can service millions of active connections in a highly available configuration.

Fig 1. LoadMaster load balancing topology for NGNIX

LoadMaster Features

  • Deploy on-premises or in cloud (Azure and AWS)
  • Layer 4 and Layer 7 load balancing
  • NGNIX health checking
  • NGINX template to simplify and speed setup
  • High performance reverse proxy
  • SSL offload for NGINX
  • Content switching
  • 24x7 Support
  • Support mix of NGNIX and other web servers (Apache, IIS)

Getting your Load Balancer for NGINX

LoadMaster is available as a 30 day trial or if you have traffic requirements of less than 20Mbit/s then you can have a LoadMaster for free. The trials are delivered as pre-built appliances for the major hypervisor platforms or if you wish, you can select the trial and free versions from the Azure and Amazon Web Services (AWS) marketplaces.

Configuring Load Balancing for NGINX

The LoadMaster documentation set provides guidelines on how to deploy and configure a LoadMaster appliance to load balance application workloads on NGINX and how to configure advanced features such as single sign-on and reverse proxy for NGINX.

Load Balancing Features for NGINX

SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.

DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers

Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX

Reverse Proxy– LoadMaster can act as a reverse proxy for NGNIX environments

Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance

SSL Redirect– Redirection of all non-HTTPS requests to HTTPS

Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime

Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities

Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

Load Balancing NGINX on Microsoft Azure

$
0
0

NGINX is a high performance webserver designed to handle thousands of simultaneous requests and has become one of the most deployed web server platforms on the Internet. KEMP LoadMaster can bring resilience and scalability to your NGINIX environment on Microsoft Azure with an easily deployable load balancer that can service millions of active connections in a highly available configuration.

LoadMaster on Microsoft Azure provides an easy and cost-effective way to load balance NGNIX servers with subscription (PAYG) and permanent (BYOL) licensing options. For small workloads (<20Mbps) we offer a totally free load balancer which can be used for test, DevOPS or even production workloads.

Simply visit the Microsoft Azure Marketplace to find the best solution for NGINX Load Balancing on Microsoft Azure.

Configuring Load Balancing for NGINX on Microsoft Azure

The LoadMaster documentation set provides guidelines on how to deploy and configure a LoadMaster appliance to load balance NGNIX on Microsoft Azure.

LoadMaster Features

  • Layer 4 and Layer 7 load balancing
  • NGNIX health checking
  • NGINX template to simplify and speed setup
  • High performance reverse proxy
  • SSL offload for NGINX
  • Content switching
  • 24x7 Support

Load Balancing Features for NGINX

  • SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.
  • DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers
  • Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX
  • Reverse Proxy– LoadMaster can act as a reverse proxy for NGNIX environments
  • Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance
  • SSL Redirect– Redirection of all non-HTTPS requests to HTTPS
  • Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime
  • Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities
  • Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

Load Balancing NGINX on AWS

$
0
0

NGINX is a high performance webserver designed to handle thousands of simultaneous requests and has become one of the most deployed web server platforms on the Internet. KEMP LoadMaster can bring resilience and scalability to your NGINIX environment on AWS with an easily deployable load balancer that can service millions of active connections in a highly available configuration.

LoadMaster on AWS provides an easy and cost-effective way to load balance NGNIX servers with subscription (PAYG) and permanent (BYOL) licensing options.

Simply visit the AWS Marketplace to find the best solution for NGINX Load Balancing on AWS.

Configuring Load Balancing for NGINX on AWS

The LoadMaster documentation set provides guidelines on how to deploy and configure a LoadMaster appliance to load balance NGNIX on AWS.

