Converged Application Server and Radware AppDirector Solution Guide

Transcription

1 Converged Application Server and Radware AppDirector Solution Guide Products: SDPVendor Converged Application Server Radware AppDirector running APSOLUTE OS build Radware, Ltd. All Rights Reserved. Radware and all other Radware product and service names are registered trademarks or trademarks of Radware in the U.S. and other countries. All other trademarks and names are the property of their respective owners. 1

2 Table of Contents SDPVendor Converged Application Server...3 Radware AppDirector Overview...4 Radware AppDirector SIP Support Overview...5 Security... 6 SDPVendor Converged Application Server and Radware AppDirector Subsystem Architecture...6 Functional Overview... 7 AppDirector Configuration... 7 Overview... 7 Initial AppDirector Configuration... 7 Farm Configuration... 9 Create Layer 4 Policy Configure L7 Persistency Adding Servers to the Farm Outbound SIP Support Configuration Server NAT Configuration Health Monitoring Configuration AppDirector Redundancy Topology General Redundant Configuration Notes Primary AppDirector VRRP Redundancy Configuration Backup AppDirector Configuration Setting up basic IP connectivity on the Backup AppDirector Auto Generating the Backup Configuration from the Primary AppDirector Backup Configuration File Updates Upload the Backup Configuration file to the device Appendix I Optional Configurations...35 Service Farm Configurations not Outlined in Step-by-Step Instructions Appendix II...44 AppDirector High Availability Design Configurations

3 SDPVendor Converged Application Server The SDPVendor Converged Application Server is a converged Service Delivery Platform (SDP) complete with a flexible Service Creation Environment (SCE) that helps you: Rapidly and cost-effectively create and launch IP, converged, fixed, mobile and interactive services with low ongoing operational costs Enhance your customers' user experience and increase retention and revenue with your own customized new services -- or choose from thesdpvendor portfolio of pre-built revenue generating services Simplify the service introduction process and minimize integration complexity with an open, standards-based, and future-proof SDP/SCE investment that is IMS-ready when you are Achieve service transparency, particularly for high-value customer segments, across TDM and IP domains A service delivery platform that is deployed globally among fixed, mobile, cable and MVNO operators, the SDPVendor Converged Application Server offers: Proven interoperability with multiple network elements in both pre-ims and IMS-compliant networks Web-based service provisioning and management A user-friendly service creation environment for quickly and easily creating new services, policies, and external interfaces Modular, pre-integrated components that can be deployed together or separately User control of service customization Patented fault detection and error recovery Flexible scalability up or down as your needs dictate Network-grade reliability and availability with high throughput and low latency The SDPVendor Converged Application Server integrates easily into a variety of existing network types and BSS/OSS environments using open interfaces, protocols, and APIs. For more information, please visit: 3

4 Diagram Converged Application Server Architecture Radware AppDirector Overview Radware s AppDirector is an intelligent application delivery controller (ADC) that provides scalability and application-level security for service infrastructure optimization, fault tolerance and redundancy. Radware combined its next-generation, OnDemand Switch multi-gigabit hardware platform with the powerful capabilities of the company s APSolute operating system classifier and flow management engine. The result AppDirector enables accelerated application performance; local and global server availability; and application security and infrastructure scalability for fast, reliable and secure delivery of applications over IP networks. AppDirector is powered by the innovative OnDemand Switch platform. OnDemand Switch, which has established a new price/performance standard in the industry, delivers breakthrough performance and superior scalability to meet evolving network and business requirements. Based on its on demand, pay-as-you-grow approach, no forklift upgrade is required even when new business requirements 4

5 arise. This helps companies guarantee short-term and long-term savings on CAPEX and OPEX for full investment protection. Radware s OnDemand Switch enables customers to pay for the exact capacity currently required, while allowing them to scale their ADC throughput capacity and add advanced application-aware services or application acceleration services on demand to meet new or changing application and infrastructure needs. And it does it without compromising on performance. AppDirector lets you get the most out of your service investments by maximizing the utilization of service infrastructure resources and enabling seamless consolidation and high scalability. AppDirector s throughput licensing options allows pay as you grow investment protection. Make your network adaptive and more responsive to your dynamic services and business needs with AppDirector s fully integrated traffic classification and flow management, health monitoring and failure bypassing, traffic redirection, bandwidth management, intrusion prevention and DoS protection. For more information, please visit: Radware AppDirector SIP Support Overview The AppDirector can be used to manage various SIP services over a single public IP address. AppDirector is able to differentiate traffic by the required SIP service and forward the traffic to the relevant SIP servers, logically represented in groups referred to as farms. This saves public IP addresses, and provides transparent scalability allowing the addition of more services to an existing SIP service IP address. The service differentiation also allows for individual farm logic for the Application Servers who represent the individual services. This is important because dispatch methods and persistency requirements can vary per Application and the AppDirector is flexible enough to manage differentiated service requirements with a single switching engine while delivering the most granular traffic distribution possible. The AppDirector constantly monitors the health of SIP servers using SIP Option requests. When a SIP server is detected to be down, based upon application responses, the AppDirector automatically switches to other available SIP servers. The AppDirector maintains persistency of SIP sessions, typically based on SIP Call ID. The AppDirector makes sure that all signaling packets of the same dialog are sent to the same SIP server. Since SIP is used for session signaling only and not for the actual media transfer, maintaining persistency allows SIP servers to see both session initiation and session termination. This is critical for SIP services, such as accounting and billing, which are based on session duration. There are also many stateful elements within an IMS ecosystem that require bi-directional persistency for signaling functionality. For this reason, the AppDirector is also learning the persistency identifier, which can be any SIP header field, in both directions to ensure traffic originated from the server is also persisted according to the session identifiers. 5

