WebMux

Model 481SD/592SGQ

User Guide

Version 8.7.x
Copyright 1997-2011 CAI Networks, Inc.
The information contained in this document is the property of CAI Networks, Inc. Neither receipt nor possession hereof confers or transfers any right to reproduce or disclose any part of the contents hereof, without the prior written consent of CAI Networks, Inc. No patent liability is assumed, however, with respect to the use of the information contained herein.

Revision History

04/22/2011 revision 8708.

Trademarks

WebMux is a trademark of CAI Networks, Inc. All other product names and logos are trade or service marks of their respective companies.

Disclaimer

The instructions and descriptions contained in this manual were accurate at the time of printing. However, succeeding products and manuals are subject to change without notice. Therefore, CAI Networks, Inc. assumes no liability for damages incurred directly or indirectly from errors, omissions, or discrepancies between the product and this manual.
CAI Networks, Inc. 1715 Wilshire Ave., Suite 719 Santa Ana, CA 92705

www.cainetworks.com

Table of Contents

Packing List....iv

Section1Main Components.... 5 1.1 Front View..... 5 1.1.1 Toggle Power Switch.... 5 1.1.2 Reset Button.... 5 1.1.3 Up Arrow Button, Down Arrow Button... 5 1.1.4 Left Arrow Button and Right Arrow Button... 5 1.1.5 Check Mark Button, and Cross Button.... 5 1.2 Rear View..... 6 1.2.1 Server LAN Port.... 6 1.2.2 Backup WebMux Port... 6 1.2.3 Router LAN (Internet) Port... 6 1.2.4 External Modem Connect Port.... 6 1.2.5 Main Power Switch.... 6 1.2.6 Power Cord.... 6 Section2WebMux Overview..... 7 2.1 Key Features.... 7 Section3The WebMux Family... 10 3.1 Topology Overview.... 12 3.2 Two-armed NAT Mode.... 12 3.3 Two-armed Transparent Mode... 13 3.4 One-armed Single Network Mode.... 13 3.5 One-armed Out-Of-Path Mode... 13 Section4Sample Configurations.... 15 4.1 Single WebMux (Two-Armed NAT Mode)... 15 4.2 Redundant Installation (Two-Armed NAT Mode)... 16 4.3 Installation without IP Address Change (Two-Armed Transparent Mode).. 18 4.4 Installation Without IP Address Change (One-Armed Single Network Mode). 19 4.5 Installation without IP Address Change (One-Armed Out-of-Path Mode).. 20 Section5Configuring the WebMux.... 22 5.1 Before you Start.... 22 5.2 Network Terminology.... 22 5.3 Hardware Setup Collect Information... 23 5.4 Hardware Setup Setup the new network.... 23 5.5 Hardware Setup Configuration Summary... 23 5.6 Initial Configuration.... 24 5.6.1 Primary WebMux Information.... 25
5.7 NAT Mode Related Configuration....26 5.8 Transparent Mode or Single Network Mode Related Configuration...28 5.9 Out-of-Path Related Configuration...29 5.10 Common ConfigurationFor NAT, Transparent, Single Network, and Out-ofPath Mode....30 5.11 What if I made mistake in my configuration?...33
Section6Management Console....34 6.1 Login.....35 6.2 Main Management Console....37 6.2.1 Save.....37 6.2.2 Pause/ Resume....38 6.2.3 Adjusting Timeout for Each Service...38 6.3 Network Setup....39 6.3.1 Adding Static Routes....43 6.3.2 Reconfigure....45 6.4 Security Settings....46 6.4.1 Change Password....47 6.4.2 Change PIN....47 6.4.3 Activating the Anti-Attack Feature...48 6.5 Miscellaneous Settings....50 6.5.1 Show Event....50 6.5.2 Logout.....50 6.5.3 Upload/Download (Backup/Restore)...50 6.5.4 Set Clock....51 6.5.5 Shutdown....52 6.5.6 Reboot.....52 Section7Setting Up Load Balancing....53 7.1 Add Farm.....53 7.2 Enabling SSL Termination....57 7.3 SSL Keys.....59 7.4 Modify Farm....63 7.5 Add Server.....65 7.6 Add Address/Port....67 7.7 Add L7 Server.....69 7.8 Modify Server....70 7.9 Add Nexthop Gateway Farm....71 Section8Initial Setup Change Through Browser...76 Section9Sample Configurations and Worksheets...78 9.1 Initial Configuration Worksheets....78 9.2 Sample Configuration Worksheets...79 9.2.1 Standalone WebMux NAT Mode...79 9.2.2 Standalone WebMux Transparent Mode..80

defined in the firewall to allow the IP address of the WebMux interfaces on the Router LAN in addition to the farm IP address (could be same as the WebMux Router LAN IP address) to communicate out to the Internet on all ports. Since the WebMux is doing Network Address Translation of the farm address to a non-routable address, the farm addresses on the WebMux must be able to communicate outbound on all ports defined in the farms.

- 17 -

4.3 Installation without IP Address Change (Two-Armed Transparent Mode)
Transparent Mode is another WebMux configuration that allows you to keep the existing IP addresses of your servers. Like Out-of-Path Mode, the servers and the WebMux will be on the same IP network. However, physically, the servers will be connected to the WebMux in the same way they would be for NAT mode, on the server LAN port. The internet port on the WebMux is connected towards the Firewall/Router. In this mode, the WebMux functions as an Ethernet bridge. Anything connected to its back interface (server LAN) is on the same network as its front interface (internet/router LAN). If you look at the diagram above, you will see that the terminals are on the same network as the servers, even though the servers are behind the WebMux. The terminals can communicate with the servers IP directly as if the WebMux was not there, and vise versa. When creating a farm, choose a unique farm IP address in the network, and then add the server IP address under that farm. Load balancing occurs when the Farm IP is accessed instead of the servers actual IP. There are no configuration changes that need to be made on the servers, only the way they are physically connected to the network. The diagram also gives an example of a redundant WebMux setup. In this case, it is absolutely required that the WebMuxes are connected in between two switches that have Spanning Tree Protocol (STP) enabled. STP controls the path where packets go in the existence of redundant Ethernet bridges according to bridge priority so that loops do no occur. Without this, packets will loop endlessly between the WebMuxes and saturate their network path.

- 18 -

During a failover situation, you may immediately notice that the backup becomes unreachable even though the LCD shows that it is active. This is a temporary situation as the switches detect new bridge priorities. This failover time usually takes about 1-30 seconds, depending the switch and different STP protocol selected. This also happens when the primary comes back online and the secondary returns back to standby mode. For single WebMux setup, any kind of switch will work, since there is only one bridge path exist on the network. No Spanning Tree Protocol is required.

5.9 Out-of-Path Related Configuration
Enter Server LAN WebMux IP Address:
In Out-of-Path Mode, at minimum, you only need to connect the Server LAN interface. This is the IP address of the WebMux Server LAN interface. This IP address must also be unique for each WebMux. The purpose of this IP address is to allow the WebMux to check the network and server health. Even for the backup WebMux, this address must be unique. It is highly recommended to add this IP address to your servers /etc/hosts file, along with the gateway IP address, to allow faster name resolution, especially on Linux/Unix. Please also refer to Appendix A for adding loopback to servers. In an installation with a primary and secondary WebMux, one unique IP address is required for each WebMux interface that connects to the Server LAN. Those two unique IP addresses are in addition to the farm IP address that is floating between the primary and secondary WebMux.

