How to configure load balancing, weighting or failover across multiple ICAP servers.

Products

• ProxyAV Software - AVOS
• Content Analysis Software - CA
• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS

Issue/Introduction

This article describes how to configure load balancing, weighting or failover across multiple ICAP servers. This only applies to configurations changes applied through the External Services settings within the Management Console. It does not apply for the ICAP services located under the Malware Scanning settings.

The ProxySG appliance supports weighted load balancing in forwarding requests through the use of service groups. By default, the appliance performs typical round-robin load balancing and evenly forwards requests sequentially to servers as defined within the service group. Manually assigning weights takes advantage of round-robin load balancing in service groups that are not homogeneous, or where the servers have different capacities.

Weighting determines what proportion of the load one server bears relative to the others. If all servers have either the default weight (1) or the same weight, each share an equal proportion of the load. If one server has weight 25 and all other servers have weight 50, the 25-weight server processes half as much as any other server. If a server has a weight 0, no traffic will be sent to this server, if all servers have a weight of 0 then ICAP with will fail In the event of a 'Fail_Closed' ICAP rule in the VPM users will be unable to browse and will receive an ICAP error.

To assign weights to ICAP services in a service group using the Management Console:

1. Select Configuration > External Services > Service Groups.
2. If necessary, create and name a new service group by clicking New.
3. If necessary, add ICAP services to the service group by editing the service group.
4. To edit the weightings, select the service group and click Edit. From the Service Group list, select the service and click Edit.
5. Set the desired weighting for the service (from 0-255), and then click OK > OK, and Apply.

In order to configure ICAP services to do an active-passive failover instead of load balancing, when configuring the ICAP Request/Response object through policy in a Web Content Layer, you need to use ICAP services directly instead of using service groups. This way, the ProxySG will send ICAP traffic to the first ICAP service on the list, and if it fails to send it, it will attempt to do so with the next one.

Resolution