Clusters

Clusters

Help | Content Gateway | Version 7.7.3

Related topics:

SSL Manager clustering

Changing clustering configuration

Adding nodes to a cluster

Deleting nodes from a cluster

Virtual IP failover

Websense Content Gateway scales from a single node to a cluster of 15 or more nodes, allowing you to quickly increase capacity and improve system performance and reliability.

Content Gateway detects the addition and deletion of nodes in the cluster and can detect when a node is down.

You can add or delete a node from a cluster at any time.

When you remove a node from the cluster, Content Gateway removes all references to the missing node.

Restarting a node in the cluster causes all nodes in the cluster to restart.

When the Virtual IP failover feature is enabled, the live nodes in a cluster can assume a failed node's traffic.

Nodes in a cluster automatically share configuration information.


	Note Filtering Service and Policy Service IP addresses are not propagated around the cluster. In transparent proxy deployments with WCCP, the service group Enabled/Disabled state and Weight settings are not propagated. See Transparent interception with WCCP v2 devices.

Content Gateway uses a proprietary protocol for clustering, which is multicast for node discovery and heartbeat, and unicast for all data exchange within the cluster.


	Important It is recommended that a dedicated network interface be used for Content Gateway cluster communication, except when the host is a V-Series appliance, in which case the P1 (eth0) interface is recommended.


	Important In a proxy hierarchy, the nodes in the cluster cannot be a mixture of HTTP parents and children; you must configure each node in a Content Gateway cluster as a single node in the hierarchy because they share a common configuration.

Management clustering

Help | Content Gateway | Version 7.7.3

In management clustering mode, you can administer all Content Gateway nodes at the same time because cluster nodes share configuration information.


	Note The number of nodes in a cluster can be 15 or more. For assistance with scaling your deployment, contact your Websense account representative.

Content Gateway uses a multicast management protocol to maintain a single system image of all nodes in the cluster.

Information about cluster membership, configuration, and exceptions is shared across all nodes.

The content_manager process propagates configuration changes to cluster nodes.

When SSL Manager is enabled, the SSL configuration can be propagated around the cluster, however it uses a separate mechanism. See the next section.

SSL Manager clustering

Help | Content Gateway | Version 7.7.3

When SSL Manager is enabled in a cluster, SSL configuration information can be propagated around the cluster, however it uses a different mechanism that requires separate configuration.

To configure SSL Manager to propagate configuration information around the cluster, one node must be selected as the primary node on which all SSL configuration changes are made. The primary is known as the SSL Manager Configuration Server. All other nodes are secondaries.

Settings made on the primary are propagated to the secondaries.

Secondaries periodically poll the primary to see if changes are pending. If changes are pending, each secondary pulls them down.

If configuration changes are made on a secondary, they are overwritten when the master configuration is pulled from the primary.

Should the primary go down, an alarm is generated and the secondaries continue to operate with their current configuration until the primary returns to service or a new primary is configured.

When SSL Manager clustering is configured, the following configuration settings are propagated:

The IP address of the primary

Configure > SSL > Certificates > Certificate Authorities

Configure > SSL > Certificates > Add Root CA

Configure > SSL > Certificates > Restore Certificates

Configure > SSL > Decryption / Encryption: all settings

Configure > SSL > Validation: all settings

Configure > SSL > Client Certificates: all settings

Configure > SSL > Logging: all settings

Configure > SSL > Internal Root CA > Import Root CA

Configure > SSL > Internal Root CA > Create Root CA

Dynamically generated certificates and incidents

Configuring SSL Manager clustering:

1.	Configure and start Management Clustering. See Changing clustering configuration.

2.	On any node in the cluster, log on to Content Gateway Manager.

3.	Go to the Configure > My Proxy > Basic > Clustering tab.

4.	In the SSL Manager Configuration Server field, enter the IP address of the SSL Manager Configuration Server (the primary). If the field is not editable, the system is not a member of a cluster.

5.	Click Apply and restart Content Gateway. Note that all Content Gateway nodes are restarted. The restart identifies the primary to all cluster members and activates SSL clustering.

The configuration can be confirmed on the Monitor > My Proxy > Summary page, at the bottom of the Node Details section. If the SSL Manager Configuration Server IP address is a link, the server is another node in the cluster. Click the link to log onto the SSL Manager Configuration Server.

Clusters

Support

Search

Article Rating:

Related Articles

Quick Links

Service Requests

How are we doing?