Using external Load Balancer

Application Load Balancing (Layer 7)

This page provides information about recommended ways to use sessions with a Layer 7 load-balancer.

Most load-balancers have the ability to provide cookies for pinning subsequent traffic from a client to the appropriate server. This method is called sticky session, session persistence or session affinity. Using cookies efficiently requires the client to know when a cookie should be sent, should not be sent or should be deleted.

Sticky session load balancing

Each MetaDefender Core instance has its own databases and application sessions that cannot be seen by other instances. Therefore, in order to get the related data/response to our queries we should ask the appropriate MetaDefender Core v5 server. On the other hand, to keep the advantages of the used load balancing method, cookies should not be sent if it is not necessary.

Single file scanning

Stage	Task	Cookie usage
Sending file	Initiate processing a file on the client side. Send file through the load-balancer. (See POST File Analysis)	Cookie should not be sent
Sending file	Save the cookie and the data_id you got from the load-balancer	Save cookie
Getting result	Request result related to data_id saved in step 2. (See GET File Analysis)	Send cookie saved in step 2
Getting result	If processing is in progress (See GET File Analysis), wait a little while and repeat step 3.	Send cookie saved in step 2

Batch scanning

Stage	Task	Cookie usage
Open batch	Initiate processing file(s) in batch. Request a batch ID through the load-balancer. (See POST Initiate Batch)	Cookie should not be sent
Open batch	Save the cookie and the batch_id you got from a Core server through the load-balancer.	Save cookie
Sending files	Send file through the load-balancer. (See POST File Analysis (using batch header))	Send cookie saved in step 2
Sending files	Save the data_id you got from the load-balancer.
Sending files	Status/result of scanning of sent files can be queried: (See GET File Analysis)	Send cookie saved in step 2
Sending files	Repeat step 3-4. with files wanted to be in the same batch.
Getting batch status	See GET Batch Status	Send cookie saved in step 2
Close batch	Tell the server that no more files will be sent to this batch. (See POST Close Batch). (This will only be successful if all the files sent to the batch have been processed already. Repeat this step until batch is closed.)	Send cookie saved in step 2
Getting results	Request results related to batch ID saved in step 2. (See GET Download Batch Signed Result	Send cookie saved in step 2

If it does not matter which upstream server responds, the queries should be sent without cookie.

Info

It is recommended not to send cookies when it's not necessary to allow load-balancer to use its own method to share the load between MetaDefender Core v5 servers.

Limitations, additional notes

Using load-balancing between MetaDefender Core servers does not support:

Global scan history
Core server administration through load-balancer

OPSWAT products that support HTTP load balanced MetaDefender Cores

Product name	Minimum version	Further information
MetaDefender Kiosk	4.3.4
OPSWAT Client	Windows: 7.6.247.0 Mac: 10.4.243.0
MetaDefender Email Security	4.3.0
MetaDefender ICAP Server	4.3.0
MetaDefender Vault	1.3.0
MetaDefender for Secure Storage	2.0.7

DNS Load Balancing

Using this method is logically similar to Layer 7 load-balancing.

Briefly how it works

Client uses a domain name to send a query to a server. Client's DNS server has more "A" records for that name with different IPs. When a client resolves the server's domain name DNS server randomly chooses an IP for that name to send back. When a session is used on the application layer, client should know the IP address of the Core server that handles that specific session. In every other case, client should resolve the domain name with DNS query to let requests to be balanced between MetaDefender Core servers.

Single file scanning

Stage	Task	Addressing
Choose a Core server by using DNS load balancing	Resolve the Core servers' common domain name.	Use domain name
Choose a Core server by using DNS load balancing	Save the IP gotten from the DNS server.	Save the IP
Sending file	Initiate processing a file on the client side. (See POST File Analysis)	Use IP saved in step 2
Sending file	Save the data_id got from the Core server
Getting result	Request result related to data_id saved in step 2. (See GET File Analysis)	Use IP saved in step 2
Getting result	If processing is in progress (See GET File Analysis), wait a little while and repeat step 3.	Use IP saved in step 2

Batch scanning

Stage	Task	Addressing
Choose a Core server by using DNS load balancing	Resolve the Core servers' common domain name.	Use domain name
Choose a Core server by using DNS load balancing	Save the IP gotten from the DNS server.	Save the IP
Open batch	Initiate processing file(s) in batch. Request a batch ID. (See POST Initiate Batch)	Use IP saved in step 2
Sending files	Send file to the specific Core server with the basch ID saved in step 3. (See POST File Analysis (using batch header))	Use IP saved in step 2
Sending files	Save the data_id you got from the Core server.
Sending files	Status/result of scanning of sent files can be queried: (See GET File Analysis)	Use IP saved in step 2
Sending files	Repeat step 3-4. with files wanted to be in the same batch.
Getting batch status	See GET Batch Status	Use IP saved in step 2
Close batch	Tell the server that no more files will be sent to this batch. (See POST Close Batch). (This will only be successful if all the files sent to the batch have been processed already. Repeat this step until batch is closed.)	Use IP saved in step 2
Getting results	Request results related to batch ID saved in step 2. (See GET Download Batch Signed Result).	Use IP saved in step 2

Limitations, additional notes

Using load-balancing between MetaDefender Core servers does not support:

Global scan history
Core server administration via DNS load-balancing

OPSWAT products that support DNS load balanced MetaDefender Cores

Product name	Minimum version	Further information
MetaDefender Kiosk	does not support yet
MetaDefender Client	does not support yet
MetaDefender Email Security	does not support yet
MetaDefender ICAP Server	does not support yet
MetaDefender Vault	does not support yet

Last updated on

Was this page helpful?