Coyote Point Systems Equalizer Especificaciones descargar pdf (Pagina 309)

Front-End-Https: on

7. Select commit to modify the cluster.

Performance Considerations for HTTPS Clusters

Layer 7 HTTPS clusters have several options that can have a significant impact on the performance and behavior

of the cluster:

1. The injection of a customheader to provide transaction-specific information to the server. For example, to

tell the server that Equalizer terminated the HTTPS connection and performed SSL processing on the

incoming request (see the previous section, above).

2. The "munging", or translation, of HTTP redirects to HTTPS redirects (see the description of the no header

rewrite flag under Modifying a Layer 7 Virtual Cluster).

3. The once only flag. This flag is present to speed up processing of HTTP requests by only looking at the

first request, but since HTTPS has a lot of overhead associated with it anyway, turning this flag off does not

reduce HTTPS performance. Furthermore, having this flag on for HTTPS clusters causes some

applications to not function as needed.

In general, it is recommended to turn the once only flag off for HTTPS clusters. In order to inject custom headers

and rewrite headers in every transaction in a connection, turning off once only is required.

HTTPS Performance and Xcel SSL Acceleration

The E650GX and E450GX include the Xcel SSL Accelerator Card. Equalizer models without Xcel (E250GX and

E350GX) performs all SSL processing in software using the system CPU. Equalizers with Xcel perform all SSL

processing using the dedicated processor on the Xcel card. This allows the system CPU to concentrate on non-

SSL traffic. For most applications, Xcel will process several hundred HTTPS transactions per second with no

noticeable degradation in performance either for the HTTPS cluster or for Equalizer as a whole.

In terms of bulk data throughput, the theoretical maximum throughput for Xcel/HTTPS is roughly 50% of that for

the Equalizer in HTTP mode: Equalizer models with gigabit Ethernet can move HTTP traffic at wire speed

(1Gbit/s) for large transfers, while Xcel can encrypt only approximately 400Mbit/s with 3DES/SHA1 or 600Mbit/s

with RC4/MD5. This reflects the fact that Xcel is primarily a transaction accelerator, not a bulk data encryption

device. It is noteworthy, however, that even when moving bulk data at 600Mbit/s, Xcel removes the entire load of

HTTPS/SSL processing from the server pool in the cluster.

One final issue to be aware of is that Xcel supports only 3DES and RC4 encryption; it does not support AES. It

also does not support SSL or TLS cipher suites that use ephemeral or anonymous Diffie-Hellman exchange (cipher

suites whose names contain "EDH", "DHE", or "ADH").

The default configuration for HTTPS clusters created with Xcel enabled will not use the modes described above.

If, however, one either modifies the cluster’s cipher suite string to use them, it is possible that they may be

negotiated with clients. This will not lead to incorrect operation of the system, but encryption for these cipher

suites will occur in software instead of taking advantage of the improved performance provided by the Xcel

hardware.

HTTPS Header Injection

309

Equalizer Administration Guide

1 2 ... 304 305 306 307 308 309 310 311 312 313 314 ... 593 594

Sin comentarios

Coyote Point Systems Equalizer Especificaciones Pagina 309