HaCluster is a Load-balancer service dedicated for Artica Proxy that allows you to build a pool of internet access resource.
Here all main features:
¶ Dedicated Load-balancing service for HTTP proxies
The HaCluster feature is designed to build a pool of clustered proxies with a load-balancing service.
The Pool of proxy can be connected to the Active Directory Service with Kerberos method and/or can using transparent method.
¶ Mixed infrastructure
HaCluster provides the possibility to distribute the load on proxies in connected mode and/or in transparent mode.
This allows it to offer a mixed infrastructure including both Active Directory-connected workstations and nodes without having proxy settings in the browsers.
¶
¶ Microsoft Active Directory support
HaCluster is compatible with Microsoft Active Directory 2008, 2012, 2016, 2019, 2022
It uses the Kerberos method to identify with your Active Directory.
The principle is as follows: The Load-balancing service is the single point that provides the initialization of the Kerberos session.
Backend proxies use the token produced for the Load-balancer to identify credentials sent by browsers.
This means that you must also allow proxies to connect to your Active Directory.
See :
- Prerequisites for the Active Directory connection
- Kerberos connection with a standard account.
- Active Directory connexion wizard
- Adjusting Kerberos encryption types
- kinit: Preauthentication failed while getting initial credentials
¶ Centralized Proxy logs.
HaCluster has features to centralize legal records from web proxy services registered in the farm.
Proxy server logs contain the requests made by users and applications on your network.
This does not only include the most obvious part : web site request by users but also application or service requests made to the internet (for example application updates).
- Centralized logs with HaCluster
- Centrally monitor backend events
- Forward relatime events to a SIEM/log sink
¶ Automatic detection and load investigation.
Most balancers detect an overloaded node by connecting to a listening port and then, calculate the response time.
In many cases, especially with proxy technology, this is not enough.
Indeed the listening port can respond quickly but the machine as a whole is sick.
The HaCluster Client helps the Load-balancing service to correctly judge the right health of backend proxies.
¶ Getting Started
To make this infrastructure, you need at least 3 Artica servers.
|
 |
- Once installed, the left menu will display a new “HaCluster” section.
- Click on the Status menu
The status section displays service status and allow you to restart it, reload it, stop and start.
In the right part you can define which port and listen interface your browser must point to and what is the method used to load-balance proxies.(Lowest connection, Round-Robin, Strict hashed ip).
- How to manage Backends ?
- Tune Health checks
- How to disconnect a backend from the farm ?
- Centrally monitor backend events
- http-check only supports disable-on-404 (v4.30)
¶ FAQ
¶ Artica License.
Your 3 servers (the load balancer and the 2 Artica servers as proxy) must have a valid Artica server license.
¶ Incompatible NAT for the load balancer
When the Artica Load-balancer send order, the Artica Proxy client retrieve the Load-balancer IP from the SSL connection.
This IP address not be masqueraded by a firewall.
If it is the case, Artica Proxy clients will try to communicate directly with the firewall instead of the load-balancer. (If you need this feature, please contact the support to evaluate required development.)
¶ Syslog Port: UDP 514
- The access requests are sent by the clustered proxies trough Syslog.
- Ensure that the UDP 514 port is open from clustered proxies to the Artica load balancer.
¶ Artica HTTPS Port: TCP 9000
- Both clustered proxies and load balancer communicate through RESTful API using the Artica Web console (by default TCP 9000 ).
- Ensure that SSL is enabled on all Artica Web consoles and there is not firewall rules that deny communications between Artica servers.
¶
[SETUP]: Setup Failed Transparent port return failed
It is possible that during the setup, a backend return Failed caused by transparent port is not correctly opened.
In this case, click on the “setup error” icon of the proxy
