Load Balancing Fujifilm SYNAPSE. Deployment Guide v Copyright Loadbalancer.org

Transcription

1 Load Balancing Fujifilm SYNAPSE Deployment Guide v0.1 Copyright Loadbalancer.org

2 Table of Contents About this Guide...4 Loadbalancer.org Appliances Supported...4 Loadbalancer.org Software Versions Supported...4 Fujifilm SYNAPSE Software Versions Supported...4 Fujifilm SYNAPSE...5 Load Balancing Fujifilm SYNAPSE...5 Persistence (aka Server Affinity)... 5 Virtual Service (VIP) Requirements... 5 Port Requirements... 5 TLS/SSL Termination... 6 Health Checks... 6 Server Feedback Agent Deployment Concept Loadbalancer.org Appliance the Basics...7 Virtual Appliance Download & Deployment... 7 Initial Network Configuration... 7 Accessing the Web User Interface (WebUI)... 8 HA Clustered Pair Configuration Appliance Configuration for Fujifilm SYNAPSE...10 Configuring VIP 1 HTTP Virtual Service Configuring the Virtual Service (VIP) Defining the Real Servers (RIPs) Configuring VIP 2 DICOM Virtual Service Configuring the Virtual Service (VIP) Defining the Real Servers (RIPs) Configuring VIP 3 External Virtual Service (HTTPS)...12 Configuring the Virtual Service (VIP) Defining the Real Servers (RIPs) Finalizing the Configuration TLS/SSL Termination Options for External VIP TLS/SSL Termination on the SYNAPSE Servers (aka SSL Pass-through) TLS/SSL Termination on the Load Balancer (aka SSL Offloading) TLS/SSL Termination on the Load Balancer with Re-encryption to the Servers (aka SSL Bridging) Testing & Verification...19 Using System Overview Technical Support...19 Further Documentation...19 Conclusion...20 Appendix...21 Server Feedback Agent Windows Agent Download Starting the Agent... 22

3 Configuration Clustered Pair Configuration Adding a Slave Unit Company Contact Information... 26

4 About this Guide About this Guide This guide details the steps required to configure a load balanced Fujifilm SYNAPSE environment utilizing Loadbalancer.org appliances. It covers the configuration of the load balancers and also any Fujifilm SYNAPSE configuration changes that are required to enable load balancing. For more information about initial appliance deployment, network configuration and using the Web User Interface (WebUI), please also refer to the relevant Administration Manual: v7 Administration Manual v8 Administration Manual 2. Loadbalancer.org Appliances Supported All our products can be used for load balancing Fujifilm SYNAPSE. The complete list of models is shown below: Discontinued Models Current Models * Enterprise R16 Enterprise R20 Enterprise VA R16 Enterprise MAX Enterprise VA Enterprise 10G Enterprise R320 Enterprise Ultra Enterprise VA R20 Enterprise VA MAX Enterprise AWS ** Enterprise AZURE ** * For full specifications of these models please refer to: ** Some features may not be supported, please check with Loadbalancer.org support 3. Loadbalancer.org Software Versions Supported V7.6.4 and later 4. Fujifilm SYNAPSE Software Versions Supported Fujifilm SYNAPSE all versions Page 4

5 Fujifilm SYNAPSE 5. Fujifilm SYNAPSE SYNAPSE is a Picture Archiving and Communication System (PACS) by Fujifilm. It allows the archiving and distribution of vast amounts of image information from all modalities, managing it all with a single system. The SYNAPSE system consists of the following servers: Database Server Windows Internet Information Server (IIS) Storage Server Digital Imaging and Communications in Medicine (DICOM) Server Hospital Information System (HIS) Server Loadbalancer.org facilitates the deployment of SYNAPSE servers in a cluster. By clustering servers behind a load balancer, guarantee zero downtime and greatest resource efficiency. This provides a cost-effective, highly available, and scalable SYNAPSE solution. 6. Load Balancing Fujifilm SYNAPSE It's highly recommended that you have a working Fujifilm SYNAPSE environment first before implementing the load balancer. PERSISTENCE (AKA SERVER AFFINITY) It is necessary to use persistence when load balancing connections to Fujifilm SYNAPSE. This is true for all three of the virtual services that are involved. Source IP persistence is recommended and is used by default. VIRTUAL SERVICE (VIP) REQUIREMENTS To provide load balancing and HA for Fujifilm SYNAPSE, the following VIPs are required: HTTP DICOM HTTPS (for external HTTPS traffic) PORT REQUIREMENTS The following table shows the ports that are load balanced: Port Protocols Use 80 TCP/HTTP Internal HTTP traffic 104 TCP/DICOM DICOM traffic 443 TCP/HTTPS External HTTPS traffic Page 5