LoadMaster Features

  • Layer 4 and Layer 7 load balancing
  • NGNIX health checking
  • NGINX template to simplify and speed setup
  • High performance reverse proxy
  • SSL offload for NGINX
  • Content switching
  • 24x7 Support

Load Balancing Features for NGINX

  • SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.
  • DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers
  • Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX
  • Reverse Proxy– LoadMaster can act as a reverse proxy for NGNIX environments
  • Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance
  • SSL Redirect– Redirection of all non-HTTPS requests to HTTPS
  • Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime
  • Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities
  • Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

Reverse Proxy for NGINX

$
0
0

When hosting services on NGNIX and other web servers, a reverse proxy can significantly improve the performance, resilience, scalability and security of application delivery. The key features of a reverse proxy are:

  • SSL Offload - Remove the security processing and administration overhead from NGNIX servers to the reverse proxy
  • Web Acceleration - Caching and compression of content on the Reverse Proxy along with optimizations such as HTTP/2 provide a better user experience
  • Security - A Reverse Proxy can protect NGNIX and other resources by offering features such as single sign-on (SSO) and IPS/IDS
  • Web Application Protection - A web application firewall (WAF) deployed on the Reverse Proxy can protect applications from well known and emerging threats
  • Load Balancing - a Reverse Proxy can load balance user traffic between NGNIX and other servers based on multiple criteria such as server availability, load, request type and even geographic location.

KEMP LoadMaster ticks all the boxes for an easily deployed reverse proxy that secures and enhances the application delivery infrastructure. It is available as a virtual appliance that may be deployed on a local hypervisor, as a virtual appliance on major cloud platforms and as a physical device. Regardless of the deployment model, Loadmaster is a proven, easily managed, supported and fully featured Reverse Proxy for NGNIX and other web server environments.

Fig 1. LoadMaster as a multi-featured Reverse proxy for NGNIX

In Fig 1. above, LoadMaster consolidates the core Reverse Proxy functionality into a single easily managed appliance. The performance, security, availability and scalability of the application environment is greatly enhanced by deploying LoadMaster as a Reverse Proxy for NGNIX.

Getting your LoadMaster Reverse Proxy for NGINX

LoadMaster is available as a 30 day trial or if you have traffic requirements of less than 20Mbit/s then you can have a LoadMaster for free. The trials are delivered as pre-built appliances for the major hypervisor platforms or if you wish, you can select the trial and free versions from the Azure and Amazon Web Services (AWS) marketplaces.

Configuring LoadMaster as a Reverse Proxy for NGINX

The LoadMaster documentation set provides guidelines on how to deploy and configure a LoadMaster appliance to proxy application workloads on NGINX.

LoadMaster Reverse Proxy Features

  • SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.
  • Context Switching– Redirection of requests to back end servers based on the content of the request
  • DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers
  • Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX
  • Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance
  • SSL Redirect– Redirection of all non-HTTPS requests to HTTPS
  • Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime
  • Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities
  • Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

Single Sign-On for NGINX

$
0
0

NGINX is a high performance webserver designed to handle thousands of simultaneous requests and has become one of the most deployed web server platforms on the Internet. KEMP LoadMaster can provide Single Sign-On across multiple applications including those hosted on NGNIX. LoadMaster offers a number of authentication options including Active Directory, Kerberos Constrained Delegation (KCS), LDAP, RADIUS and SAML and provides a single point of control for user access to applications. Two factor authentication schemes are also supported.

  • SSL Offload - Remove the security processing and administration overhead from NGNIX servers to the reverse proxy
  • Web Acceleration - Caching and compression of content on the Reverse Proxy along with optimizations such as HTTP/2 provide a better user experience
  • Security - A Reverse Proxy can protect NGNIX and other resources by offering features such as single sign-on (SSO) and IPS/IDS
  • Web Application Protection - A web application firewall (WAF) deployed on the Reverse Proxy can protect applications from well known and emerging threats
  • Load Balancing - a Reverse Proxy can load balance user traffic between NGNIX and other servers based on multiple criteria such as server availability, load, request type and even geographic location.

KEMP LoadMaster ticks all the boxes for an easily deployed reverse proxy that secures and enhances the application delivery infrastructure. It is available as a virtual appliance that may be deployed on a local hypervisor, as a virtual appliance on major cloud platforms and as a physical device. Regardless of the deployment model, Loadmaster is a proven, easily managed, supported and fully featured Reverse Proxy for NGNIX and other web server environments.