6 Security With the convergence of the voice and data networks, security of network infrastructure has become a key issue. Security is considered by network managers to be the main impediment for implementing VoIP, and other rich media application services i.e. SMS, OMS & IMS. Fearing that their voice servers could be potential targets for Distributed Denial of Service (DDoS) attacks. AppDirector s comprehensive security suite ensures that voice services are not compromised by DoS attacks or other exploits of the SIP protocol, allowing reliable and continuous delivery of VoIP and related mix media services. The unique combination of signature and behavioral based protection provides a no touch zero day protection solution that mitigates DDoS attacks while managing the high availability and scalability of the services protected. SDPVendor Converged Application Server and Radware AppDirector Subsystem Architecture Radware and SDPVendor performed exhaustive joint testing to ensure the best possible user experience while focusing on the Gateway and IP platform interfaces. The tests and defined configuration deliver a best of breed service creation and service delivery solution. The basic architecture is defined in Diagram 2.0 below: Diagram Converged Application Server and Radware Subsystem Architecture 6

7 Functional Overview When a User Agent (UA) request arrives at the AppDirector s Virtual IP Address (VIP), there is a decision made to understand the protocol making said request. Suggesting that there could be requests made via several signaling protocols. Once the request is properly classified into a logical group of servers, known as a farm, persistency entries are evaluated to ensure dialog stateful forwarding. For SIP, this persistency identifier is the call-id, learned bi-directionally. For an HTTP web service, this could be an XML tag within the body of an HTTP message. Assuming a persistency table entry match occurs, the routing is retained according to the previously made load balancing decision and recorded state entry. Assuming that a state entry is not present, suggesting it is a first request for a given dialog, the request should be routed according to the load balancing algorithm defined for the specific server farm. Once this initial dispatch decision is made, the persistency identifier is recorded and mapped appropriately in the persistency table. Within a farm, every server has two interfaces. These interfaces are used in an active-active manner and state entries held to one interface will be preserved at the time of a failure to the alternative interface. No source address translations are made in this design which means the original client IPs can be seen at the servers. AppDirector Configuration Overview This document details the step by step AppDirector configuration via the Web Based Management GUI needed to create the Application Server ecosystem. The following steps should be done in order due to configuration dependencies, e.g. a Farm has to be created before Servers can be added to it. If desired parameters are not found, then either a required configuration step was not first performed or the page has to be refreshed. Please reference Diagram 2, page 6, for IP addressing and connectivity information. Initial AppDirector Configuration Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None 7

8 Stop Bits: 1 Flow Control: None 1. Assign the following IP address to interface 2 of the AppDirector Interface 2 IP address /27 applied with the following command: net ip-interface create Create a default gateway route entry on the AppDirector pointing to : net route table create i 2 3. Assign the following IP address to interfaces 1 and 5 of the AppDirector Interface 1 IP address /27 applied with the following command: net ip-interface create f disable Interface 5 IP address /27 applied with the following command: net ip-interface create f disable 4. Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware. Failure to establish a connection may be due to the following: Incorrect IP Address in the browser Incorrect IP Address or default route configuration in the AppDirector Failure to enable Web Based Management or Secure Web Based Management in the AppDirector If the AppDirector can be successfully pinged, attempt to connect to it via Telnet or SSH. If the pinging or the Telnet/SSH connection are unsuccessful, reconnect to the AppDirector via its console port. Once connected, verify and correct the AppDirector s configuration as needed. 1 1 To enable web-based management from the console command line interface, use manage web status set enable 8

9 Farm Configuration 1. From the menu, select AppDirector Farms Farm Table to display the Farm Table page similar to the one shown below: Note: This configuration section will only show steps for SIP and HTTP service farm definitions. Appendix II will contain additional service configuration details for services like Admin Console, GDI and AppXcel (for SSL offloading). Appendix I will contain the complete configurations for all services including SIP and HTTP. 2. Click the Create button. 3. On the Farm Table Create page, enter the necessary parameters as shown below: 2 4. Click the Set button to save parameters. 5. From the Farm Table page, click the Create button. 2 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings. 9

10 6. On the Farm Table Create page, enter the necessary parameters as shown below: 7. Click the Set button to save parameters. 8. Verify that the new entry was created on the Farm Table page: 9. Click the Extended Farm Parameters URI at the top of the Farm Table page. 10. On the Extended Farm Parameters Table page, click on the Farm Name HTTP_FARM. 11. On the Extended Farm Parameters Update page, enter the necessary parameters as shown below: 10

11 12. Click the Set button to save parameters. Create Layer 4 Policy 1. From the menu, select AppDirector Layer 4 Farm Selection Layer 4 Policy Table to display the Layer 4 Policy Table page similar to the one shown below: 2. Click the Create button. 3. On the Layer 4 Policy Table Create page, enter the necessary parameters as shown below. 11

12 4. Click the Set button to save the parameters. 5. On the Layer 4 Policy Table page, click the Create button. 6. On the Layer 4 Policy Table Create page, enter the necessary parameters as shown below. 7. Click the Set button to save the parameters. 8. On the Layer 4 Policy Table page, click the Create button. 9. On the Layer 4 Policy Table Create page, enter the necessary parameters as shown below. 12

13 10. Click the Set button to save the parameters. 11. Verify that the new entry was created on the Layer 4 Policy Table page: Configure L7 Persistency 1. From the menu, select AppDirector L7 Server Persistency Text Match to display the Text Match Session ID Persistency page similar to the one shown 2. Click the Create button. 3. On the Text Match Session ID Persistency Create page, enter the necessary parameters as shown below. 13

