MWG Load balancing

[dvillanueva]

Hi,

I need so help, i got 2 physical appliance and I want to configure in Proxy HA clustering. I already configure proxy HA but not load balancing between they happend. We I turn off the director Proxy HA in one appliance the load pass to the other appliance (backup); but when I turn in on again the load pass to the director, and no load balancing between the 2 appliance happen. Does any one knows wich configuration do I need to do.

Thanks

[aloksard · Accepted solution]

Hi,

What is your current MWG version?

Please refer below link for Proxy HA configuration:-

https://community.mcafee.com/t5/Documents/Web-Gateway-Understanding-Proxy-HA/ta-p/553435

Load Balancing

The Director node is receiving traffic from the clients and redirects it to scanning nodes on the kernel level using a built-in load sharing algorithm which takes into account resource usage and active number of connections. So if one scanning node is overloaded, the other will get more traffic to compensate. Generally load balancing is source-IP sticky, meaning the same client should reach the same scanning node. Normally, the active director is also an active scanning node.

Reasons why one box is getting all the traffic:-

• No “Port redirects” configured on the director node. If there is no port redirect the network driver on the director node will not redirect the traffic, but handle it locally.
• All traffic is coming from the same source IP because there is a downstream proxy or a NATing device in place. Proxy HA load balancing is source IP sticky.
• The director does not know about other scanning nodes, you will need to review the HA configuration – use mfend, perhaps they are on different subnets?

Please check output of below commands:-

1) mfend-lb -s     (  This command is used to see the current HA status.)

2) mwg-mon -v -c

mwg-mon

• A health-check process that monitors the Proxy HA redirect ports you defined to ensure that they are available to accept incoming traffic.
• if a redirect port is not listening, then mwg-mon detects this as a failure and load balancing will cease.
• monitors all of the port redirects as a whole and not individually

Regards

Alok Sarda