KEMP Technologies releases a statement about their KEMP LoadMaster line of application delivery controllers and the recent Logjam vulnerability, also known as CVE-2015-4000.
In short, the LoadMaster products do not use the weak DHE_EXPORT cipher suites and are NOT vulnerable for Logjam exploits. Reed the full statement here.
If you deploy a KEMP LoadMaster to load balance Exchange (which you should!) you may see an unusual behavior where the LoadMaster treats a service failure incorrectly as a server failure. First let me explain a very typical configuration example to demonstrate the issue, after that I'll explain how to fix.
I won't go into the details of deploying the LoadMaster or Exchange 2013, if you're reading this article you're supposed to have a good understanding of Exchange 2013 load balancing and the basics of working with the KEMP LoadMaster.
I start my configuration by downloading the latest Exchange 2013 Templates from the KEMP Technologies website. In this example I used Core services: MAPI, SMTP and Unified HTTP/HTTPS because I'm not going to enable ESP for this service.
So a new Virtual Service is created with the Exchange 2013 HTTPS Reencrypted template.
Next step is to assign a SSL certificate to the Virtual Service:
And add the real servers to all nine sub-Virtual Services:
The result is a nice and healthy Virtual Service:
So far so good? Well, almost… Let's see what happens when one of our Real Servers encounters an issue. To do so we simulate an unhealthy OWA, resulting in having Managed Availability no longer reporting a 200 OK when the /owa/healthcheck.htm url is queried.
Set-ServerComponentState ex01 -State inactive -Component owaproxy -Requester healthapi
Now if we check the health of the Virtual Service in the KEMP WUI we expect it to report an unhealthy Real Server for the OWA sub-Virtual Service. Instead it displays a failed RS for all services:
In the Warning Log is an endless series of these error messages:
Mar 30 13:56:04 lb100 l4d: Removing RS 192.168.200.182:443 from VS 192.168.200.200:443(E2013HTTPS) - EOF or Incorrect data received
Mar 30 13:56:04 lb100 last message repeated 5 times
Mar 30 13:56:13 lb100 l4d: Adding RS 192.168.200.182:443 to VS 192.168.200.200:443(E2013HTTPS)
Mar 30 13:56:13 lb100 last message repeated 5 times
Mar 30 13:56:13 lb100 l4d: Removing RS 192.168.200.182:443 from VS 192.168.200.200:443(E2013HTTPS) - EOF or Incorrect data received
Mar 30 13:56:13 lb100 last message repeated 5 times
Mar 30 13:56:22 lb100 l4d: Adding RS 192.168.200.182:443 to VS 192.168.200.200:443(E2013HTTPS)
Mar 30 13:56:22 lb100 last message repeated 5 times
I worked with KEMP Support to troubleshoot this unexpected behavior and the root cause was found pretty fast. By default the Real Server Check uses HTTP/1.1 to query the healthcheck.htm url, as can be seen here:
My recommendation is to disable the Use HTTP/1.1 feature of all subVS to restore normal behavior.
KEMP Support, as always, was great to assist us with this issue. I left a Feature Request to ask them to update the Exchange Templates to remove the HTTP/1.1 checkbox by default.
This is very cool! KEMP gives away the LoadMaster Application Delivery Controller for free. The LoadMaster for Azure was already free, now the virtual appliance is available in a free edition too. Available for all supported hypervisors (VMware, Hyper-V, KVM, Xen, Oracle VirtualBox).
The free VLM has some limitations, for instance the HA setup with an active and hot stand-by unit is not supported. Another important limitation is that the free LoadMaster doesn't come with the awesome support paying customers receive. Also there are some bandwidth and SSL TPS limitations, all in all not much special for most home, lab, testing and other non-production deployments.
Get yours now at http://freeloadbalancer.com/
The KEMP Technologies LoadMaster range of load balancers goes from very affordable entry level models up to the real work horses. To choose the right option you need to think about the number of network interfaces you need, how many real or virtual servers you want to be able to use and estimate your expected throughput and SSL TPS.
Of all those parameters SSL TPS is the one that confuses some people.
SSL TPS is the number of SSL (Secure Sockets Layer) Transactions per Second. First we need to understand what a Transaction is. A SSL transaction consists of three phases:
The Session Establishment phase is the most expensive from a performance point-of-view. This is where the authentication and handshake, key exchange takes place and the encrypted sessions basically is created. The Data Transfer phase is where the actual data is being transferred and during the Session Closure phase the client and server tear down the connection.
So TPS is the number of new SSL sessions per second, not to be confused with concurrent (already established) SSL sessions.
Creating a SSL session requires CPU resources and our common x86 processors are not particularly good at this task. This is why certain ADCs have a dedicated CPU to perform this task, this is called an ASIC (Application Specific Integrated Circuit). The LoadMaster LM-2600, LM3600 and LM-5400 are examples of ADCs with an SSL ASIC. Traditionally an ADC with SSL ASIC was used to offload the SSL traffic and transfer the traffic over unencrypted HTTP to the real server.