14 4. Click the Set button to save parameters. 5. On the Text Match Session ID Persistency page, click the Create button. 6. On the Text Match Session ID Persistency Create page, enter the necessary parameters as shown below. Note: This step is optional and only required for support of HTTP persistency for a given service. Note: Persistency Identifier value = <ns3:callingparty><value> This value could be different per HTTP service and therefore the application specific persistency identifier should be known via SDPVendor. Instructions for adding a second HTTP service can be found in Appendix II. 7. Click the Set button to save parameters. 14

15 8. Verify that the new entry was created on the Text Match Session ID Persistency page: Adding Servers to the Farm 1. From the menu, select AppDirector Servers Application Servers to display the Server Table page similar to the one shown below: 2. On the Server Table Create page, enter the necessary parameters as shown below: 15

16 3. Click the Set button to save parameters. 4. On the Server Table page, click the Create button to configure another server. 5. Create the second server using the information below: 6. Click the Set button to save parameters. 7. On the Server Table page, click the Create button to configure another server. 8. Create the third server using the information below: 9. Click the Set button to save parameters. 10. On the Server Table page, click the Create button to configure another server. 11. Create the forth server using the information below: 16

17 12. Click the Set button to save parameters. 13. The HTTP_FARM Servers can be added like the SIP_Farm Servers above. The Farm Name will change to reflect the correct HTTP_FARM. The Command Line interface (CLI) definitions are alao provided here for your reference: appdirector farm server table create HTTP_FARM None -sn OSP3_NIC1 -ba appdirector farm server table create HTTP_FARM None -sn OSP5_NIC1 -ba appdirector farm server table create HTTP_FARM None -sn OSP5_NIC2 -ba appdirector farm server table create HTTP_FARM None -sn OSP3_NIC2 -ba Verify the entries were created on the Server Table page. 17

18 Outbound SIP Support Configuration 1. From the menu, select AppDirector Global Tweaks to display the Tweaks page. 2. On the Tweaks page, change the parameters as shown below: Note: This value is necessary for dynamic session ID learning of SIP outbound server initiated requests (i.e. B2BUA support). 3. Click the Set button to save parameters. Server NAT Configuration 1. From the menu, select AppDirector NAT Server NAT to display the Global Parameters page. 2. On the Global Parameters page, change the parameters as shown below: Note: This configuration ensures server initiated requests source IP addresses are translated to the VIP towards an external system. 3. Click the Set button to save parameters. 18

19 Health Monitoring Configuration 1. From the menu, select Health Monitoring Global Parameters to display the Health Monitoring Global Parameters page. 2. On the Health Monitoring Global Parameters page, change the parameters as shown below: Note: The Health Monitoring Status is the only applicable setting in this configuration. 3. Click the Set button to save parameters. 4. Create the Health Monitoring Check for the First Server. 5. From the menu, select Health Monitoring Check Table to display the Health Monitoring Check Table page similar to the one shown below: 6. Click the Create button. 7. On the HM Check Table Create page, enter the necessary parameters as shown below: 19

20 8. Before clicking the Set button, choose the button next to Arguments to populate the specific settings for the rest of this check. 9. Enter the information below: Request: From: 10. Click the Set button for the Method Arguments and click the Set button again in the HM Check Table Create window. 11. Create the Health Monitoring Check for the Second Server. 12. If the Health Monitoring Check Table page is not already displayed from the previous step, select Health Monitoring Check Table from the menu. 20

21 13. Click the Create button. 14. On the HM Check Table Create page, enter the necessary parameters as shown below: Note: The Ping method check should be replaced by a HTTP check when deploying with a valid HTTP application. 15. Click the Set button to save the Health Check. 16. The OSP3_NIC1 Health Checks have been added above. One can either repeat steps 10 to 20 for the other three server interfaces or use the following Command Line interface (CLI) definitions to cut and paste into the AppDirector: OSP3_NIC1 Previously Configured SIP - Check health-monitoring check create OSP3_NIC1_SIP -id 9 -m 19 -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d Port Check health-monitoring check create OSP3_NIC1_8180 -id 4 -p i 15 -r 2 -t 3 -d OSP3_NIC2 SIP - Check health-monitoring check create OSP3_NIC2_SIP -id 10 -m 19 -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d Port Check health-monitoring check create OSP3_NIC2_8180 -id 5 -p i 15 -r 2 -t 3 -d OSP5_NIC1 SIP - Check health-monitoring check create OSP5_NIC1_SIP -id 1 -m 19 -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d Port Check health-monitoring check create OSP5_NIC1_8180 -id 6 -p i 15 -r 2 -t 3 -d OSP5_NIC2 SIP - Check health-monitoring check create OSP5_NIC2_SIP -id 7 -m 19 -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d Port Check health-monitoring check create OSP5_NIC2_8180 -id 8 -p i 15 -r 2 -t 3 -d

22 17. Verify that the new entry was created on the Health Monitoring Check Table page: 18. Binding Health Checks to Servers. 19. Create the Health Monitoring Binding for the First Server. 20. From the menu, select Health Monitoring Binding Table to display the Health Monitoring Binding Table page similar to the one shown below: 21. Click the Create button. 22. On the HM Binding Table Create page, enter the necessary parameters as shown below: 22