6 Load Balancing Fujifilm SYNAPSE TLS/SSL TERMINATION External connections are secured using TLS/SSL (HTTPS). This ensures that data is encrypted as it passes between an external client and a back end server. TLS/SSL connections can either be terminated on the load balancer (aka SSL offloading) or on the real servers (aka SSL pass-through). When terminating on the load balancer, it's also possible to enable re-encryption so that the connection from the load balancer to the real servers is protected (aka SSL bridging). Please refer to page 14 onward for more information. TLS/SSL termination on the load balancer can be very CPU intensive. In most cases, for a scalable solution, terminating TLS/SSL on the SYNAPSE servers is the best option. HEALTH CHECKS Regular SYNAPSE server monitoring ensures that failed servers are marked as down and client requests are only directed to functional servers. Health checks can range from a simple ICMP PING to a full negotiate check where content on a certain page is read and verified. By default, a simple Connect to port health check is used by the virtual services described in this guide. We also have an informative blog on DICOM Echo health checking, which can be used if required: SERVER FEEDBACK AGENT It may be useful to adjust how much traffic is passed to the back end servers depending on their CPU load. This can be done by installing the Loadbalancer.org server feedback agent on each real server and then reconfiguring the Virtual Service to make use of the agent. Please refer to section 1 of the appendix on page 21 for full details on installing and configuring the server feedback agent. 7. Deployment Concept VIPs = Virtual IP Addresses The load balancer can be deployed as a single unit, although Loadbalancer.org recommends a clustered pair for resilience & high availability. Please refer to section 2 in the appendix on page 24 for more details on configuring a clustered pair. Page 6

7 Loadbalancer.org Appliance the Basics 8. Loadbalancer.org Appliance the Basics VIRTUAL APPLIANCE DOWNLOAD & DEPLOYMENT A fully featured, fully supported 30 day trial is available if you are conducting a PoC (Proof of Concept) deployment. The VA is currently available for VMware, Virtual Box, Hyper-V, KVM and XEN and has been optimized for each Hypervisor. By default, the VA is allocated 1 CPU, 2GB of RAM and has an 8GB virtual disk. The Virtual Appliance can be downloaded here. The same download is used for the licensed product, the only difference is that a license key file (supplied by our sales team when the product is purchased) must be applied using the appliance's WebUI. Please refer to the Administration Manual and the ReadMe.txt text file included in the VA download for more detailed information on deploying the VA using various Hypervisors. INITIAL NETWORK CONFIGURATION The IP address, subnet mask, default gateway and DNS settings can be configured in several ways as detailed below: Method 1 - Using the Network Setup Wizard at the console After boot up, follow the instructions on the console to configure the IP address, subnet mask, default gateway and DNS settings. Method 2 - Using the WebUI Using a browser, connect to the WebUI on the default IP address/port: To set the IP address & subnet mask, use: Local Configuration > Network Interface Configuration To set the default gateway, use: Local Configuration > Routing To configure DNS settings, use: Local Configuration > Hostname & DNS Method 3 - Using Linux commands At the console, set the initial IP address using the following command: ip addr add <IP address>/<mask> dev eth0 At the console, set the initial default gateway using the following command: route add default gw <IP address> <interface> At the console, set the DNS server using the following command: echo nameserver <IP address> >> /etc/resolv.conf If method 3 is used, you must also configure these settings using the WebUI, otherwise the settings will be lost after a reboot. Page 7

8 Loadbalancer.org Appliance the Basics ACCESSING THE WEB USER INTERFACE (WEBUI) The WebUI can be accessed via HTTP at the following URL: * Note the port number 9080 The WebUI can be accessed via HTTPS at the following URL: * Note the port number 9443 (replace with the IP address of your load balancer if it's been changed from the default) Login using the following credentials: Username: loadbalancer Password: loadbalancer To change the password, use the WebUI menu option: Maintenance > Passwords. Once logged in, the WebUI will be displayed as shown on the following page: Page 8