Fig 1. LoadMaster SSO topology for NGNIX and AD

IIn fig 1. above, users are presented with a custom authentication form where the credentials provided are authenticated via LoadMaster. LoadMaster supports multiple SSO domains for different groups (e.g. Staff or Partners) on different security domains. Once authenticated, the remote user can seamlessly access the SSO enabled applications – in this case NGNIX, Exchange OWA and Sharepoint.

Getting your SSO Enabled Load Balancer for NGINX

LoadMaster is available as a 30 day trial or if you have traffic requirements of less than 20Mbit/s then you can have a LoadMaster for free. The trials are delivered as pre-built appliances for the major hypervisor platforms or if you wish, you can select the trial and free versions from the Azure and Amazon Web Services (AWS) marketplaces.

Configuring Load Balancing and SSO for NGINX

The LoadMaster documentation set provides guidelines on how to deploy and configure a LoadMaster appliance to load balance application workloads on NGINX and how to configure advanced features such as single sign-on and reverse proxy for NGINX. The following documents will assist with getting started with SSO for NGNIX.

Custom images for user authentication dialogs can be downloaded here

Load Balancing Features for NGINX

As well as offering SSO services, LoadMaster delivers a wide range of features to enhance the performance, availability and manageability of application delivery infrastructure.

  • SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.
  • Context Switching– Redirection of requests to back end servers based on the content of the request
  • DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers
  • Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX
  • Reverse Proxy‐ LoadMaster can act as a reverse proxy for NGNIX environments
  • Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance
  • SSL Redirect– Redirection of all non-HTTPS requests to HTTPS
  • Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime
  • Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities
  • Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

SSL Offload for NGNIX

$
0
0

NGINX is a high performance webserver designed to handle thousands of simultaneous requests and has become one of the most deployed web server platforms on the Internet. A key component of delivering applications and services with NGNIX is the use of SSL to secure the communications between clients and the NGNIX servers.

The processing overhead of SSL can have a significant impact on the performance of a HTTP server and one solution is to offload this to a load balancer. This approach brings a number of benefits beyond just reducing the server overhead. It also provides a single point of management for website security with just one place to manage SSL keys and certificates and a centralized point of control for SSL configuration and policy.

SSL Offload options for NGNIX

With SSL offloading, all client traffic is decrypted/encrypted at the load balancer allowing the load balancer to perform other functions such as compression, caching and content inspection. The load balancer may optionally use SSL encrypted sessions with the NGNIX servers for additional security in environments where the network between the load balancer and NGNIX is untrusted.

Fig 1. SSL offload topology for NGNIX

Configuring SSL Offload for NGINX

A tech note on our support site provides guidelines on how to configure SSL offloading for NGNIX servers on LoadMaster. Our support team are available to assist you during your evaluation period should you need any guidance on configuring SSL offload and the best practices for securing NGNIX workloads with SSL.

Load Balancing Features for NGINX

  • SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.
  • DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers
  • Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX
  • Reverse Proxy‐ LoadMaster can act as a reverse proxy for NGNIX environments
  • Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance
  • SSL Redirect– Redirection of all non-HTTPS requests to HTTPS
  • Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime
  • Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities
  • Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

Load Balancing WordPress on NGNIX

$
0
0

NGINX is a high performance webserver designed to handle thousands of simultaneous requests and has become one of the most deployed web server platforms on the Internet and is especially suited to delivering workloads such as WordPress.

A load balancer can maintain the availability and performance of WordPress on NGNIX by ensuring that requests are evenly spread across NGNIX servers, that NGNIX host failures are handled gracefully without end user impact and that user traffic is optimized to reduce load on the NGNIX WordPress servers.

Why load balance WordPress on NGNIX?

  • SSL Offload‐ Remove the security processing and administration overhead from the WordPress NGNIX servers to the load balancer
  • Web Acceleration‐ Caching and compression of WordPress content on the load balancer along with optimizations such as HTTP/2 provide a better user experience
  • Security‐ A Reverse Proxy can protect WordPress by offering features such as single sign-on (SSO) and IPS/IDS
  • Web Application Firewall‐ The load balancer’s web application firewall (WAF) protects WordPress from well known and emerging threats
  • Intelligent Load Balancing‐ User traffic is load balanced between WordPress servers based on multiple criteria such as server availability, load, request type and even geographic location

Load Balancing WordPress on NGNIX

When load balancing WordPress, the load balancer can optionally implement SSL offload, WAF, caching, compression and health checking to minimize load on WordPress servers and maximize uptime and performance.

