Layer 7 LB + SSL question

[viniciuscarvalho]

Hello there! We are adding a new node to our jboss web servers and we will use a layer 7 switch to load balance the requests.

We were thinking in using SSL only at the switch layer, and make all the connections from the switch to jboss web using only http port, and from the switch to the internet using https.

Well, it seems that we hit a deadlock, since our apps use <transport-guarantee>confidential. Since the switch only communicates with the jboss using http port, it will enter in an infinite loop.

Disabling the transport-guarantee we faced other problems, when struts try to redirect our requests from https://ourserver/app to /app/index.do, it does not force https :(

I could not find any docs on jboss or apache, or even googling it, regarding network topology using a layer 7 switch + ssl and jboss.

Is it really needed to use SSL connector on jboss web even with a layer 7 switch in front of it?

[jfclere]

What is a " layer 7 switch"? - Please explain -
You have to use AJP to forwarding the ssl information to JBoss.

Or configure the " layer 7 switch" so that is behaves like httpd as described in http://www.jboss.org/community/wiki/SSLModproxyForwarding.

Or tell the http port is secure in the connector by having secure="true" in the connector (in server.xml) but that is only if you don't use client certificates to make the authentication.

[viniciuscarvalho]

What is a " layer 7 switch"? - Please explain -
You have to use AJP to forwarding the ssl information to JBoss.

Or configure the " layer 7 switch" so that is behaves like httpd as described in http://www.jboss.org/community/wiki/SSLModproxyForwarding.

Or tell the http port is secure in the connector by having secure="true" in the connector (in server.xml) but that is only if you don't use client certificates to make the authentication.

http://en.wikipedia.org/wiki/Multilayer_switch. Its a ordinary router with a ssl accelerator. We got it working by using the secure=true, but that was not the desired since now, even with the user accessing a confidential context through http he can access it with no problems.

We are still trying different approaches (like having an Apache in front of jboss in order to forward traffic through AJP)

Regards

[jfclere]

Apache httpd fronting JBoss is probably what you need. We will be happy to help :-)