- 29 -

Enter Server LAN Network IP Address Mask:
This is the network mask of the Server LAN. For a class A network, it may be 255.0.0.0. For a class C network, it may be 255.255.255.0. Enter Server LAN VLAN ID (optional):
Note The VLAN ID is used for full 802.1q VLAN support.
Enter Server LAN Gateway IP address (optional):
This is an optional configuration that is used only if you are going to do SSL termination or Layer 7 load balancing. Keep in mind this is an IP address assigned to the Server LAN network interface. Be sure to use a unique IP address or duplicate IPs on the network will occur. Enter 0.0.0.0 if not needed.
5.10 Common ConfigurationFor NAT, Transparent, Single Network, and Out-of-Path Mode

Enter External Gateway:

This is the common setup for NAT, Transparent, and Out-of-Path modes. This is an address on the firewall or router local interface. In NAT mode, the WebMux needs to know this to route the server replies back to the clients. Although in Out-of-Path Mode this is not being used to route return traffic back to the Internet clients, the WebMux uses this IP address to check the connectivity of the external network on this gateway or through this gateway to the ISP side routers. For SSL termination or Layer 7 load balancing, servers must route traffic back to the WebMux via the server LAN gateway (previously mentioned). The WebMux then forwards it to the client through the external gateway. If health check on external gateway is enabled (by default), WebMux will turn the farm listing red to indicate the external gateway failure.

- 38 -

6.3 Network Setup
After logging into management console as superuser, click on the network menu. You will come to this screen:
IPv6 96-bit Address Prefix: In Out-of-Path Mode, you will see the option to create an IPv6 address prefix. The IPv4 addresses will be appended to this prefix. For example, if you assigned 192.168.12.21 for the WebMuxs server LAN ip and you assigned fec0:: as the IPv6 prefix, the WebMuxs complete IPv6 address will be fec0::192.168.12.21 (or fec0::c0a8:c15). See also Appendix H for extra info on using IPv6.

- 39 -

Server for email notification: The WebMux can send email notifications. Enter the IP address of the email server that will forward the notifications.
Note Because the WebMux does not resolve names, this entry must be an IP address.
Also, you must allow relaying from the WebMux IP on your email server in order to accept emails from the WebMux. Addresses for email notification: Enter the email addresses to be notified. Separate multiple addresses with a colon. For example: johndoe@anywhere.com:janedoe@anywhere.com UDP syslog server IP address notification: The WebMux can be configured to send syslog messages to a remote syslogd server. Enter the syslogd server IP address to use this feature. The syslogd server must be configured to accept remote UDP syslog connections. The facility for WebMux syslog messages is LOCAL6. The notification levels of the syslog messages are as follows:
Level INFO NOTICE NOTICE NOTICE WARNING Search Key STATS LOGIN SETUP EVENT LOGIN LCD display messages Successful browser login/logout (excludes timeout logout) Significant access and changes to setup and configuration items. Same as pager/mail messages Unsuccessful browser login Description
Server gateway IP address: The WebMux appears to all the servers in the farms as a gateway or router. This is the IP address for the WebMux acting as a router for the servers. This is the IP address that should be used as the default gateway IP address in the web (or other) servers. It is highly recommend adding it to the /etc/hosts file on your servers. Only apply for the NAT mode (or for Out-of-Path Mode that requires the WebMux to do the SSL termination or Layer 7 load balancing. Normally, this is optional for Out-of-Path Mode).

Note For first time setup, it is very important to set up this address and the Server Farm
network mask (below) first. Also when setting up the servers, you may be asked to fill in the default gateway IP address for the server. Use this IP address to setup all the servers under it. The WebMux will not function properly if this IP address is not set correctly for both WebMux and the servers. WebMux http control port: Since the WebMux is load balancing incoming HTTP traffic, the HTTP port for the management console must be set to a different port. By default, the port is 24. You can change the port to any port that is not being load balanced, if so desired. The font push buttons can also change this.

- 40 -

WebMux https control port: Since the WebMux is load balancing incoming HTTPS traffic, the HTTPS port for the management console must be set to a different port. By default, the port is 35. You can change the port to any port that is not being load balanced, if so desired. The front push buttons can also change this. SNMP UDP Port: SNMP on the WebMux is active and uses port 161 by default. You can change the port here. Or you can enter 0 or none or leave blank to disable SNMP altogether. WebMux uses SNMP v1 and the community string public. WebMux diagnostic ports: The WebMux allows diagnostic sessions from remote access for factory technical support or trained network engineers through ssh or telnet. Access is also subject to the restriction of the Allowed-Host setting earlier. superuser can login with its password using ssh to run certain diagnostic tools (help shows the commands, how to use these commands are not supported). When this entry is blank, any diagnostic access is denied. This entry should remain blank under normal operations. Default port numbers are 77 / 87. The first port is ssh and second is telnet. If only one port specified, only ssh login is possible. You will need to notify us the port numbers before obtaining support from us. Least significant bits in client IP address to ignore for persistent connections: This feature allows persistent connections to be handled properly when communicating with America Onlines bank of cache servers. With AOLs cache servers, the IP address of the cache server becomes the source address. Since an end user can be sent through multiple cache servers; it is possible the requests for one HTML page are being routed to different web servers in the same session. Therefore, applications, such as shopping carts, that require persistent and secure connections will not work properly. This feature will treat multiple cache servers as one source, thus the WebMux can properly handle the persistent requests from browsers. From customers feedback, number three (3) is good enough for most AOL requests. The WebMux will use this entry to determine how to load-balance the traffic. It calculates based on two to the power of the entry as the number of IP addresses to combine. When too large a mask applied, it will defeat the load balancing function of the WebMux. Act as IP Router: Yes: The WebMux will route IP packets both directions. The WebMux will not act as a firewall in this mode. No: The WebMux will NOT route incoming IP packets through the WebMux, except IP packets for farm IP/port. This is the default setting. Front Network Verification: The WebMux checks the availability of the front network by checking on the IP address you configured as your external gateway ip (your router IP). The selection here determines the protocol used to check the connectivity of that IP address. It can be none, ARP, TCP

- 54 -

Service: The service selection determines the type of service running on the servers in the farm and how the WebMux will check the server health status. The service type selection will create a farm using the well-known port for that service type. If a port other than a well-known port for TCP or UDP service is to be used, then choose one of the Generic selections and enter the port number in the PORT NUMBER field. You do will not need to specify the port number if the service protocol is on the list. The WebMux has level 7 protocol checks for the known ports in the list. For Custom Defined TCP Service (custom health check), please specify the URL for the CGI code in the Administration Setup screen.
CAUTION Once a farm is created, the port number cannot be changed. Like the IP
address, the farm must be deleted and a new one created in order to change farm settings. Please choose Generic TCP and specify port number, if service is not listed below. If multiple ports to be used, please also select Generic TCP and specify port number 0.
Service DNSDomain Name Service (TCP) FTPFile Transfer Protocol (TCP) HTTPHypertext Transfer Protocol (TCP) HTTPSSecure Hypertext Transfer Protocol (TCP) HTTP/HTTPS Combined Ports NTPNetwork Time Protocol POP3Post Office Protocol SMTPSimple Mail Transfer Protocol (TCP) Generic TCP Generic UDP Generic TCP/UDP Generic no health check (TCP) Generic no health check (UDP) Generic no health check (TCP/UDP) Custom Defined TCP Services Custom Defined + Generic TCP Custom Defined UDP Services Custom Defined TCP/UDP Services Custom Defined Paired HTTP and HTTPS (TCP) Service Well-Known Port# 80/User Specify User Specify User Specify User Specify User Specify User Specify User Specify User Specify User Specify User Specify User Specify
Scheduling method: The scheduling method is the way in which traffic is distributed among the servers in the farm. Eight different methods are supported. If you are using a shopping cart service, a persistent scheduling method is recommended. Least connections Least connectionspersistent Round robin Round robinpersistent