Fig 1. Load Balancing topology for WordPress on NGNIX

Configuring Load Balancing for WordPress

The LoadMaster documentation set provides guidelines on how to deploy and configure a LoadMaster appliance to load balance application workloads on NGINX and how to configure advanced features such as single sign-on and reverse proxy for NGINX. You can download a trial version of LoadMaster or if use the Free Version of LoadMaster for WordPress workloads of less than 20Mbits/sec.

Load Balancing Features for NGINX

  • SSL Offload– LoadMaster can offload the SSL processing workload from the NGINX servers and also provide a single point of administration for SSL certificates and security.
  • DDOS Protection– LoadMaster includes a snort compatible engine to offer DDOS protection for NGNIX servers
  • Authentication– The Edge Security Pack in LoadMaster provides comprehensive authentication and single sign-on services for NGNIX
  • Reverse Proxy‐ LoadMaster can act as a reverse proxy for NGNIX environments
  • Caching and Compression– LoadMaster uses caching and compression as a way to improve NGNIX performance
  • SSL Redirect– Redirection of all non-HTTPS requests to HTTPS
  • Intelligent Session Persistence– Multiple options available to ensure clients are load balanced to the same server for the session lifetime
  • Web Application Firewall (WAF)– The LoadMaster WAF for NGNIX provides application level protection from common and day-zero vulnerabilities
  • Global Load Balancing (GSLB)– Load balance NGNIX across multiple physical locations including cloud to provide disaster recovery failover and geo-aware traffic distribution.

Load Balancer settings when migrating from Exchange 2010 to Exchange Server 2016

$
0
0

Exchange Server 2016 supports coexistence with Exchange Server 2010 Update Rollup 11 and later. Planning and configuring load balancer settings is critical for Exchange Server configuration, and it plays a crucial role when coexistence and migration projects are in progress. Since many organization are looking to update from their older Exchange Server 2010 deployments to Exchange Server 2016, this article helps you to understand the considerations to address for coexistence configurations.

Configuring the Load Balancer when Migrating from Exchange 2010 to Exchange 2016

Upgrading or migrating between versions of Exchange Server required careful planning to deliver a seamless user experience with no downtime. When organizations are migrating from Exchange 2010 to Exchange 2013, it may take some time to complete the project. As a result, it is essential to configure the previous and new Exchange systems to coexist. A correctly configured load balancer setup can make this possible.

Users can access Exchange Server email in many ways including Outlook clients on multiple devices, Outlook on the Web, Active Sync, and others. There are various protocols that clients use to connect to the Exchange Server, and these can all be configured to use the load balancers in place. The protocols are:

  1. Outlook Web App (OWA)
  2. Autodiscover
  3. Exchange Web services (EWS)
  4. Exchange Active Sync(EAS)
  5. Offline Address book (OAB)
  6. Outlook Anywhere
  7. MAPI
  8. SMTP Protocol

The table below shows the Exchange 2010 Internal and External URL configuration that will be used on the Exchange 2010 CAS Servers.

Figure 1 shows a typical Exchange 2010 deployment with a load balancer, and how different client connection types are handled.

Figure 1. Current Exchange 2010 organizations before introduction Exchange 2016

Exchange Organizations after introducing Exchange 2016

As servers running Exchange 2016 Server are introduced into an organization the same CAS URLs and name space from Exchange 2010 can be used, with one addition for Outlook Anywhere as discussed below. The Table below includes the additional Outlook Anywhere URL.

There are two options available to allow coexistence between Exchange Server 2010 and Exchange Server 2016. They are:

  1. Reconfigure the Exchange Server 2010 organization, or
  2. Retain the existing Exchange 2010 organization.

Let’s discuss each of these options and load balancer design and role is implemented in both.

