High availability (failover) configuration for ICAP of ProxyAV units.

book

Article ID: 166905

calendar_today

Updated On:

Products

ProxyAV Software - AVOS

Issue/Introduction

You want to set up high availability (failover) of your ProxyAV units for ICAP services.  Advanced Secure Gateway appliances provide internal Content Analysis ICAP services, (one for request modification and one for response modification). These internal ICAP services cannot be added to an ICAP service group.

Resolution

To set up high availability (failover) of ProxyAV units, an ICAP service group must be configured on the ProxySG.  Create the service group and add the relevant ICAP services to the group. Services within group must be the same type (ICAP).

To do so, go to Management Console--->Content Analysis--->Service Groups. From this location you can create a service group and add multiple ICAP services and define the weight as instructed below:

1. Add a new group:  
 a. Click New; the Add List Item dialog appears. 
 b. In the Add Service Group field, enter an alphanumeric name. This example creates a group called ICAP_Response. 
 c. Click OK. 

2. Highlight the new service group name and click Edit; the Edit Service Group dialog appears. 

3. Select existing services: 
 a. Click New; the Add Service Group Entry dialog appears. 
 b. From the list of existing services, select the ones to add to this group. Hold the Control or Shift key to select multiple services. 
 c. Click OK to add the selected services to group. 

4. Assign weights to services: 
 a. Select a service and click Edit; the Edit Service Group Entry weight dialog appears.  
 b. In the Entry Weight field, assign a weight value. The valid range is 0-255. For conceptual information about service weighting, see Weighting  
 c. Repeat steps a and b for other services, as required. 
 d. Click OK to close the dialog.  
 e. Click OK again to close the Edit Service Group Entry dialog 
5. Click Apply. 

When instructed by created policies, the ProxySG sends ICAP response modification requests to ICAP servers in the service group. The load carried by each service in the group is determined by the weight values.

After you have created a service group you can add it to an ICAP Response Service object in policy. This configuration is used for load balancing and failover as the ProxySG will only send connections to the available ICAP service(s).