- 55 -

Weighted least connections Weighted least connectionspersistent Weighted round robin Weighted round robinpersistent Weighted fastest response Weighted fastest responsepersistent Faster Layer 7 HTTP URI load directing (no compression) Layer 7 HTTP URI load directing Layer 7 HTTP URL load directing with cookies Layer 7 HTTP cookie load directing with cookies Layer 7 HTTP virtual host load directing with cookies Layer 7 scheduling methods can only be used with the HTTPHypertext Transfer Protocol (TCP) service. These scheduling methods allow you to direct traffic to a specific group of servers depending on a match pattern that is tested against the URI in the clients GET request header. Layer 7 HTTP URI load directing is your basic Layer 7 load balancing method. The Faster Layer 7 HTTP URI load directing (no compression) option is the original basic Layer 7 load balancing feature that was not built with the HTTP compression logic. Although, both selections will load balance exactly the same way, selecting the Faster method may free up more resources than the normal Layer 7 HTTP URL load directing option; even if HTTP compression is not being used. Layer 7 HTTP URL load directing with cookies allows the WebMux to maintain client/server persistence. This scheduling method also compares the match pattern against the host MIME header. In other words, a host name can be specified as a match pattern. In order for client/server persistence to occur, the server will have to generate a cookie first. The WebMux will generate its own cookie to keep track of which client session belongs to which server. These are useful for shopping cart services, for example, so that a client will be directed to the same server and keep their shopping cart items valid. The WebMux cookie expire time matches the MAX_AGE setting specified in the cookie generated by the servers. When MAX_AGE is not defined, the cookie expire time is 30 minutes. If the server deletes the original cookie, the WebMux will also delete its corresponding cookie. Layer 7 HTTP cookie load directing with cookies tests the match pattern against the cookie MIME header content only. Client to server persistence is also enabled in this scheduling method. Layer 7 HTTP virtual host load directing with cookies allows you to direct traffic to name based virtual hosts. For other scheduling methods, you cannot put the same server IP address more than once in a single farm. This scheduling method will allow you to have several name based virtual hosts on a single physical server with one IP address. Client to server persistence is enabled in this scheduling method. SSL Termination: Selecting an SSL key in this section will enable SSL termination for this farm. The HTTP service and POP3 service terminate to ports 443 and 995, respectively, and will allow you to choose any port for the clear traffic to the servers.

- 62 -

able to directly transfer your existing key and certificate from your Linux server. For Windows IIS keys and certificates, you will need to convert them to PEM format. Please refer to our support site for instructions: http://www.cainetworks.com/support/how-to-convert-ssl.html You can get OpenSSL for Windows at: http://www.slproweb.com/products/Win32OpenSSL.html If you would rather, you may contact us at support@cainetworks.com and we can do the conversion for you.
Note The CA certificate field is only for client side SSL authentication. It is not for the
intermediate certificate. Please see Appendix O for details about setting up client side SSL authentication.

7.4 Modify Farm

Modify farm can be invoked from the main management console screen by clicking on the farm IP address or selecting a radio button of a farm and clicking the modify farm button on the left side of the screen.
Farm IP address and port number: This displays the current farm IP that is being modified. These fields are set in the Add Farm screen. Once set, they are not changeable. If they must be changed, delete the farm and then add a new one. Label: The label is displayed on the column to the left of the corresponding IP addresses in the main status screen. Although labels can be anything, it is better to have meaningful and unique label for each farm. The label field is also used as the host name in HOST: MIME header to when checking HTTP servers. The HOST: MIME header is essential in virtual hosting as

- 63 -

that will determine which site is being accessed. The format of the farm label should be the site host name (i.e., www.xyz.com), max length 75 bytes. Without a label specified, a 401 (Unauthorized) error code is still considered a live server. If you have a label specified and the server returns error code 401, then the WebMux will consider that server dead. For both IIS and Apache servers doing virtual hosting, the farm name label must be an existing web site name on the server. For more information on Virtual hosting, please go to Appendix D for details. Farm scheduling method: Eight different methods are supported: Least connections Least connectionspersistent Round robin Round robinpersistent Weighted least connections Weighted least connectionspersistent Weighted round robin Weighted round robinpersistent Weighted fastest response Weighted fastest responsepersistent Faster Layer 7 HTTP URI load directing (no compression) Layer 7 HTTP URI load directing Layer 7 HTTP URL load directing with cookies Layer 7 HTTP cookie load directing with cookies Layer 7 virtual host load directing with cookies SSL Termination: You can change the SSL key/certificate pair used for this farm. All current connections for this farm will be reset if you change the key/certificate pair selection. Block non-SSL Access to farm: If you do not want to allow non-encrypted traffic connecting to the farm, select Yes. Tag SSL-terminated HTTP requests: If SSL termination is active for this farm, choosing Yes for this option will add an XWebMux-SSL-termination: true MIME header in the decrypted http request going to the real server. Connection throttling watermarks: Setting a value in the high field will control the maximum number of concurrent connections allowed on a farm. The low field will control when to resume allowing more connections. For example, with a high set to 20 and a low set to 10, the WebMux stop allowing more connections when the number of concurrent connections hit 20 and new connections will not be allowed until the number of concurrent connections drop to 10 or below.

- 64 -

SNAT: Selecting YES in this field will enable SNAT for this farm only. This option is not available when SNAT is enabled system-wide in the network management or when running in Single Network Mode. Compress HTTP traffic: Enable or disable HTTP compression. When enabled the MIME header X-WebMuxCompression: true will be appended to the server response MIME header. (NOT supported in Out-of-Path Mode, except when used in a Layer 7 Farm). Delete: Click this button to delete the entire farm.
CAUTION This function also deletes ALL the servers under this farm.

7.5 Add Server

In the Modify Farm screen click on the Add Server button to add a new server to this farm. Or you can select the radio button of the farm from the main screen and click on the add server button on the left.
Server IP Address: This is the IP address of the server to be added. Label: Since version 4.0.3, the WebMux allows adding a label to each servers IP address. The purpose of labeling a server is only to help identify the server in the farm. It has nothing to do with the name resolution of the server. Although label can be anything, it is always better to have meaningful and unique label for each server.
CAUTION Once the server is added, the IP address cannot be changed. To correct the IP
address, the server must be deleted and a new one be created.

- 65 -

Server Port Number: If the port number specified in the farm setup is the same as the real servers port number, you can leave this as same. In NAT mode, the WebMux can perform port forwarding from the farm IP port to the server IP port if you specify a server port that is different from the farm port.
CAUTION Like the IP address, once created, the port number cannot be changed. To
correct the port number, the server needs to be deleted and a new one to be created. Weight: Scheduling priority weight. Valid integer numbers are between 1 and 100. A server that has a weight of 2 will be directed twice as much traffic as a server with a weight of 1. A special zero weight setting is provided for a graceful shut down of a server. When the weight is changed to zero, the WebMux will not send new connections, but will maintain all current connections to the server. The connections will gradually reduce to zero as current clients sessions terminated. When there are no connections, the server is functionally dead or off line until the weight is changed back to a valid number. Then the server can then be shutdown or taken out of service without affecting any users.
CAUTION Unlike a server that can go down unexpectedly, the WebMux will not move a
STANDBY server to ACTIVE when one or more servers weight is set to zero. If the weight of all the servers in a farm were set to zero, then the farm would be down because none of the servers are accepting new connections.

Your original default external gateway will be automatically added to the nexthop gateway farm. Click on the nexthop gateway farm IP on the grey line above the router IP to add more gateways to the nexthop farm.

- 72 -

Click on the Add Gateway button to add more gateway IPs to your nexthop gateway farm.
IP Address: Enter the IP address of your nexthop gateway. Label: The label here is used only for reference purposes. Weight: Scheduling priority weight. Valid integer numbers are between 1 and 100. Run State ActiveThe gateway will be put into service immediately after it is added. If there are gateways in the farm in Standby, WebMux will activate a Standby gateway in its place if it goes out of service. When the original gateway comes back in service, it will stay Standby mode until manually setting its run state to Active again through the browser interface. This will give system administrator time to fix the system or reboot the gateway once some software/hardware update is completed. Favorite ActiveThe gateway will be put into service immediately after it is added. If a Favorite Active gateway failed, once it is operational, the WebMux will automatically put it back to the Active state.