23 23. Click the Set button to save parameters. 24. Create the Health Monitoring Binding for the Second Server. 25. If the Health Monitoring Binding Table page is not already displayed from the previous step, select Health Monitoring Binding Table from the menu. 26. Click the Create button. 27. On the HM Binding Table Create page, enter the necessary parameters as shown below: 28. Click the Set button to save parameters. 29. The OSP3_NIC1 Health Check Bindings have been added above. One can either repeat steps 27 to 33 for the other three server interfaces or use the following Command Line interface (CLI) definitions to cut and paste into the AppDirector: OSP3_NIC1 Previously Configured SIP - binding health-monitoring binding create 9 1 Port binding health-monitoring binding create 4 2 OSP3_NIC2 SIP - binding health-monitoring binding create Port binding health-monitoring binding create 5 13 OSP5_NIC1 SIP - binding health-monitoring binding create 1 4 Port binding health-monitoring binding create

24 OSP5_NIC2 SIP - binding health-monitoring binding create 7 7 Port binding health-monitoring binding create Verify that the new entry was created on the Health Monitoring Binding Table page: Note: There were more bindings than could be displayed on a single page. This completes the AppDirector Policy Configuration. 24

25 AppDirector Redundancy Topology For complete high-availability, Radware encourages implementing pairs of AppDirector units in an Active / Backup configuration. If your implementation of this architecture includes only a single AppDirector, then it is unnecessary to follow the steps in this section. The following diagram provides details of such an architecture based on the same test environment: Diagram 4.0 Logical Redundancy Topology General Redundant Configuration Notes The overall configuration of a backup AppDirector is almost identical in many ways to that of the active device. There are, however, important differences that are noted throughout the following steps. Radware offers two means of redundancy and failover between pairs of devices Proprietary and VRRP. Since VRRP is a more commonly used method within the industry, this section will cover the steps to configure both AppDirectors using that method. 3 3 For a detailed discussion of VRRP, see RFC

26 There are separate configuration steps to be taken on both the Active and Backup AppDirector devices, and this section is divided into two parts one for the active device and one for the backup device. Primary AppDirector VRRP Redundancy Configuration 1. From the web-based management (WBM) screen, go to AppDirector Redundancy Global Configuration and set the parameters as noted below: 2. Click the Set button to save these changes. 3. Go to AppDirector Redundancy VRRP Virtual Routers and create a new entry. 4. Click the Set button to save the parameters. 5. Go to AppDirector Redundancy VRRP Associated IP Addresses and create a new entry: 26

27 6. Click the Set button to save the parameters. Note: This address is that of the Active AppDirector s physical interface. It is also the default gateway setting on the servers on the first switch segment. 7. Go to AppDirector Redundancy VRRP Virtual Routers and create a new entry. 8. Click the Set button to save the parameters. 9. Go to AppDirector Redundancy VRRP Associated IP Addresses and create a new entry: 10. Click the Set button to save the parameters. Note: This address is that of the Active AppDirector s physical interface. It is also the default gateway setting on the servers on the second switch segment. 11. Go to AppDirector Redundancy VRRP Virtual Routers and create a new entry. 27

28 12. Click the Set button to save the parameters. 13. Go to AppDirector Redundancy VRRP Associated IP Addresses and create a new entry: 14. Click the Set button to save the parameters. Note: This address is that of the Active AppDirector s physical interface. This is the network facing segment. In the next steps the VIP will also be bound to the network facing VR. 15. Create a second entry in the Associated IP Addresses table: Note: This is the Virtual IP Address used for both SIP and HTTP service Farms. 16. Click the Set button to save the parameters. 17. When complete, you should have two entries in the Associated IP Addresses window: 28

29 18. Go to AppDirector Redundancy Mirroring Active Device Parameters to make the following changes: 19. Click the Set button to save the parameters. 20. Go to AppDirector Redundancy Mirroring Mirror Device Parameters to make the following changes: Note: This IP value defines the network target for mirroring updates to the backup device. 21. Click the Set button to save the parameters. 22. Go to AppDirector Redundancy VRRP Virtual Routers and click on the VRID s Up/Down drop down menu, selecting All Up. 29

30 23. Click the Set button to save the parameters. 24. Go to AppDirector Redundancy VRRP Virtual Routers to verify Master status: This completes VRRP redundancy configuration on the Primary AppDirector. 30

31 Backup AppDirector Configuration Setting up basic IP connectivity on the Backup AppDirector 1. Using a serial cable, connect to the backup AppDirector with a terminal emulation program. The settings for the connection should be: Bits per Second: Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None 2. Assign the following IP address to interface 2 of the AppDirector Interface 2 IP address /27 applied with the following command: net ip-interface create Create a default gateway route entry on the AppDirector pointing to : net route table create i 2 4. Connect to the management IP address of the backup device using a browser. The default username and password is radware. Auto Generating the Backup Configuration from the Primary AppDirector 1. From the web interface menu of the Primary AppDirector, select File Configuration Receive from Device to display the Configuration File Download page similar to the one shown below: 2. Click the Set button to launch save file window. 31

32 3. Click the OK button to save the file to a local directory. Backup Configuration File Updates 1. Open the Downloaded File in a text editor, like Notepad. 2. There are three modifications required for easy upload of the backup configuration. A. The IP Interface information, because the primary is not aware of the specific addresses used for the backup device we should update the defined values. See Diagram 4 on page 25 for Backup IP assignments. From the download file, prior to any modification: net ip-interface create f disable net ip-interface create f disable net ip-interface create After defined modification: net ip-interface create f disable net ip-interface create f disable net ip-interface create B. The VRRP Virtual Router (VR) Priorities and Local Interface Definitions per VR: From the download file, prior to any modification: redundancy vrrp virtual-routers create 1 2 -as up -p 255 -pip pm False redundancy vrrp virtual-routers create 5 3 -as up -p 255 -pip pm False redundancy vrrp virtual-routers create 2 4 -as up -p 255 -pip pm False After defined modification: 32

