23
Copyright © 2000 - 2005 KEMP Technologies, Inc. All Rights Reserved.
I. SSL Acceleration
When this option is enabled. The LoadMaster functions as an SSL endpoint and decrypts the content of the
message. This allows the LoadMaster to use the contents of the message to perform content switching and
handle persistency options.
In this mode, the connection to the real server is not encrypted. This relieves the real server of the work need
to handle the SSL protocol and also means that only one SSL certificate is required for the LoadMaster,
instead of one certificate per real server.
SSL acceleration is available for any “TCP” service, which uses port 443 if the persistency option is not SSL
session ID. The use of SSL acceleration and SSL session ID persistency does not make sense and so is not
supported.
1. Certificate files
To enable the LoadMaster to act as an SSL endpoint, a server SSL certificate and a private key must be
supplied. When SSL acceleration is enabled via the Web interface, the user is given the option of installing a
SSL certificate file. It is also possible to install and update certificates via the administration menu.
If no certificate is installed for a virtual service, a temporary one is generated locally on the LoadMaster. This
certificate is locally signed and will be regenerated upon reboot and so should not be used except for testing.
An SSL certificate can be acquired from one of the various Trusted Authorities.
A private key must also be transferred to the LoadMaster. This can be either a separate file on the same
machine or the private key can be appended to the SSL certificate. If the private key is appended to the SSL
certificate (openssl can generate one file with both parts in), then a separate private key is not required.
J. Rule Based Content Switching
In the previously described load balancing methods, it is assumed that all real servers have the same content.
A network administrator may wish to split up the site so that certain servers should be used only for static
content i.e. “.gif”s while other servers should be used only for scripts etc. This would be useful if a customer
database only ran on a small number of servers but the site had lots of static content.
With L7 content switching, “Rules” can be defined which can be used to redirect different requests to different
real servers. A “rule” defines a string, which is matched against the incoming URL string. If the URL matches
the “Rule”, the request is directed to the Real Servers the “rule” is assigned to.
URL definition according to RFC2616:
http://www.a-host.com/content/example/request.cgi?value=”hello”
⏐←
→⏐←
→
⏐
←
Start URL
End URL
→
⏐
←
Query part
→⏐
Protocol definition and
(ignored)
Host part (ignored)
1. Rule Definition
A “rule”, can be defined as one of the following:
A prefix string: The rule will match if the start of the URL matches the given string.
I.e. If a rule has the value “/home”, then all requests for “/home/…” will be matched by the rule.
A postfix string: The rule will match if the end of the URL matches the given string.
I.e. If a rule has the value “.gif”, then all requests for “XXX.gif” will be matched by the rule.