- 73 -

StandbyThe gateway will be put into STANDBY, or backup, mode after it is added. The WebMux will change a STANDBY gateway to ACTIVE when one or more ACTIVE gateways fail. Last Resort StandbyThe gateway will be put into STANDBY state. Unless all other gateways are out of services, this gateway will not be switch in.
Back at the main status page of the web GUI, you will notice that the farm IP addresses are now shown in grey. Before creating a nexthop gateway farm, the farm IPs were shown in blue with the ALIVE status, or red with the DEAD status. The farm IP status was an indication of the availability of the default external route of your WebMux. Now that you have created a nexthop gateway farm, the status of your external route is determined by the availability of any one of the nexthop gateways in your nexthop gateway farm. As with a single default gateway the type of health checking done on the router IPs is determined by the front network verification protocol setting in the Administrator Setup page (see section 6.3). If you click on the nh link under the service column, you will get to the modify service timeout page.

- 74 -

The setting in this page will determine how long or how short the WebMux will wait to be able to verify if the gateway IP is still valid or not. You can disable the checking altogether by setting the timeout value to 0 or you can set the front network verification protocol to none in the Network Setup page (see Section 6.3).

Router LAN Information 205.133.156.200 255.255.255.Server LAN Information 10.1.1.10 10.1.1.1.1 255.0.0.0 10.0.0.0 10.255.255.205.133.156.1 Y Y N Y Y 255.0.0.0 10.0.0.0 10.255.255.205.133.156.1 Y N 10.1.1.20 205.133.156.200 255.255.255.0 101
Administration Setup Information

- 82 -

Section 10

Contact Information

For latest product and support information, please visit our web site at: http://www.cainetworks.com To reach us by e-mail: Support: support@cainetworks.com Sales: sales@cainetworks.com To reach us by phone: Support: 714-550-0901 X2

- 83 -

Section 11
I cant login with my browser. It always says you are not logged in. To use your browser to manage the WebMux, it must be set to accept all cookies. Because the cookie is set to expire in 8 hours, you also need to make sure your system clock set correctly using GMT. The message is an indication that your system clock is off. Please refer to page 84 on how to set the system clock of the WebMux. I cant login with my browser because the WebMux does not respond. Your IP address is not on the allowed host list, or the wrong IP addresses were entered by accident. Use the LCD panel setup to clear that list. If I have multiple servers assigned as STANDBY, how does the WebMux choose which server to use if an ACTIVE server goes down? The WebMux checks the standby servers in order and activates each one until their total weight meets or exceeds the server that is unavailable Will a server with weight 0 act as a STANDBY? No. A weight of 0 indicates that the server will not accept any new connections. The state is considered neither ACTIVE nor STANDBY. This is to quiet the new connections for the server so that it can be taken out of service. Is the Server LAN and the Router or Front LAN required to be on separate IP subnets? It is required that the server LAN and the router LAN be separate IP subnets. What notification services are compatible with the WebMux? Airtouch and PageMart are the services that are currently supported. Any SMTP server configured to allow relaying from the WebMux can be used for sending email notifications. If Im running a Unix-based FTP, such as wuftp, how can I get the ftp server in the farm to resolve the WebMux IP addresses? The IP addresses typically will not be able to be resolved since the servers in the farm are typically using non-routable or private network addresses. In order for wuftp to resolve the IP addresses and stop complaining, place the non-routable IP address entries in the /etc/hosts file on those servers.

- 84 -

How come my servers in the farm are showing in red color from time to time, even the servers are okay? Your servers are trying to resolve the WebMuxs IP address to name so it could log them into log file. To avoid this problem, set the servers not resolve the IP addresses. You can also try adding all the IP address to the /etc/hosts file on your servers. For example,

- 90 -

Appendix B
How to Make Route Delete Reboot Persistent
These instructions are for Windows 2000/NT systems. This is not necessary for Windows 2003 or 2008 systems. 1. In a Windows system, go to boot drive root by cd C:\ 2. Use a text editor to create a text file, in which it contains one line: route delete 10.1.0.0 mask 255.255.0.0 10.1.1.200 3. In above file 10.1.0.0 is the network destination, 255.255.0.0 is the Netmask for the network, and 10.1.1.200 is the farm address, also is the address for the loopback adapter address. 4. Start Scheduled Task in control panel; 5. Click add Scheduled Task; then next; 6. Browse to the.bat file we createdlike WebMux.bat under c:\ ; 7. Choose Perform this taskwhen my computer starts. That will delete the route every time the Windows computer reboots. Please make sure after route delete the only route left in the routing table for the loopback adapter is this one (your actual IP address and netmask maybe different): 10.1.1.255 255.255.255.255 10.1.1.200 10.1.1.All other routes for the loopback adapter must not show in the routing table. On both Windows and Unix, the routing table can be seen by execute this command: netstat rn Please note for Windows 2003 servers, the route for the loopback adapter cannot be deleted. However, since Windows 2003 server automatically sets a high metric number, the route does not need to be deleted.

- 91 -

Appendix C

Phone Paging Codes

When an error occurs, the WebMux will send an error code to the regular numerical pager assigned in the Administration Setup page. Please refer to the Management Browser Administration Setup section on setting up phone pager numbers. To be as compatible as possible to different types of pagers, only numeric error codes are used. The minimum requirement is the pager should be able to display up to 18 digits. If the pager cannot display 18 digits, some codes may get truncated.
C.1 For WebMux (Single and with Secondary)
99IIIIIIIIIIIIPPPPA server went down. This 18-digit code (no spaces) starts with 99 followed by 12 digits of the IP address (without the periods) of the server. The last four digits represent the port number of the server. 00IIIIIIIIIIIIPPPPA downed server went back up. This 18-digit code (no spaces) starts with 00 followed by 12 digits of the IP address (without the periods) of the server. The last four digits represent the port number of the server. 98////////////[PPPP]Gateway (router LAN) does not respond. 12 digits number after the 98 is the IP address of the gateway. Port number is optional. 01////////////[PPPP]Gateway comes back in service. 12 digits number after the 01 is the IP address of the gateway. Port number is optional. 88////////////PPPPWebMux has detected more connections than the threshold defined in the setup screen. 40last resort servers taken out of service for a farm. 41last resort servers put in service for a farm. 73WebMux cannot reach to the back LAN. 74WebMux cannot reach the front LAN. 75Primary or Secondary cannot reach the other WebMux through the serial cable. 76Serial cable communication restored. 55User configuration cannot be parsed by WebMux (after the configuration restored through browser).

- 112 -

Appendix M
Bond All Interfaces Setup Guide
As of firmware version 8.5.04, when you specify a non-zero VLAN ID in NAT Mode or Transparent Mode, you will be given an additional option to Bond rtr/svr NI. This feature allows you to use the Internet and Server ports as a single bonded interface (also known as Port Channel or Link Aggregation Group). When this option is enabled, the traditional front and back LAN of the WebMux is no longer partitioned on the WebMux itself, rather, on the network SWITCH using tagged and untagged VLAN ID settings. Specific concepts need to be followed when setting up the WebMux with VLAN IDs. One is that the ports on the switch connected to the WebMux MUST be configured to be using tagged VLAN (802.1q). VLAN IDs configured on the WebMux for any mode (NAT, Transparent, or Out-of-Path) is a tagged VLAN (802.1q) specification. For the rest of the network, there are two ways to configure the switch and devices in order for them to be able to communicate with each other. One way is to make all the devices in the local network use 802.1q VLAN tagging, since only devices using 802.1q VLAN tagging will be able to communicate with each other. However, that option depends on the actual network interface in the device and whether or not it supports 802.1q VLAN tagging. The other option is to leave the network interface configuration on the other devices alone and configure the switch to do the VLAN tagging. This will be the option that we will be using in our example. All manageable switches with VLAN capabilities have these features, but since the switch configuration commands vary from brand to brand, we will only lay out the main configuration concepts and leave it up to you to refer to your switch user manual for specifics. In the following example, we will be configuring a WebMux in NAT Mode using the Bond rtr/svr NI option enabled: RTR LAN IP: 192.168.12.21 RTR LAN mask: 255.255.255.0 SVR LAN IP: 192.168.11.21 SVR LAN mask: 255.255.255.0 RTR LAN vlan id: 100 SVR LAN vlan id: 200 Bond svr/rtr NI? YES SVR LAN gateway IP: 192.168.11.1 External Gateway IP: 192.168.12.1 On the switch, we will be connecting ports 1 and 2 to the Internet/rtr port and Server/svr ports of the WebMux. We will designate ports 3, 4, 5, and 6 for the Front/Internet LAN and ports 7, 8, 9, and 10 for the Back/Server LAN. First you will need to create a port channel or link aggregation group that includes physical ports 1 and 2. In most switches your real ports are designated by 0/1, 0/2, and so on.