33 redundancy vrrp virtual-routers create 1 2 -as up -pip pm False redundancy vrrp virtual-routers create 5 3 -as up -pip pm False redundancy vrrp virtual-routers create 2 4 -as up -pip pm False Note: The -p 255 defines the highest priority value for the primary device. By removing this switch value entirely for the backup configuration, the device will assign the default priority value of 100. C. The Mirroring and Mirroring Interface Definition: From the download file, prior to any modification: redundancy mirror address setcreate After defined modification: redundancy mirror address setcreate redundancy mirror backup status set enable Note: This IP value defines the network target for mirroring updates to the primary device. 3. Save the changes made to the Download File. Upload the Backup Configuration file to the device 1. From the web interface menu of the Backup AppDirector, select File Configuration Send to Device to display the Configuration File Upload page similar to the one shown below: 4. On the Configuration File Upload page, choose the necessary parameters as shown below: 4 4 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings. 33

34 Note: Clicking the Browse button and navigate to the updated configuration file. 4. Click the Set button to upload the configuration. 5. Click the Set button for the new configuration to be installed on reboot. This concludes the configuration of both AppDirectors. Please note that there are additional configuration information in Appendix I and II. Appendix I breaks down the additional service configurations steps which can be applied separately if desired. It will also cover the configuration evolution required to add new HTTP services. All of the configurations outlined are optional. Appendix II displays the full configuration from the Primary and Backup AppDirector including optional configurations. 34

35 Appendix I Optional Configurations Service Farm Configurations not Outlined in Step-by-Step Instructions AppDirector Configuration Admin Console Farm appdirector farm table setcreate OSP3_HTTP_ADMIN_CONSOLE -as Enabled -at 300 -dm Cyclic appdirector farm table setcreate OSP5_HTTP_ADMIN_CONSOLE -as Enabled -at 300 -dm Cyclic Servers appdirector farm server table create OSP3_HTTP_ADMIN_CONSOLE sn OSP3_nic1 -id 14 appdirector farm server table create OSP3_HTTP_ADMIN_CONSOLE sn OSP3_nic2 -id 15 appdirector farm server table create OSP5_HTTP_ADMIN_CONSOLE sn OSP5_nic1 -id 16 appdirector farm server table create OSP5_HTTP_ADMIN_CONSOLE sn OSP5_nic2 -id 17 Layer4Policies appdirector l4-policy table create TCP OSP3_admin_console fn \ OSP3_HTTP_ADMIN_CONSOLE -ta HTTP appdirector l4-policy table create TCP OSP5_admin_console -fn \ OSP5_HTTP_ADMIN_CONSOLE -ta HTTP AppDirector Configuration GDI Farm appdirector farm table setcreate GDI_Farm_OSP3 -as Enabled -at 600 -dm Cyclic appdirector farm table setcreate GDI_Farm_OSP5 -as Enabled -at 600 -dm Cyclic Servers appdirector farm server table create GDI_Farm_OSP sn OSP3 -id 3 appdirector farm server table create GDI_Farm_OSP sn OSP5 -id 5 L4Policies appdirector l4-policy table create TCP Telnet_ OSP3 -fn GDI_Farm_sip3 appdirector l4-policy table create TCP GDI_L4_Traffic_ OSP3 -fn GDI_Farm_ OSP3 appdirector l4-policy table create TCP Telnet_ OSP5 -fn GDI_Farm_ OSP5 appdirector l4-policy table create TCP GDI_L4_Traffic_ OSP5 -fn GDI_Farm_ OSP5 appdirector l4-policy table create TCP FTP_ OSP3 -fn GDI_Farm_ OSP3 -ta "FTP Control" appdirector l4-policy table create TCP FTP_ OSP5 -fn GDI_Farm_ OSP5 -ta "FTP Control" AppDirector Configuration AppXcel Interface net ip-interface create Farm appdirector farm table setcreate app_xcel_farm -as Enabled -dm Cyclic Servers appdirector farm server table create app_xcel_farm sn app_xcel1 -id 9 appdirector farm server table create app_xcel_farm sn app_xcel2 -id 10 appdirector farm server table create app_xcel_farm sn app_xcel3 -id 11 L4Policies appdirector l4-policy table create TCP app_xcel -fn app_xcel_farm VRRP redundancy vrrp virtual-routers create 2 1 -as up -p 255 -pip pm false redundancy vrrp associated-ip create AppXcel Configuration appxcel mode set proxy net management-ip create net route table create defaultgw appxcel key table create appxcel certificate table create 1 appxcel tunnel table create 1 -i p 6080 h r 6060 k 1 -s HTTP -l 1 t off Usage : appxcel tunnel table create <tunnelid> [-i <interface IP> <netmask>] -p <listening port> -h <remote IP> -r <remote port> [-u <hostname>] 35