9 Loadbalancer.org Appliance the Basics (shows v8.2.x) HA CLUSTERED PAIR CONFIGURATION Loadbalancer.org recommend that load balancer appliances are deployed in pairs for high availability. In this guide a single unit is deployed first, adding a secondary slave unit is covered in section 2 of the appendix on page 24. Page 9

10 Appliance Configuration for Fujifilm SYNAPSE 9. Appliance Configuration for Fujifilm SYNAPSE When deploying Fujifilm SYNAPSE, three virtual services must be configured. CONFIGURING VIP 1 HTTP VIRTUAL SERVICE CONFIGURING THE VIRTUAL SERVICE (VIP) Using the web user interface, navigate to Cluster Configuration > Layer 7 Virtual Services and click on Add a new Virtual Service 2. Enter an appropriate name for the VIP in the Label field, e.g. Synapse-Cluster 3. Set the Virtual Service IP address field to the required IP address, e.g Set the Virtual Service Ports field to Set the Layer 7 Protocol to TCP Mode 6. Click Update to create the virtual service Click Modfiy next to the newly created Synapse-Cluster VIP Set Persistence Mode to Source IP persistence Set Persistence Timeout to 60 (the units are minutes, so this value equals 1 hour) Set Balance Mode (the load balancing algorithm) according to your needs. The default setting is Weighted Least Connections, and should work well in most deployments 1 Click Update DEFINING THE REAL SERVERS (RIPS) Using the web user interface, navigate to Cluster Configuration > Layer 7 Real Servers and click on Add a new Real Server next to the newly created Synapse-Cluster VIP 2. Enter an appropriate name for the server in the Label field, e.g. Synapse1 3. Change the Real Server IP Address field to the required IP address, e.g Set the Real Server Port field to Click Update 6. Repeat these steps to add additional SYNAPSE servers as required Page 10

11 Appliance Configuration for Fujifilm SYNAPSE CONFIGURING VIP 2 DICOM VIRTUAL SERVICE CONFIGURING THE VIRTUAL SERVICE (VIP) Using the web user interface, navigate to Cluster Configuration > Layer 7 Virtual Services and click on Add a new Virtual Service 2. Enter an appropriate name for the VIP in the Label field, e.g. Synapse-DICOM 3. Enter the same IP address in the Virtual Address text box as you did when setting up the SynapseCluster virtual service previously, which in the example presented here is Set the Virtual Service Ports field to Set the Layer 7 Protocol to TCP Mode 6. Click Update to create the virtual service Click Modfiy next to the newly created Synapse-DICOM VIP Set Persistence Mode to Source IP persistence Set Persistence Timeout to 60 Set Balance Mode (the load balancing algorithm) according to your needs. The default setting is Weighted Least Connections, and should work well in most deployments 1 Click Update Page 11

12 Appliance Configuration for Fujifilm SYNAPSE TCP connections on port 104 are recognized as DICOM requests and are forwarded to the DICOM server which the Loadbalancer.org appliance determines is the most available based on server weight configuration. DEFINING THE REAL SERVERS (RIPS) Using the web user interface, navigate to Cluster Configuration > Layer 7 Real Servers and click on Add a new Real Server next to the newly created Synapse-DICOM VIP 2. Enter an appropriate name for the server in the Label field, e.g. Synapse-DICOM-Server 3. Change the Real Server IP Address field to the required IP address, e.g Set the Real Server Port field to Click Update 6. Repeat these steps to add additional SYNAPSE servers as required CONFIGURING VIP 3 EXTERNAL VIRTUAL SERVICE (HTTPS) The steps for configuring this VIP are for the recommended mode of operation, which is TLS/SSL pass-through mode. In such a set up, TLS/SSL connections are terminated on the real servers, and the load balancer has no involvement in TLS/SSL termination or decryption. If there is a requirement to terminate TLS/SSL connections on the load balancer then either TLS/SSL offloading or TLS/SSL bridging should be used instead of the default TLS/SSL passthrough setup. To do this, first follow the instructions presented here to configure this VIP in the default way. Then see page 14 for the additional steps required to set up TLS/SSL termination. CONFIGURING THE VIRTUAL SERVICE (VIP) Using the web user interface, navigate to Cluster Configuration > Layer 7 Virtual Services and click on Add a new Virtual Service 2. Enter an appropriate name for the VIP in the Label field, e.g. Synapse-External 3. Enter the same IP address in the Virtual Address text box as you did when setting up the SynapseCluster virtual service previously, which in the example presented here is Set the Virtual Service Ports field to Set the Layer 7 Protocol to TCP Mode 6. Click Update to create the virtual service Page 12