- 113 -

When you create a port channel, a new interface may be created designated by 1/1 for example. Next, you will assign the VLAN IDs to the PORT-CHANNEL interface (1/1). First, configure the port-channel interface to participate or include VLAN 100 and make sure that it is TAGGED. Then, configure the port-channel interface to participate or include VLAN 200 and make sure that it is TAGGED. The port-channel interface should now be part of both VLAN 100 and VLAN 200 using TAGGED VLAN. Now, configure the switch to use ports 3, 4, 5, and 6 for the Front/Internet LAN. The devices connected these ports will not be using any VLAN configurations. The switch will be configured to accept incoming untagged packets and automatically assign a VLAN ID to those packets. In this case, you will be using VLAN ID 100. First, you will configure ports 3, 4, 5, and 6 to participate or include VLAN 100 and make sure that you specify that it is UNTAGGED. On some switches, that means you have to first issue the command to have the port participate on VLAN 100, then you have no issue a no vlan tagging 100 command. Next is very important to make this portion work properly, you must make these ports accept all frames AND you must assign them the PVID of 100. If you are unsure where, or how, to set the PVID, then please refer to your switch user manual. This tells the switch that these ports are part of VLAN 100, the data from the devices connected will be untagged and it should accept it anyway, and finally the switch will automatically assign a VLAN ID of 100 to these untagged packets. At this point, assuming that your device has a 192.168.12.0/24 address, you should now be able to ping the WebMux rtr LAN IP address of 192.168.12.21. Finally, on the server side you will configure the switch to use ports 7, 8, 9, and 10 for the Back/Server LAN. Again, the devices on these ports will not be using any VLAN configurations. The switch will be configured to accept incoming untagged packets and automatically assign a VLAN ID to those packets. Your server side VLAN ID is 200. You will need to configured port 7, 8, 9, and 10 to participate or include VLAN 200 and make sure that you specify that it is UNTAGGED. Next you will need to make these ports accept all frames AND you must assign them the PVID of 200. Again, please refer to your switch user manual for specific commands. At this point, any device connected to port 7, 8, 9, or 10 (and assuming that it already has a 192.168.11.0/24 address), you should now be able to ping the WebMux svr LAN IP address of 192.168.11.21.

- 127 -

Round-Robin, 10 route, 20, 30, 41, 54, 81, 88, 91, 97 Router LAN, 12, 15, 16, 17, 22, 23, 24, 26, 78, 79, 80, 82, 85 routes, 12, 43, 91 scheduling, 55, 64 secondary, 16 Server LAN, 6, 12, 15, 16, 17, 23, 26, 27, 28, 29, 30, 78, 79, 81, 82, 84 Single network mode, 8, 13 SNAT, 8, 43, 115 SNMP, 101 Spanning Tree Protocol, 18, 19 SSL, 7, 30, 54, 57, 58, 59 SSL termination, 21, 30, 37, 54, 56, 58, 64, 68, 81 startup, 97, 115 STP, 18 superuser, 36, 39 sysinit, 97, 115 syslogd, 40 Tag, 64 tagged, 8, 108, 111 timeout, 37, 38, 40, 42 Timeout, 38, 42 TLS, 59 Transparent, 8, 18, 30, 54, 78, 79, 80, 81, 82 uplink, 110, 111 Upload, 50, 51 URL, 35, 42, 55, 76, 93 version, 24, 43, 53, 65 Virtual Farm, 13, 22 Virtual Host Load Directing, 70 VLAN, 8, 27, 28, 29, 30, 78, 79, 80, 81, 82, 107, 111 weight, 42, 66, 71, 73, 84, 94, 95 X-FORWARD-FOR, 19

- 128 -

services such as credit card validation and mapping services. (Note: this function only works in NAT mode). Built-in Firewall Protections. Stop possible hacker intrusion into your network from Internet. All IP addresses and ports are blocked except the farm IP address. Built-in functions will detect any possible denial of service attack and make your services always available. (Note: this function only works in NAT mode with Forwarding Deny, see setup for details). In-Path or Out-of-Path Load Balancing. In normal setup, the WebMux can be configured In-Path, to act as firewall in addition to the load balancer and health checker. However, if outbound traffic is much larger than inbound traffic and you already have a firewall in place, or change of IP address causes problems, consider using Out-of-Path configuration. Outof-Path load balancing is also called direct routing, or one leg operation. Informs you of the status of your network. It provides phone pager and email notification so that the network administrator can be paged or emailed whenever a server or WebMux goes down, and when it returns online. This feature could reduce server room night shift operator costs, or timely repair should the server goes down unexpectedly.
4 Copyright 1997-2005 CAI Networks, Inc.

The WebMux Family

The 1U WebMux family consists of three models. They are: The WebMux 480S The WebMux 580SG The WebMux 680SP
The table below compares the features of the models.
Model Number: Speeds: Copper Ethernet Speed MAX. SSL Termination 1024 RSA Transaction/S Max SSL Terminated connection Max Active SSL Certificates Balancing Method: Round-Robin Persistent Round-Robin Weighted Round-robin Persistent Weighted Roundrobin Least Connections Persistent Least Connections Weighted Least Connections Persistent Weighted Least Connections Weighted Fast Response Persistent Weighted Fast Response Fault Tolerance: Diskless Design Port aggregation Failover via ethernet Service aware Server aware Backup server Performance: Maximum concurrent connections 1,440,000 2,880,000 5,760,000 Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes 10/5,10/100/10,10/100/20,480S 580SG 680SP
Maximum New Connections/S Maximum throughput per second Maximum Internet Link Speed Management: Secure web browser access In service/Not in service Page alarms (ext modem req) Email Notification Configuration access Remote telnet access Persistent connections Port mapping Port-specific services Security Features Network Address Translation Network Port Translation TCP SYN protection TCP DoS protection SSL support Device Support: Maximum virtual farms Maximum real servers Device's role in the network UDP-based service support Misc. Overnight Exchange Unit Free Email/Phone Support Warranty on Hardware/Firmware Power Consumption 115VAC Current Heat Production

7,MBit/s 2 X T3

40,GBit/s 1.5 X OC-12

50,Gbit/s 1.5 X OC-12

Yes Yes Yes Yes Yes Yes Yes Yes Yes

Yes Yes Yes Yes Yes

500 65,532 IP router Yes
Unlimited 65,532 IP router Yes
Service Contract ServiceContract ServiceContract Three Years Three Years 120W 2.5A 350BTU/H Three Years Three Years 200W 3.5A 550BTU/H Three Years Three Years 350W 5A 800BTU/H
Power and Cooling Requirement
95 130VAC or 195-235VAC at 50-60Hz universal input power required. Absolute operating temperature range is 0-40C. Recommended operation ambient temperature should not to exceed 30C.
6 Copyright 1997-2005 CAI Networks, Inc.