Reconfigure the Exchange Server 2010 organization

This is the recommended option from the two available. Reconfiguring the Exchange Server 2010 organization enables Outlook Anywhere for all the Exchange Server 2010 users. This makes it much easier to coexist with Exchange Server 2016 servers. All the Outlook clients should be using Outlook Anywhere as the default connection protocol. The PowerShell script below can be used to enable Outlook Anywhere on Exchange 2010 Server:

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Get-ClientAccessServer | Where {$_.OutlookAnywhereEnabled -Eq $False} | Enable-OutlookAnywhere -ClientAuthenticationMethod Basic -SSLOffloading $False -ExternalHostName mail.domain.com -IISAuthenticationMethods NTLM, Basic

Internally outlook clients does not use the Outlook Anywhere protocol by default to connect to Exchange Server, as the Outlook client by default uses the RPC protocol on high-speed networks. However, to force all the Outlook clients to use Outlook Anywhere on internal network use the PowerShell commands below on the Exchange Server. Once executed Autodiscover configures all the Outlook clients to use RPC/HTTP and uses mail.domain.com for the internal connection.

Set-OutlookProvider EXPR -OutlookProviderFlags:ServerExclusiveConnect
Set-OutlookProvider EXCH -OutlookProviderFlags:ServerExclusiveConnect

Figure 2 shows the configuration for Exchange Server 2016 and Exchange Server 2010 co-existence. With all the above Exchange Server configuration in place the load balancers need configured to work with Exchange 2016 Server to use the Mail.domain.com and Autodiscover.domain.com URLs shown in the table. This allows the clients to connect and if the target mailbox is on an Exchange 2016 Server it directly connects to the user’s mailbox. If the target mailbox is on a legacy Exchange 2010 Server then the Exchange 2016 CAS server proxies the connection to the Exchange 2010 CAS server, and this sets up the connection to the mailbox. The proxying of this connection is entirely transparent to the users.

DNS changes will also be required on the load balancer that is handling requests to the CAS servers. This is necessary to ensure that the correct requests are sent to the right Exchange 2016 and Exchange 2010 servers during the coexistence. The same will be true for load balancers directing SMTP requests if in use. The DNS changes required will be unique to each Exchange organization.

Figure 2. Exchange organizations after introduction of Exchange Server 2016

The points below outline how various protocols are proxied from Exchange 2016 to Exchange 2010:

OWA Protocol

OWA Client -> Exchange 2016 -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

Active Sync Protocol

Active Sync Client -> Exchange 2016 CAS -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

Exchange Web Service

Active Sync Client -> Exchange 2016 CAS -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

Outlook Anywhere

Active Sync Client -> Exchange 2016 CAS -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

No change the existing Exchange 2010 organization

If you decide to go for option 2 and retain the existing Exchange Server 2010 organization without modification then a few things need configured. In this scenario, Exchange 2010 Outlook Anywhere is configured with mail.domain.com and RPC traffic is set up with Outlook.comain.com. This design does not need any changes to coexist with Exchange 2016. Users could continue to use outlook.domain.com for all the RPC connections. Since the load balancer is already routing outlook.domain.com to Exchange Server 2010 no changes are required there either. However, Exchange Server 2010 users continue to use outlook.domain.com, and all Exchange 2016 users use mail.domain.com for all connections.

Configure the load balancer with the URL’s mail.domain.com and Autodiscover.domain.com to route requests and traffic to Exchange 2016 Servers. Figure 3 shows this configuration.

Figure 3. Mail flow with a retained Exchange Server 2010 organization.

The points below outline how various protocols are proxied from Exchange 2016 to Exchange 2010 without the organizational changes outlined for option 1:

OWA Protocol

OWA Client -> Exchange 2016 -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

Active Sync Protocol

Active Sync Client -> Exchange 2016 -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

Exchange Web Service

Active Sync Client -> Exchange 2016 -> Proxies Connection -> Exchange 2010 CAS -> Exchange 2010 mailbox

Hopefully this article series will help you to understand how a load balancer plays a role in configuring coexistence between Exchange 2010, 2013, and 2016. The next article will cover coexistence when migrating from Exchange Server 2013 to Exchange Server 2016.

Viewing all 188 articles
Browse latest View live