13 Appliance Configuration for Fujifilm SYNAPSE Click Modfiy next to the newly created Synapse-External VIP Set Persistence Mode to Source IP persistence Set Persistence Timeout to 60 Set Balance Mode (the load balancing algorithm) according to your needs. The default setting is Weighted Least Connections, and should work well in most deployments 1 Click Update DEFINING THE REAL SERVERS (RIPS) Using the web user interface, navigate to Cluster Configuration > Layer 7 Real Servers and click on Add a new Real Server next to the newly created Synapse-External VIP 2. Enter an appropriate name for the server in the Label field, e.g. Synapse-HTTPS 3. Change the Real Server IP Address field to the required IP address, e.g Set the Real Server Port field to Click Update 6. Repeat these steps to add additional SYNAPSE servers as required FINALIZING THE CONFIGURATION To apply the new settings, HAProxy must be restarted as follows: Using the WebUI, navigate to: Maintenance > Restart Services and click Restart HAProxy Page 13

14 TLS/SSL Termination Options for External VIP 10. TLS/SSL Termination Options for External VIP The recommended and default setup for the external virtual service, named Synapse-External in the example setup presented in this guide, is to pass TLS/SSL connections through to the back end servers unaltered. This means that TLS/SSL connections are terminated on the real servers, and the load balancer has no involvement in TLS/SSL termination or decryption. If it is required, it is also possible to terminate TLS/SSL connections on the load balancer. The instructions on setting this up are presented below. With the load balancer, TLS/SSL termination can be handled in the following three ways: On the SYNAPSE Servers (recommended) aka SSL Pass-through On the load balancer aka SSL Offloading On the load balancer with re-encryption to the SYNAPSE Servers aka SSL Bridging 1 TLS/SSL TERMINATION ON THE SYNAPSE SERVERS (AKA SSL PASSTHROUGH) Notes: This is the recommended and default setup. Following the steps in section Configuring VIP 3 External Virtual Service (HTTPS) on page 12 will create this setup; no additional configuration is needed Data is encrypted from client to server. This provides full end-to-end data encryption as shown in the diagram below: This is our recommended solution, as TLS/SSL termination on the load balancer can be very CPU intensive. For a scalable solution, terminating TLS/SSL on the real servers is the best option, as they are best placed to perform this function. The steps on page 12 will create this setup; no additional configuration is needed. 2 TLS/SSL TERMINATION ON THE LOAD BALANCER (AKA SSL OFFLOADING) Notes: Since TLS/SSL is terminated on the load balancer, data from the load balancer to the real servers is not encrypted as shown in the diagram below. This may or may not be an issue depending on the network structure between the load balancer and real servers and your security requirements Page 14

15 TLS/SSL Termination Options for External VIP Re-encryption is possible between the load balancer and the SYNAPSE servers (aka SSL bridging). Please see page 17 for more details. An stunnel TLS/SSL VIP can be used to terminate TLS/SSL connections. The backend for this VIP should be the Synapse-External virtual service. The following diagram shows this: TLS/SSL termination on the load balancer can be very CPU intensive. For this reason, we recommend using option 1, SSL pass-through, by default. To create this type of set up, the steps in section Configuring VIP 3 External Virtual Service (HTTPS) on page 12 should be followed first. Once finished, the following steps should also then be followed. Using the web user interface, navigate to Cluster Configuration > Layer 7 Real Servers and click on Modify next to the first server listed under the Synapse-External VIP 2. Change the Real Server Port value from 443 to 80, as connections to the back end servers are now going to be un-encrypted and so should be sent on port 80 (HTTP) 3. Click Update 4. Repeat these steps for each real server listed under the Synapse-External VIP Navigate to Cluster Configuration > Layer 7 Virtual Services and click on Modify next to the Synapse-External VIP 6. Change the Virtual Service Ports value from 443 to a different and convenient value that is not currently in use on the load balancer. Port 8080 is used in the example presented here 7. Click Update 5. Page 15