Network Overview

The WebMux has two modes, In-Path, or NAT (Network Address Translation) and Out-of-Path (Direct Routing) mode. Each mode has its advantage and disadvantages. Lets look the NAT mode first.
The main purpose of the WebMux is to balance the traffic among multiple web or other servers. The diagram above shows an NAT installation with two WebMuxes. In this configuration, one WebMux is serving as the primary, and the other is serving as the secondary, or backup, providing a fault tolerant solution. In order for the web servers to share the incoming traffic, the WebMux must be connected to the network. There are two interfaces on the WebMux. One interface connects to the Router LAN. This is the network to which the Internet router is connected. The other interface is connected to the Server LAN. This network connects all the web servers. The WebMux routes traffic between these two networks. Next, a Virtual Farm or multiple farms must be configured on the WebMux. A virtual farm is a single representation of the servers to the clients. A farm consists
of a group of servers that service the same domain, website or services. For example, to configure a farm (or virtual farm) to serve www.cainetworks.com: First, Server 1 and Server 2 would each need the website www.cainetworks.com configured on them and HTTP/HTTPS services started, and Second, a farm on the WebMux is defined with Server 1 and Server 2 in it. The servers would be setup to either share the traffic, or setup as a primary server and standby server. In either case, if Server 1 goes down, then all traffic will be automatically directed to Server 2 by the WebMux.
In Out-of-Path mode, only one network in the setup, that is the server LAN, is connected to the Internet through the firewall and router. Internet traffic or local connections can both be directly sent to the WebMux , which routes the packets to the proper server(s), then the server routes the return traffic back to the remote or local clients directly.

Choose NAT mode or Out-of-Path Mode:
This is where to choose NAT (Network Address Translation) or Out-of-Path mode. * is a default or selected option. Network address translation provides protection to the servers; it can handle large amounts of data as noted in the specification. It provides the best security for isolating servers from any other part of the networks. Out-of-Path provides better performance when huge amounts of data need to go back to clients (up to 100X more than on the specification chart); it also does not require a change to the server IP address. If choosing NAT, continue to the next setting; otherwise, skip next few settings and go to direct routing. If answer NO here, please continue setup referring to page 20, the Out-of-Path Related Configuration section.
NAT Mode Related Configuration Enter Router LAN WebMux Proxy IP Address:
This is the IP address that the WebMux uses as the external IP address when it functions as a proxy. This IP address can be used to setup the first farm. When any server behind the WebMux (on the Server LAN) initiates communication with another host, the WebMux substitutes the servers IP address with this address. (This is true for all services, except FTP services, which use the FTP farm IP address for passive FTP connection). For redundant setup, secondary WebMux uses the same IP address for this entry as the primary one. This address floats between primary and secondary WebMuxes. 18 Copyright 1997-2005 CAI Networks, Inc.
Enter Router LAN Network IP Address Mask:
This is the network mask of the Router LAN network. It is usually 255.255.255.0 for class C networks.
Enter Server LAN WebMux IP Address:
This is the IP address of the WebMux interface that connects to the Server LAN. This IP address must also be unique for each WebMux. This address must be different from the server LAN gateway address. The purpose of this IP address is to allow WebMux to check the network and server health situation. Even for the backup WebMux, this address must be unique. It is highly recommended to add this IP address to your servers /etc/hosts file, along with the gateway IP address, to allow faster name resolution, especially on Linux/Unix. In an installation with a primary and secondary WebMux, one unique IP address is required for each WebMux interface that connects to the Server LAN. Those two unique IP addresses are in addition to the gateway IP address that is floating between the primary and secondary WebMux. These IP addresses cannot be your Internet registered addresses. They must be Internet non-routable. For example, you can assign addresses in a 10.0.0.0 network address range, or a 192.168.199.0, etc.

20 Copyright 1997-2005 CAI Networks, Inc.
NAT and Out-of-Path Common Configuration Enter External Gateway:
This is the common setup for both NAT and Out-of-Path modes. This is an address on the firewall or router local interface. In NAT mode, the WebMux needs to know this to route the server replies back to the clients. Although in Outof-Path mode this is not being used to route return traffic back to the Internet clients, the WebMux does check the connectivity to the incoming side on this gateway or through this gateway to the ISP side routers. In SSL termination mode, servers need to route traffic back to the WebMux via the server LAN gateway (previously mentioned). The WebMux then forwards it to the client.
Is this a Primary WebMux?
If this is the Primary, answer Yes. If this is the Secondary WebMux, answer No. The secondary WebMux automatically gets configuration information from the Primary once it sets up. If this is the only WebMux, answer Yes.
Primary WebMux Information
This question is not asked for the Secondary WebMux.
Is this WebMux running solo without a backup WebMux?
If the Primary WebMux is running in a standalone configuration (see sample configuration Standalone WebMux.), answer Yes. If you plan to add 2nd WebMux later, you may answer no.

Clear Allowed Host File?

Allowed host file prevents any unauthorized access to the WebMux Management Console. If a workstations IP address is not in the allowed host file, that computer will not be able to reach the WebMux management console through the network. However, sometimes a wrong IP address is entered so that Copyright 1997-2005 CAI Networks, Inc. 21
no computer can access the browser management console. At that point, clearing the allowed host file will allow any browser to access it. By default, the allowed host list is empty so that any IP address can access WebMux. We do encourage adding only host IP addresses that you do allow to manage WebMux into the list. See configuration through browser interface for more details.
Remake /home/WebMux/conf/passwd?
This function is provided in case you have forgotten the passwords to access the Management Console. Please use a browser to access Management Console for normal password changes. The factory default password is the same as the login ID on the screen. Answer Y to reset the Passwords to factory default. Answer N to leave them unchanged.

24 Copyright 1997-2005 CAI Networks, Inc.

Management Console

After the Initial Configuration, the user should be able to connect a web browser to the WebMux. The web browser does all of the WebMux management. The following sections explain each of the easy to use management console screens. Login Administration Setup Page o Change Password o Set Clock Status Add Farm Modify Farm Add Server Modify Server

Login Start Login Page:

Start a web browser from your management workstation. Set URL to https://webmuxip:webmuxport/cgi-bin/login o webmuxip is the IP address of the WebMux on the server LAN. o webmuxport is the management port address of the WebMux. The default ports are 24 for an unsecured connection, and 35 for the secured connection. Use http instead of https on the URL line if you decide to use port 24 for unsecured communications. (The port number can be changed per your specification, under setup in main management console section). The following login page will appear.
NOTE: In order to use a browser to manage the WebMux, the browser must be set to accept all cookies.

User ID:

There are two preset user IDs Super User - Allows access to all screens and functions provided by the WebMux. WebMux - Does not allow the user to access or change any settings; allows viewing only.

Password:

Fill in the correct password for the selected User ID. The password is case sensitive. The default passwords are: ID Password superuser superuser WebMux WebMux It is recommended to change the passwords periodically. No new user ID can be added.

Login:

After entering the correct password, click Login.
NOTE: For first time setup, please login as superuser and go to the Administration Setup by clicking the Setup button. It is important to set up the Server Farm Gateway IP address and network mask first.
26 Copyright 1997-2005 CAI Networks, Inc.

Main Management Console

Once logged in to the Management Console, this main screen will show. To continue configuring the WebMux, the normal steps are: Click on the Setup button to change administration and setup related information; Click on Add Farm button to add a server farm at a time; Click on the IP address portion of the farm display to add servers; Click on Save button to save the farm/server configuration. Click on services on each farm to adjust the timeout for each kind of services. Note that same protocol services between farms will share the same timeout value.

Add Farm

Click Add Farm to add a virtual web or FTP site. The ADD FARM screen will appear. Please see that section for details.
Changes made to the "Farm" and "Server" will take effect immediately. The changes however are not saved permanently to the flash memory until the "Save" button is clicked. Unsaved farm/server settings will be lost during power outage or WebMux reboot.