36 [-c <gzip deflate>] [-z <sw hw off> [<gzip level>]] [-d <gzip threshold>] [-g <on off>] [-e <on off> [<http rewrite port>]] [-E [<http rewrite URL none>]] [-k <KeyID none>] [-R <on off> [<https redirect url>]] [-s <http other smtp ftp active-ftp-data>] [-K <on default off> [<keep-alive timeout(sec)>]] [-t <on off>] [-T <client timeout(sec)> <backend timeout(sec)>] [-f <farm address for triangulation>] [-l <Lan1 Lan2>] [-m <on off> [<multiplexing timeout>]] [-P <explicit implicit>] [-F <front end FTPS IP>] [-D <on off>] [-C <control channel timeout(sec)> <data channel timeout(sec)>] [-G <IP none>] [-H <depth>] [-Q <on off>] [-U <redirect URL none>] Note: The only configuration difference if configuring additional AppXcels (AX) would be the management IP Address and the Tunnel Interface address. Everything else is identical per AX configuration. When cabling the AX, simply connect LAN1 to the Network facing Layer 2 VLAN already available for SIP and HTTP service connectivity. The AD and AX will communicate over a x/24 network locally significant between the two systems. AppDirector Configuration Additional HTTP Services Farm Configuration 1. From the menu, select AppDirector Farms Farm Table to display the Farm Table page. 2. Click the Create button. 3. From the Farm Table page, click the Create button. 4. On the Farm Table Create page, enter the necessary parameters as shown below: Note: This Farm Name was chosen to match a second HTTP service used for validation. Please assign a logical name which properly represents the service addition in question. 5. Click the Set button to save parameters. 36

37 6. Click the Extended Farm Parameters URI at the top of the Farm Table page. 7. On the Extended Farm Parameters Table page, click on the Farm Name HTTP_FARM. 8. On the Extended Farm Parameters Update page, enter the necessary parameters as shown below: 9. Click the Set button to save parameters. Create Layer 7 Policy 1. From the menu, select AppDirector Layer 7 Farm Selection Methods Table to display the Method Table page similar to the one shown below: 2. Click the Create button. 3. On the Method Table Create page, enter the necessary parameters as shown below. 37

38 Note: This argument classifies HTTP requests by URL. Introduced for the first time here, L7 policies are necessary to differentiate HTTP requests by URL to ensure unique persistency handling per HTTP service type. Because all HTTP service traffic requiring L7 persistency is destined for port 8180, the only way to properly differentiate such request is by URL. This value is a specific value for the new service. The second policy will be a default policy to drive traffic into the existing farms previously defined in the baseline configuration. 4. Before clicking the Set button, choose the button next to Arguments to populate the specific settings for the rest of this check. 5. Enter the information below: 6. Click the Set button to save the parameters. 7. Click the Set button on the Method Table Create page to save the parameters. 8. On the Method Table Create page, enter the necessary parameters as shown below. 9. Before clicking the Set button, choose the button next to Arguments to populate the specific settings for the rest of this check. 10. Enter the information below: 38

39 11. Click the Set button to save the parameters. 12. Click the Set button on the Method Table Create page to save the parameters. 13. From the menu, select AppDirector Layer 7 Farm Selection Policies to display the Layer 7 Policy Table page similar to the one shown below: 14. Click the Create button. 15. On the Layer 7 Modification Table Create page, enter the necessary parameters as shown below. 16. Before clicking the Set button, choose the button next to Arguments to populate the specific settings for the rest of this check. 17. Enter the information below: 39

40 18. Click the Set button to save the parameters. 19. Click the Set on the Layer 7 Policy Table button to save the parameters. 20. On the Layer 7 Modification Table Create page, enter the necessary parameters as shown below. 21. Before clicking the Set button, choose the button next to Arguments to populate the specific settings for the rest of this check. 22. Enter the information below: 23. Click the Set button to save the parameters. 24. Click the Set on the Layer 7 Policy Table button to save the parameters. Create Layer 4 Policy 1. From the menu, select AppDirector Layer 4 Farm Selection Layer 4 Policy Table to display the Layer 4 Policy Table page similar to the one shown below: 40

41 2. Click on the Virtual IP button for the desired Layer 4 entry which will be used to add the new HTTP service. 3. On the Layer 4 Policy Table Update page, change the necessary parameters as shown below. Note: This update will enable the L7 policies previously defined and raise the request parsing to the L7 URL. Once a match is made on the L7 policies a farm is defined and the appropriate farm level L7 persistency will be honored. The new L7 persistency definition will be made in the next section Configure L7 Persistency. 4. Click the Set button to save the parameters. 41

42 Configure L7 Persistency 1. From the menu, select AppDirector L7 Server Persistency Text Match to display the Text Match Session ID Persistency page similar to the one shown 2. Click the Create button. On the Text Match Session ID Persistency Create page, enter the necessary parameters as shown below. Note: Persistency Identifier value = <ns3:egress> This value could be different per HTTP service and therefore the application specific persistency identifier should be known via SDPVendor. 3. Click the Set button to save parameters. Adding Servers to the Farm 1. From the menu, select AppDirector Servers Application Servers to display the Server Table page. 2. On the Server Table Create page, click Create to add new and/or existing server to the new HTTP service farm. Note: Please reference page 22, step 20, for specific instructions on how to define the health check bindings via the web interface. The Command Line interface (CLI) definitions are defined as follows: appdirector farm server table create 3PCC_V2_FARM None sn OSP3_nic1 -id 18 -ba appdirector farm server table create 3PCC_V2_FARM None sn OSP5_nic1 -id 19 -ba appdirector farm server table create 3PCC_V2_FARM None -sn OSP5_nic2 -id 20 -ba appdirector farm server table create 3PCC_V2_FARM None -sn OSP3_nic2 -id 21 -ba