16 TLS/SSL Termination Options for External VIP 8. Navigate to Cluster Configuration > SSL Termination and click Add a New Virtual Service 9. Set an appropriate Label for the VIP, e.g. Synapse-SSL 10. No SSL certificate is required for this configuration, and the default self-signed certificate can be used 1 Set the Virtual Service IP Address to be the same IP address as the Synapse-External virtual service, which in the example presented here is Set the Virtual Service Port value to Set the Backend Virtual Service IP Address to be the same IP address as the Synapse-External virtual service, which in the example presented here is Set the Backend Virtual Service Port value to the port that the Synapse-External VIP was moved to earlier, which in the example presented here is port Click Update to create the virtual service Page 16

17 TLS/SSL Termination Options for External VIP To apply the new settings, HAProxy and stunnel must be restarted as follows: 2. Using the WebUI, navigate to: Maintenance > Restart Services and click Restart HAProxy Using the WebUI, navigate to: Maintenance > Restart Services and click Restart STunnel 3 TLS/SSL TERMINATION ON THE LOAD BALANCER WITH RE-ENCRYPTION TO THE SERVERS (AKA SSL BRIDGING) Notes: This is similar to SSL offloading. The only difference is that the connections from the load balancer to the real servers are re-encrypted using TLS/SSL, as shown in the diagram below: TLS/SSL termination on the load balancer can be very CPU intensive. For this reason, we recommend using option 1, SSL pass-through, by default. To create this type of set up, the steps in section Configuring VIP 3 External Virtual Service (HTTPS) on page 12 should be followed first. Once finished, the following steps should also then be followed Using the web user interface, navigate to Cluster Configuration > Layer 7 Virtual Services and click on Modify next to the Synapse-External VIP Change the Virtual Service Ports value from 443 to a different and convenient value that is not currently in use on the load balancer. Port 8080 is used in the example presented here Check the Enable Backend Encryption box Page 17

18 TLS/SSL Termination Options for External VIP Click Update Navigate to Cluster Configuration > SSL Termination and click Add a New Virtual Service Set an appropriate Label for the VIP, e.g. Synapse-SSL No SSL certificate is required for this configuration, and the default self-signed certificate can be used Set the Virtual Service IP Address to be the same IP address as the Synapse-External virtual service, which in the example presented here is Set the Virtual Service Port value to 443 Set the Backend Virtual Service IP Address to be the same IP address as the Synapse-External virtual service, which in the example presented here is Set the Backend Virtual Service Port value to the port that the Synapse-External VIP was moved to earlier, which in the example presented here is port 8080 Click Update to create the virtual service Page 18

19 TLS/SSL Termination Options for External VIP To apply the new settings, HAProxy and stunnel must be restarted as follows: 2. Using the WebUI, navigate to: Maintenance > Restart Services and click Restart HAProxy Using the WebUI, navigate to: Maintenance > Restart Services and click Restart STunnel 1 Testing & Verification USING SYSTEM OVERVIEW The System Overview can be viewed in the WebUI. It shows a graphical view of all VIPs & RIPs (i.e. the Fujifilm SYNAPSE servers) and shows the state/health of each server as well as the state of the cluster as a whole. The example below shows that both SYNAPSE servers are healthy and available to accept connections for all of the three virtual services: 12. Technical Support For more details about configuring the appliance and assistance with designing your deployment please don't hesitate to contact the support team using the following address: support@loadbalancer.org 13. Further Documentation The Administration Manual contains much more information about configuring and deploying the appliance. It's available here: Page 19

20 Further Documentation 14. Conclusion Loadbalancer.org appliances provide a very cost effective solution for highly available load balanced Fujifilm SYNAPSE environments. Page 20