Today SSL offloading enables the ADC to perform L7 task such as content switching and Intrusion Prevention Detection (IPS). And with the power of modern hardware it's common practice to even re-encrypt the traffic again before it leaves the ADS to the real server.
To calculate the expected SSL TPS you need to understand both the traffic characteristics of your application as well as the expected load the users will cause.
For a typical HTTP application you need to understand:
Plan for peak usage, burst load can be up to three or four times the average load.
A more hands-on and practical way to determine SSL TPS may be to simply measure it from a production or lab deployment. If you don't have an existing solution in place to measure, I suggest you download a trial version of the KEMP LoadMaster VLM. The VLM comes with a 30 days temporary license which should be sufficient to perform some tests in your environment.
After you created the Virtual Service and directed users to the LoadMaster you can read the TPS and throughput in real-time in the System Metrics section of the Home page.
This screenshot is taken from a small Exchange 2013 environment with ~700 active users with Outlook Anywhere in Online Mode and an average of 1.5 ActiveSync device per user.
This customer plans to use the LoadMaster for several other applications in the near feature. The choice for the VLM-2000 with its 2 Gbps throughput and up to 1.000 SSL TPS seems to be the right one, this unit offers more than enough performance with sufficient headroom for peak usage.
An alternative approach would be to enable SNMP on the LoadMaster:
The MIB can be located under the Tools section of the LoadMaster Documentation site. Then use your favorite SNMP tool to collect and log the data, for instance Peassler's PRTG.
| Model |
VLM-200
|
VLM-2000
|
VLM-5000
|
VLM-10G
|
 |  | | | |
| Doorvoer (licentie) |
200 Mbps
|
2 Gbps
|
5 Gbps
|
10 Gbps
|
| SSL TPS (licentie) |
200
|
1.000
|
10.000
|
12.000
|
De titel is een beetje cryptisch, maar dit gaat natuurlijk over de nieuwste software voor de KEMP LoadMaster load balancers. Even geleden schreef ik over versie 7.0-8 en de vernieuwingen die deze brengt. Kort daarna heeft KEMP deze vervangen voor versie 7.0-8a, inderdaad het zelfde versienummer maar dan met één letter toegevoegd.
Er is een probleem ontdekt waarbij de reverse proxy-functionaliteit van het Edge Security Pack stopt met werken. In de logfile staat dan een segfault fout:
Sep 30 11:44:24 LB02 kernel: ssomgr[27053]: segfault at 4 ip 0804fc29 sp 6f470100 error 4 in ssomgr[8048000+41000]
De oplossing zit dus in v7.0-8a, vraag hem snel aan bij KEMP Support.
Vandaag is versie v7.0-8 uitgekomen van de KEMP LoadMaster software. Big deal? Toch zeker wel want er zit weer een aantal mooie verbeteringen in. In dit artikel behandel ik er een paar van.
KEMP Technologies heeft een update uitgebracht van de LoadMaster software. Dit is de tweede update van de nieuwe 7.0 software die eerder dit jaar beschikbaar kwam en onder andere het Edge Security Pack introduceerde. Een andere opvallende verandering in 7.0 is de verbeterde webinterface, die weliswaar nog steeds voor verbetering vatbaar is maar een stuk moderner aanvoelt en logische ingedeeld is.
In 7.0-6 worden een aantal nieuwe features geïntroduceerd, bestaande features verbeterd en bugs verholpen. Onder die verbeterde features valt bijvoorbeeld het werken met certificaten, real servers en de afhandeling van health checks op ESP virtual services. Ook zijn er een paar nieuwe talen toegevoegd voor de ESP imagesets:
Het is helaas nog niet mogelijk om aangepaste image sets toe te voegen, dat is wel jammer. Maar als work-around kun je voor Blank kiezen en in de SSO Greeting Message een HTML-string met bijvoorbeeld een link naar een logo opnemen.
Al met al raad ik aan om deze update te installeren. Wel heb je minimaal versie 6.0-42 nodig om te kunnen upgraden, maar die is alweer meer dan een half jaar geleden uitgebracht dus de kans is groot dat je al op een hoger patchlevel zit. Gebruikers van de VLM-100 of VLM-1000 die versie 7.0 en ESP willen gaan gebruiken moeten hiervoor een nieuwe VLM uitrollen, het wordt niet ondersteund om ESP in te schakelen op een ge-upgrade VLM.
Na het uitvoeren van de upgrade dien je de cache van je browser (in ieder geval voor het adres van de LoadMaster) te verwijderen.
Je vind informatie over updates van de firmware hier: http://forums.kemptechnologies.com/index.php?p=/categories/news De laatste release notes kun je hier downloaden: Full Release Notes. Nieuwe firmwares zoals deze zijn gratis beschikbaar voor alle klanten met een geldig supportcontract, aanvragen van de firmware doe je bij KEMP Support.