43 Binding Health Checks for the New Service Farm Servers 1. From the menu, select Health Monitoring Binding Table to display the Health Monitoring Binding Table page. Note: Please reference page 22, step 20, to define the bindings via the web interface. 2. The Command Line interface (CLI) definitions are defined as follows: health-monitoring binding create 4 18 health-monitoring binding create 5 21 health-monitoring binding create 6 19 health-monitoring binding create 8 20 Note: Existing health checks (HC) for HTTP service 8180 were used and bound to the new Service farm server definitions. If each service has a unique URI that defines the service availability, it would be best practice to define this unique HTTP request for optimal HC service awareness. 43

44 Appendix II AppDirector High Availability Design Configurations Primary AppDirector Configuration Device Configuration Date: :47:03 DeviceDescription: AppDirector with Cookie Persistency Base MAC Address: 00:03:b2:2e:a4:00 Software Version: DL (Build date Feb , 15:15:22,Build#14) APSolute OS Version: A(9): The following commands will take effect only once the device has been rebooted system tune bridge-fft-table set 1024 system tune ip-fft-table set system tune arp-table set 1024 system tune client-table set system tune routing-table set 512 system tune url-table set 256 system tune request-table set 200 system tune nat-address-table set 1 system tune nat-ports-table set system tune session-id-table set system tune l3-client-table-size set 20 system tune outbound-nat-address set 0 system tune outbound-nat-ports set system tune outbound-intrcpt-tbl set 0 system tune radius-attribute-table set 1 system tune segments set 15 manage snmp versions-after-reset set "v1 & v2c & v3" system tune session-pasv-protocols set 16 system tune session set 512 system tune session-resets set 100 The following commands take effect immediately upon execution health-monitoring check create OSP5_NIC1_SIP -id 1 -m "SIP UDP" -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d health-monitoring check create OSP3_NIC2_8180 -id 5 -p i 15 -r 2 -t 3 -d health-monitoring check create OSP5_NIC1_8180 -id 6 -p i 15 -r 2 -t 3 -d health-monitoring check create OSP5_NIC2_SIP -id 7 -m "SIP UDP" -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d health-monitoring check create OSP5_NIC2_8180 -id 8 -p i 15 -r 2 -t 3 -d health-monitoring check create OSP3_NIC1_SIP -id 9 -m "SIP UDP" -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d health-monitoring check create OSP3_NIC2_SIP -id 10 -m "SIP UDP" -p a \ URI=sas@ FROM=appdirector@ FRWD=0 C1=200 -i 15 -r 2 -t 3 -d health-monitoring check create OSP3_NIC1_8180 -id 4 -p i 15 -r 2 -t 3 -d net ip-interface create f disable net ip-interface create f disable net ip-interface create net ip-interface create net route table create i 2 redundancy mode set VRRP appdirector farm table setcreate SIP_Farm -as Enabled -at 45 -dm Cyclic -cm "No Checks" -sm ServerPerSession appdirector farm table setcreate HTTP_FARM -as Enabled -at 20 -dm Cyclic -cm "No Checks" -sm ServerPerSession Start of Optional configuration farms appdirector farm table setcreate GDI_Farm_OSP3 -as Enabled -at 600 -dm Cyclic appdirector farm table setcreate GDI_Farm_OSP5 -as Enabled -at 600 -dm Cyclic 44

45 appdirector farm table setcreate app_xcel_farm -as Enabled -dm Cyclic appdirector farm table setcreate OSP3_HTTP_ADMIN_CONSOLE -as Enabled -at 300 -dm Cyclic appdirector farm table setcreate OSP5_HTTP_ADMIN_CONSOLE -as Enabled -at 300 -dm Cyclic appdirector farm table setcreate 3PCC_V2_FARM -as Enabled -at 20 -dm Cyclic -cm "No Checks" -sm ServerPerSession End of Optional configuration farms appdirector farm server table create SIP_Farm None -sn OSP3_NIC1 -id 1 -ba appdirector farm server table create HTTP_FARM None -sn OSP3_NIC1 -id 2 -ba appdirector farm server table create SIP_Farm None -sn OSP5_NIC1 -id 4 -ba appdirector farm server table create HTTP_FARM None -sn OSP5_NIC1 -id 6 -ba appdirector farm server table create SIP_Farm None -sn OSP5_NIC2 -id 7 -ba appdirector farm server table create HTTP_FARM None -sn OSP5_NIC2 -id 8 -ba appdirector farm server table create SIP_Farm None -sn OSP3_NIC2 -id 12 -ba appdirector farm server table create HTTP_FARM None -sn OSP3_NIC2 -id 13 -ba Start of Optional configuration Servers appdirector farm server table create GDI_Farm_OSP None -sn OSP3 -id 3 appdirector farm server table create GDI_Farm_OSP None -sn OSP5 -id 5 appdirector farm server table create app_xcel_farm None -sn app_xcel1 -id 9 appdirector farm server table create app_xcel_farm None -sn app_xcel2 -id 10 appdirector farm server table create app_xcel_farm None -sn app_xcel3 -id 11 appdirector farm server table create OSP3_HTTP_ADMIN_CONSOLE None -sn OSP3_nic1 -id 14 appdirector farm server table create OSP3_HTTP_ADMIN_CONSOLE None -sn OSP3_nic2 -id 15 appdirector farm server table create OSP5_HTTP_ADMIN_CONSOLE None -sn OSP5_nic1 -id 16 appdirector farm server table create OSP5_HTTP_ADMIN_CONSOLE None -sn OSP5_nic2 -id 17 appdirector farm server table create 3PCC_V2_FARM None -sn \ OSP3_nic1 -id 18 -ba appdirector farm server table create 3PCC_V2_FARM None -sn \ OSP5_nic1 -id 19 -ba appdirector farm server table create 3PCC_V2_FARM None -sn \ OSP5_nic2 -id 20 -ba appdirector farm server table create 3PCC_V2_FARM None -sn \ OSP3_nic2 -id 21 -ba End of Optional configuration servers Start of Optional configuration L7 policies required for additional HTTP services appdirector l7 farm-selection method-table setcreate 3PCC_V2_Service -cm \ URL -ma \ HN= :8180 P=/axis2/services/ThirdPartyCallService_v2_0 appdirector l7 farm-selection method-table setcreate OtherHTTP_Services \ -cm URL -ma HN= :8180 appdirector l7 farm-selection policy-table setcreate Web_Srvc_Selection 5 \ -m1 3PCC_V2_Service -pa PRSST=On -fn 3PCC_V2_FARM appdirector l7 farm-selection policy-table setcreate Web_Srvc_Selection\ 10 -m1 OtherHTTP_Services -pa PRSST=On -fn HTTP_FARM End of Optional configuration L7 policies required for additional HTTP services redundancy interface-group set enable appdirector nat server status set enable redundancy mirror main client-status set enable redundancy mirror address setcreate appdirector farm connectivity-check httpcode setcreate SIP_Farm\ "200 - OK" appdirector farm connectivity-check httpcode setcreate HTTP_FARM\ "200 - OK" appdirector farm connectivity-check httpcode setcreate GDI_Farm_sip3\ "200 - OK" appdirector farm connectivity-check httpcode setcreate GDI_Farm_sip5\ "200 - OK" appdirector farm connectivity-check httpcode setcreate app_xcel_farm\ "200 - OK" appdirector farm connectivity-check httpcode setcreate\ SIP3_HTTP_ADMIN_CONSOLE "200 - OK" appdirector farm connectivity-check httpcode setcreate\ 45