SSL Keys

WebMux model 480S, 580SG, 680PG support SSL termination. For models that do not support SSL termination, please ignore this section. WebMux supports SSL V2, SSL V3, and TLS V1 with RSA key length from 512, 1024, and 2048. RSA key length 1024 also called 128bit strong encryption.
28 Copyright 1997-2005 CAI Networks, Inc.
By default, the SSL termination is NOT on. The description here is for model 480S. Other model can be configured similarly. For each WebMux, one can have 16 SSL certificates: Any one can be an active or not active key. The first line of the private key is the comment. See included two sample keys for details. If there is no comment line in the key, it will be blank. If there is no key, it will display (key and certificate unset). During Add Farm action, first select add HTTP farm, then click on the Select SSL Termination. Choosing from any key other than none will enable SSL termination on the HTTP farm. All the HTTPS incoming traffic will be sent terminated to farms on port 80. Please set the port to a clear port, since after the WebMux terminates the SSL traffic, only clear traffic will go to servers. When the servers return traffic back, the WebMux will re-encrypt the data and send back to client. If you are using out-of-path mode, please make sure your servers gateway points to the WebMux server LAN gateway IP; so that the WebMux has the chance to re-encrypt the data before replying back to clients. One can also block not encrypted incoming traffic, so that only encrypted traffic can reach to your server. This might be useful, when you only want encrypted traffic reaching to your servers.

Adjusting Timeout for Each Service
Clicking on the service type on each farm will allow you to change the timeout value of layer 7 testing for each different service. Please note this change is global and will affect all the farms using the same type of service. For example, the default timeout for checking HTTP protocol alive or not is 5 seconds. If the web server does not respond to the WebMux protocol chat within 5 seconds, the WebMux will declare that server is dead and switch that server out from service and notify the operator through email or pager. However, if your web server is not really dead but for some reason not responding to the checking request, the WebMux will false alarm. To avoid this, the user can change the timeout value to a larger value. Many times, servers can not resolve the IP address for the back end of the WebMux IP address and could cause the server to not respond to the WebMuxs protocol checking. Adding the WebMux server LAN IP address and server LAN gateway address to the name resolution table will help resolve this problem. Please read the Q&A section for more information.
34 Copyright 1997-2005 CAI Networks, Inc.
Administration Set Up After login as superuser, click on the setup button, you will come to this screen:

Allowed remote host IPs:

The WebMux management console and diagnostic login only allow logins from these IP addresses to establish a management session. You can access from more than one IP address by specifying all the allowed IP addresses separated by a ":". Netmask following the IP address specify the range of hosts can access management console. For example, 192.168.12.0/24 will allow all hosts in 192.168.12 network to access it. From version 6.4.00, 192.168.12 will be allowed for class C allowed host. If this field is left blank, you can access the management software from any IP address. It is recommended to set this up for security reasons. If wrong IP addresses are entered, management console login Copyright 1997-2005 CAI Networks, Inc. 35
might not be possible. Use the push button controls on the WebMux to clear the allowed host list. This field is blank by default.

Dialout prefix:

Some phone systems require a prefix for outside phone numbers. If a prefix is required, enter it here. Leave it blank if a prefix is not required. For most Analog PBX, this will be 9. Do not enter anything in here, if modem is not connected.

Pager phone numbers:

This is the pager phone number to be dialed when an abnormal condition occurs. Enter the number without any special characters or spaces. It should be in the format of a single long integer. Add 1 and the area code if needed. Do not use "()" or "-" or blank spaces. Do not enter anything in here, if modem is not connected.
Server for email notification:
In addition to paging, the WebMux can send email notifications. Enter the IP address of the email server that will forward the notifications. Please note: Because the WebMux does not resolve names, this entry must be an IP address. Changes to the email server allowing the WebMux to relay messages are necessary.

Front Router Connection Verification:
It can be none, ARP, TCP Connection, or ping. Depending on the front end router, this can be changed. For example, most Cisco routers will talk to the WebMux through ARP and TCP Connection; however, most Cisco DSL modems will only talk to the WebMux through Ping. The change to this verification method will take effect after the WebMux has been rebooted.
38 Copyright 1997-2005 CAI Networks, Inc.
Front Router Connection Verification IP Address:
It can be the router in front of the WebMux, or a router in your ISPs WAN. It is recommended to have the router IP address as the verification IP address. However, it can be any address that is reachable on your Internet side.

Persistence Timeout:

The WebMux will keep track the browser connections if the persistent farm is defined and accessed. Within the timeout time period, the WebMux will send any request from the browser IP address to the same server. Our survey shows 5-6 minutes is the best value for most cases. The larger the persistence timeout value, the less chance user connection get lost. However, by keeping a lot of connections in the WebMux memory, the maximum number of concurrent connections will drop.
Outbound Connection Timeout:
The WebMux keeps track the outbound connections. This outbound proxy function provides communication tunnels for servers behind it to talk to other computers on the Internet side. This type of connection is different from the connections from outside through server farms to the servers. After the connection closed from the servers to the outside computer, it will wait this timeout minutes before it removes that from the tracking table. Setting this too long will cause the WebMux to allocate too much memory, thus reduce the memory for other functions. The default value is 15 minutes. This function has no effect in Out-of-Path mode.

Server Scan Mode:

The WebMux talks to the real servers in the farm through the layer 4-7 protocols every few seconds. This is important process for monitoring servers health situation. If there are a lot of farms and a lot of servers, the WebMux may not be able to get around checking all the servers in few seconds. In concurrent mode, the WebMux will start multiple protocol scanners to chat with servers concurrently. Concurrent mode uses more memory and may have other side effects. For most setups, sequential scan is recommended. URL for Custom Service Check: Sometimes the WebMux built-in server health check is not enough for special needs. When one ASP/JSP servers output depends on the database server and the database server connection is down, one might want to reduce the incoming traffic to the server, suspend new traffic to the server, or totally redirect incoming traffic to a different server. To accomplish that, the WebMux allows a farm being set using a custom defined service. It will then call the CGIs URL on the server defined in this field. This will involve a custom developed CGI code by your software developer on your server and place it on the path. Upon success the page should return HTTP response code 200 and a plain text page beginning with one of the allowed responses. The URL is truncated to 255 bytes (to be a string of at most 256 bytes with a terminating null). The response from the server Copyright 1997-2005 CAI Networks, Inc. 39

service you choose is not listed in the list below, you will need to specify a port number here. For example, for MS Terminal Services, use port number 3389. If you enabled SSL termination (see last chapter), select port 80 for the farm and servers in the farm. The WebMux will terminate all SSL (on port 443) traffic and send them to port 80(DO NOT select port 443 if you enabled SSL termination). For example, if you have five port-80 farms and your WebMux only allows one certificate, the WebMux will use same certificate for all five farms.

Service:

This is the service of the new farm. Select a service type to create a farm using its well-known port. If a port other than a well-known port for TCP or UDP service is to be used, then choose one of the Generic selections, and enter the port number in the PORT NUMBER box. No port number needed to be specified, if the service protocol is on the list. The WebMux has level 7 protocol checks for the known ports in the list. For Custom Defined TCP Service (custom health check), please specify the URL for the CGI code in the setup screen.
CAUTION: Once a farm is created, the port number cannot be changed. Like the IP address, the old farm must be deleted and a new one created, in order to change farm settings. Please choose Generic TCP and specify port number, if service is not listed below. If multiple ports to be used, please also select Generic TCP and specify port number 0.
Service DNS Domain Name Service (TCP) FTP File Transfer Protocol (TCP) HTTP Hypertext Transfer Protocol (TCP) HTTPS Secure Hypertext Transfer Protocol (TCP) HTTP/HTTPS Combined Ports NTP Network Time Protocol POP3 Post Office Protocol SMTP Simple Mail Transfer Protocol (TCP) Generic TCP Generic UDP Generic TCP/UDP Generic no health check (TCP) Generic no health check (UDP) Generic no health check (TCP/UDP) Custom Defined TCP Services Custom Defined UDP Services Custom Defined TCP/UDP Services Custom Defined Paired HTTP and HTTPS (TCP) Service Copyright 1997-2005 CAI Networks, Inc.
Well-Known Port# 80/User Specify User Specify User Specify User Specify User Specify User Specify 80 or User Specify User Specify User Specify User Specify

