ddesmidt's Posts

Larsonm aslready gave an answer. As explained, the default cipher is: AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH (takes the strongest of AES first. Then the strongest of any cipher but RC4. At last the strongest of RC4. And in any case it will accept a client with no encryption neither authentication). The syntax used to specify the supported cipher is the one from OpenSSL: https://www.openssl.org/docs/apps/ciphers.html For instance: To allow only TLSv1.2, use the cipher “!SSLv3:ALL” Note: This cipher does not allow TLSv1.0 nor TLSv1.1. Dimitri

Three are multiple ways (like always in load balancers) to achieve the same thing. Here are a few examples of possible options: OPTION1: In case of servers in the primary pool are all dead, use servers in the secondary pool Create an Application Rule (Under "Edge – Manage /  Load Balancer / Applications Rules") # detect if pool "pool_production" is still UP acl pool_production_down nbsrv(pool_production) eq 0 # use pool "pool_sorry_server" if "pool_production" is dead use_backend pool_sorry_server if pool_production_down Apply that Application Rule to the Virtual Server (Under "Edge – Manage /  Load Balancer / Virtual Servers") OPTION2: Redirect EVERYTHING to maintenance site Create an Application Rule (Under "Edge – Manage /  Load Balancer / Applications Rules") redirect location http://maintenance.xyz.com/maintenance.htm Apply that Application Rule to the Virtual Server (Under "Edge – Manage /  Load Balancer / Virtual Servers") OPTION3: Use a specific maintenance server pool + rewrite all URL to /maintenance.php Create an Application Rule (Under "Edge – Manage /  Load Balancer / Applications Rules") # Match everything acl match_all always_true use_backend maint_pool if match_all # Rewrite all url with "/maintenance.html" reqirep ^GET\ (.*)\ HTTP/(.*)  GET\ /maintenance.php\ HTTP/\2 Apply that Application Rule to the Virtual Server (Under "Edge – Manage /  Load Balancer / Virtual Servers") Dimitri

Just for other readers: Hardware VTEP allows L2 VXLAN/VLAN connectivity. That's for the use case where you have VMs on a VXLAN logical switch (10.1.1.11/24)  and you want them L2 connected to physical servers on a VLAN (10.1.1.21/24). NSX offers native VXLAN/VLAN connectivity too: 1. with DLR bridging (used for Logical/Physical L2 connectivity within a DC) 2. with L2 SSL-VPN (used for Logical/Physical L2 connectivity with a remote location) NSX-v 6.2 (planed early Q3) will support Hardware VTEP. Contact your physical switch vendor to see if it will support integration with NSX-v. Important Note: HW VTEP will be incompatible with NSX Distributed Logical Router function. In other words the subnet (10.1.1.0/24) extended from Logical (VXLAN) to Physical (VXLAN) via HW VTEP won't be able use a dist L3 (only central L3). When using NSX-v 6.2 native VXLAN/VLAN bridging, you'll be able to combine VXLAN/VLAN bridging and still enjoy Dist L3 for that subnet. Dimitri

The AppRule in the VMware documentation looks good to me. I would need to see your AppRule and a trace from your browser on the http request you send to the Edge-VIP. Note: Also validate your VIP is type HTTP and not TCP to be able to use the Application Rule. Here is another example with comments that may help you: # Check if host is "app1.xyz.com" (case insensitive) acl host_app1 hdr(Host) -i app1.xyz.com # Check if host is "app2.xyz.com" (case insensitive) acl host_app2 hdr(Host) -i app2.xyz.com # Check if host is "app3*" (case insensitive) acl host_any_app3 hdr_beg(host) -i app3 # Use specific pool for each hostname use_backend pool_app1 if host_app1 use_backend pool_app2 if host_app2 use_backend pool_app3 if host_any_app3 #for everything else, use the pool defined in the Virtual Server Dimitri

I tried your ACL with success. "/api*" go to api_pool. other urls go to ui_pool. In term of documentation, there are examples in our Admin Guide but not an exhaustive AppRules documentation. The Admin Guide points to the haproxy manual since the Edge is using the haproxy "straight". Note: There would be no point of recreating something that already exists. Could you send: The config of your Edge show configuration loadbalancer The trace taken from the Edge debug packet capture interface vNic_0 host_10.0.1.6 (where "vNic_0" is the Edge interface where the VIP is listening and "10.0.1.6" is the VIP@) debug copy scp root@20.20.20.199: tcpdump_vNic_0.0 (to export the trace taken) Thanks, Dimitri