46 SIP5_HTTP_ADMIN_CONSOLE "200 - OK" appdirector farm connectivity-check httpcode setcreate 3PCC_V2_FARM\ "200 - OK" net next-hop-router setcreate id 0 -fl 0 appdirector farm nhr setcreate ip fl 0 appdirector farm extended-params set HTTP_FARM -st Enabled appdirector farm extended-params set 3PCC_V2_FARM -st Enabled redundancy backup-interface-group set enable system internal appdirector full-session-id-table setcreate SIP_Farm 0\ UDP -k Call-ID -l Header -t 480 -d "Both Directions" -fl 0 system internal appdirector full-session-id-table setcreate HTTP_FARM 8180\ TCP -k <ns3:callingparty><value> -l "Regular Expression" -c < -t 200 -d \ "Client Request" -fl 0 Start of Optional configuration L7 persistency required for additional HTTP services system internal appdirector full-session-id-table setcreate 3PCC_V2_FARM\ 8180 TCP -k <ns3:egress> -l "Regular Expression" -c < -t 200 -d \ "Client Request" -fl 0 End of Optional configuration L7 persistency required for additional HTTP services net vlan-tag-handling set Overwrite appdirector segmentation nhr-table setcreate DefaultNHR -ip \ fl appdirector l4-policy table create TCP \ HTTP_L4_8180_Farm -po Web_Srvc_Selection -ta HTTP -pc "Header and Body" \ -pm Maintain appdirector l4-policy table create UDP Any SIP_Traffic -fn SIP_Farm -ta SIP appdirector l4-policy table create TCP HTTP_L4_Traffic -fn HTTP_FARM -ta HTTP \ -pm Maintain Start of Optional configuration L4 policies required for additional services appdirector l4-policy table create TCP Telnet_OSP3 -fn GDI_Farm_sip3 appdirector l4-policy table create TCP GDI_L4_Traffic_OSP3 -fn GDI_Farm_OSP3 appdirector l4-policy table create TCP Telnet_OSP5 -fn GDI_Farm_OSP5 appdirector l4-policy table create TCP GDI_L4_Traffic_OSP5 -fn GDI_Farm_OSP5 appdirector l4-policy table create TCP FTP_OSP3 -fn GDI_Farm_OSP3 -ta "FTP Control" appdirector l4-policy table create TCP FTP_OSP5 -fn GDI_Farm_OSP5 -ta "FTP Control" appdirector l4-policy table create TCP app_xcel -fn app_xcel_farm appdirector l4-policy table create TCP OSP3_admin_console -fn \ OSP3_HTTP_ADMIN_CONSOLE -ta HTTP appdirector l4-policy table create TCP OSP5_admin_console -fn \ OSP5_HTTP_ADMIN_CONSOLE -ta HTTP End of Optional configuration L4 policies required for additional services appdirector farm redirection set SIP5_HTTP_ADMIN_CONSOLE -rn Disabled appdirector farm redirection set SIP3_HTTP_ADMIN_CONSOLE -rn Disabled appdirector farm redirection set app_xcel_farm -rn Disabled appdirector farm redirection set GDI_Farm_sip5 -rn Disabled appdirector farm redirection set GDI_Farm_sip3 -rn Disabled appdirector farm redirection set HTTP_FARM -rn Disabled appdirector farm redirection set SIP_Farm -rn Disabled redundancy mirror main sid-status set enable appdirector global outboundsipsupport set Enabled health-monitoring binding create 1 4 health-monitoring binding create 4 2 health-monitoring binding create 5 13 health-monitoring binding create 6 6 health-monitoring binding create 8 8 health-monitoring binding create health-monitoring binding create 9 1 health-monitoring binding create 7 7 Start of Optional configuration server health check bindings required for additional services health-monitoring binding create 4 18 health-monitoring binding create