Scheduling method:

The scheduling method is the way in which traffic is distributed among the servers in the farm. Eight different methods are supported. If you are using a shopping cart service, a persistent scheduling method is recommended. Least connections Least connections - persistent Round robin Round robin - persistent Weighted least connections Weighted least connections - persistent Weighted round robin Weighted round robin persistent Weighted fastest response Weighted fastest response - persistent

Weight:

Scheduling priority weight. Valid integer numbers are between 1 and 100. A server that has a weight of 2 will be directed twice as much traffic as a server with a weight of 1. A special zero weight setting is provided for a graceful shut down of a server. When the weight is changed to zero, the WebMux will not send new connections, but will maintain all current connections to the server. The connections will gradually reduce to zero as current clients sessions terminated. When there are no connections, the server is functionally dead or off line until the weight is changed back to a valid number. Then the server can then be shutdown or taken out of service without affecting any users.
CAUTION: Unlike a server that can go down unexpectedly, the WebMux will not move a STANDBY server to ACTIVE when one or more server's weight is set to zero. If the weight of all the servers in a farm were set to zero, then the farm would be down because none of the servers are accepting new connections.

Run State

Active - The server will be put into service immediately after it is added. However, once it is failed, it will stay Standby mode until manually setting its run state to Active again through the browser interface. This will give system administrator time to fix the system or reboot the server once some software/hardware update is completed. Favorite Active The server will be put into services immediately after it is added. If a Favorite Active server failed, once it is operational, the WebMux will automatically put it back to the Active state. Standby - The server will be put into STANDBY, or backup, mode after it is added. The WebMux will change a STANDBY server to ACTIVE when one or more ACTIVE servers fail. Last Resort Standby The server will be put into STANDBY state, unless all other servers are out of services, this server will not be switch in. This will allow the last server to show a different web page from others.
52 Copyright 1997-2005 CAI Networks, Inc.

Modify Server

Modify Server can be invoked by clicking on the server IP address on the Status screen.
Destination server IP address and port number:
These parameters are set in the Add Server screen. Once set, these fields cannot be modified. To correct this setting, delete the server and add a new one.

205.133.156.210,

servers

A Redundant Installation

Configuration Before WebMux Installation Equipment IP Address Internet Router (or Firewall) Address 205.133.156.1 Webserver(s) Default Gateway 205.133.156.1 Web Site IP Address 205.133.156.200 Configuration Before WebMux Installation Question Primary Host Name Domain Name NAT or Out-of-Path Router LAN Information Router LAN WebMux Proxy IP Address Router LAN Network IP Address Mask Router LAN Network IP Address Router LAN Broadcast IP Address Server LAN Information Server LAN WebMux IP Address Server LAN Gateway IP Address Server LAN Network IP Address Mask Server LAN Network IP Address Server LAN Network Broadcast Address Administration Setup Information External gateway IP address Remake /home/WebMux/conf/passwd Administration HTTP Port Number Secure Administration HTTPS Port Is this WebMux primary WebMux running solo without backup Reboot? webmux1

Entry Secondary webmux2

Cainetworks.com Cainetworks.com NAT NAT
10.1.1.10 10.1.1.1.1 255.0.0.0 10.0.0.0 10.255.255.255
10.1.1.20 255.0.0.0 10.0.0.0 10.255.255.255

205.133.156.1 Y Y N Y

205.133.156.1 Y N
60 Copyright 1997-2005 CAI Networks, Inc.
Direct Routing Installation of WebMux
Configuration Before WebMux Installation Equipment IP Address Internet Router (or Firewall) Address 10.1.1.1 Webserver(s) Default Gateway 10.1.1.1 Web Site IP Address 10.1.1.200/255.255.0.0 Configuration After WebMux Installation Question Entry WebMux Host Name Domain Name NAT or Out-of-Path Server Configuration Server IP address Server NetMask Server Default Gateway Server Default Gateway (if using WebMux for SSL Termination) Server add loopback adapter Route Deletion Refer to Appendix 2 WebMux Server LAN Information Server LAN WebMux IP Address Server LAN Servers IP Address Mask Server LAN WebMux IP Address Mask Server LAN WebMux farm IP Address Server LAN WebMux Broadcast Address Server LAN gateway IP address (Optional, but necessary for WebMux SSL termination. Each servers default gateway needs to be set to this IP.) Administration Setup Information WebMux External Gateway IP address Remake /home/WebMux/conf/passwd Administration HTTP Port Number Secure Administration HTTPS Port Number Is this WebMux primary WebMux running solo without backup Reboot? Copyright 1997-2005 CAI Networks, Inc. Cainetworks.com Out-of-Path
No Change No Change No Change 10.1.1.253 10.1.1.200 10.1.1.200
10.1.2.254 (any) 255.255.0.0 255.255.0.0 10.1.1.200 10.1.255.255 10.1.1.253

10.1.1.1 Y Y Y Y 61

There is no change to each servers IP address, netmask and gateway address (except if using the WebMuxTM for SSL termination. See next paragraph). There is need to add a loopback adapter to each server, and assign the farm address to the loopback adapter. For MS Windows, it always adds a route for the loopback adapter, which will need to be removed, please refer to Appendix 2. In the virtual farm, each server uses its original IP address to join the farm. For SSL termination, you must set server LAN gateway IP address and set the servers default gateway to that IP.

70 Copyright 1997-2005 CAI Networks, Inc.

For WebMux Primary Only

66 - Secondary is not responding. 71 - Primary failed. Secondary took over from Primary. 72 - Primary went back up. Control returns to the Primary.
For WebMux Secondary Only
Appendix 4 Virtual Hosting Issues
Servers serving more than one web site may do virtual hosting. The WebMux supports virtual hosting by checking the virtual servers response. There are three different situations for the WebMux to handle. If the service is HTTPS, there is no way to do virtual hosting on the same IP address. However, each HTTPS farm can be on a different IP address on the same server. The reason that each HTTPS server must have its own IP address is that any web server software, IIS or Apache, can not see the URL in the HTTPS packets, since they are encrypted. The IIS or Apache server only decrypts the URL after the packet is sent to a particular process. Since no web server software supports virtual hosting HTTPS on the same IP address, the WebMux does not need to do anything extra other than load balancing all the packets for that particular farm. If the service is HTTP, then any web server software, IIS or Apache, can host almost unlimited virtual farms on each IP address. Many hosting centers handle this situation by putting all the servers serving each virtual host on a server farm on the WebMux. The WebMux will load balance the traffic for all the incoming traffic for that IP address to different servers in that farm. During farm setup, the label for the farm could be one of the virtual farms base URL, say www.mydomain.com , the WebMux actually periodically reads a page from this URL. If server that serves that URL does not response correctly, the WebMux will mark that server dead. Since every server in that farm serves all the virtual farms, the WebMux expects the problem with one server in one URL will affect all the URLs in that farm. Another situation is the server that serves HTTP virtual sites using a single private IP address already before load balancing. After adding load balancer, some the sites want to have their own IP addresses. The WebMux allows set up separate farm for each site having its own public IP address, but point to the same sets of servers in the private network. In this situation, each separate farm could have its own label as www.site1.com and www.site2.com, etc. The WebMux will actually do health check on each URL by periodically read a default page from that site. In the virtual hosting situation, the label and response from the web servers are critical for reliable services. The WebMux checks the label and checks the server for its health situation based on the URL supplied in the label. If the server response is 500 or greater, which is an error code indicating server internal error, the WebMux will excludes that server from serving the farm. If server responses 402, which indicating access is denied for that virtual farm, the WebMux will mark that server dead. We have checked with IIS server and Apache server, they both follow the same rules.