21 Appendix 15. Appendix 1 SERVER FEEDBACK AGENT The load balancer can modify the weight (amount of traffic) of each server by gathering data from either a custom agent or an HTTP server. For Layer 7 VIPs, like those used when load balancing Fujifilm SYNAPSE, only the agent method is supported. A telnet to port 3333 on a Real Server with the agent installed will return the current idle stats as an integer value in the range The figure returned can be related to CPU utilization, RAM usage or a combination of both. This can be configured using the XML configuration file located in the agent s installation folder (by default C:\ProgramData\LoadBalancer.org\LoadBalancer). The load balancer typically expects a 0-99 integer response from the agent which by default relates to the current CPU idle state, e.g. a response of 92 would imply that the Real Servers CPU is 92% idle. The load balancer will then use the formula (92/100*requested_weight) to find the new optimized weight. The 'Requested Weight' is the weight set in the WebUI for each Real Server. For more information please also refer to the following blog article: WINDOWS AGENT DOWNLOAD The latest Windows feedback agent can be downloaded from: To install the agent, run loadbalanceragent.msi on each Real Server: Click Next Page 21

22 Appendix Select the installation folder and click Next Click Next to start the installation The agent should be installed on all Real Servers in the cluster. STARTING THE AGENT Once the installation has completed, you'll need to start the service on the Real Servers. The service is controlled by the Feedback Agent Monitor program that is also installed along with the Agent. The monitor can be accessed on the Windows server using: All Programs > Loadbalancer.org > Monitor. It's also possible to start the service using the services snap-in the service is called 'Loadbalancer CPU monitor'. Page 22

23 Appendix To start the service, click the Start button To stop the service, click the Stop button CONFIGURATION Each layer 7 VIP can be configured to use the feedback agent. To Configure Virtual Services to use Agent Feedback follow the steps below: 2. Go to Cluster Configuration > Layer 7 - Virtual Services Click Modify next to the Virtual Service 3. Change the Feedback Method to Agent 4. Click Update 5. Reload/restart services as prompted Page 23

24 Appendix 2 CLUSTERED PAIR CONFIGURATION ADDING A SLAVE UNIT If you initially configured just the master unit and now need to add a slave - our recommended procedure, please refer to the relevant section below for more details: A number of settings are not replicated as part of the master/slave pairing process and therefore must be manually configured on the slave appliance. These are listed below: Hostname & DNS settings SNMP settings Network settings including IP addresses, bonding configuration and VLANs Routing configuration including default gateways and static routes Date & time settings Physical Advanced Configuration settings including Internet Proxy IP address & port, Firewall table size, SMTP relay and Syslog server Graphing settings Firewall Script & Firewall Lockdown Script settings Software updates Version 7: Please refer to Chapter 8 Appliance Clustering for HA in the v7 Administration Manual. Version 8: To add a slave node i.e. create a highly available clustered pair: Deploy a second appliance that will be the slave and configure initial network settings Using the WebUI, navigate to: Cluster Configuration > High-Availability Configuration Page 24

25 Appendix Specify the IP address and the loadbalancer users password (the default is 'loadbalancer') for the slave (peer) appliance as shown above Click Add new node Once complete, the following will be displayed: To finalize the configuration, restart heartbeat and any other services as prompted in the blue message box at the top of the screen The pairing process now commences as shown below: Clicking the Restart Heartbeat button on the master appliance will also automatically restart heartbeat on the slave appliance. Please refer to chapter 9 Appliance Clustering for HA in the Administration Manual for more detailed information on configuring HA with 2 appliances. Page 25

26 Appendix 3 COMPANY CONTACT INFORMATION Website North America (US) URL: Loadbalancer.org, Inc Linden Hill Road, Suite 201 Wilmington, DE USA Tel: (sales): sales@loadbalancer.org (support): support@loadbalancer.org North America (Canada) Loadbalancer.org Appliances Ltd Richards Street Vancouver, BC V6B 2Z4 Canada Tel: (sales): sales@loadbalancer.org (support): support@loadbalancer.org Europe (UK) Loadbalancer.org Ltd. Compass House North Harbour Business Park Portsmouth, PO6 4PS UK Tel: +44 (0) (sales): sales@loadbalancer.org (support): support@loadbalancer.org Europe (Germany) Loadbalancer.org GmbH Tengstraße München Germany Tel: +49 (0) (sales): vertrieb@loadbalancer.org (support): support@loadbalancer.org Page 26