Using Flash Media Server Edge Servers Trademarks 1 Step RoboPDF, ActiveEdit, ActiveTest, Authorware, Blue Sky Software, Blue Sky, Breeze, Breezo, Captivate, Central, ColdFusion, Contribute, Database Explorer, Director, Dreamweaver, Fireworks, Flash, FlashCast, FlashHelp, Flash Lite, FlashPaper, Flash Video Encoder, Flex, Flex Builder, Fontographer, FreeHand, Generator, HomeSite, JRun, MacRecorder, Macromedia, MXML, RoboEngine, RoboHelp, RoboInfo, RoboPDF, Roundtrip, Roundtrip HTML, Shockwave, SoundEdit, Studio MX, UltraDev, and WebHelp are either registered trademarks or trademarks of Macromedia, Inc. and may be registered in the United States or in other jurisdictions including internationally. Other product names, logos, designs, titles, words, or phrases mentioned within this publication may be trademarks, service marks, or trade names of Macromedia, Inc. or other entities and may be registered in certain jurisdictions including internationally. Third-Party Information This guide contains links to third-party websites that are not under the control of Macromedia, and Macromedia is not responsible for the content on any linked site. If you access a third-party website mentioned in this guide, then you do so at your own risk. Macromedia provides these links only as a convenience, and the inclusion of the link does not imply that Macromedia endorses or accepts any responsibility for the content on those third-party sites. Jabber is a registered trademark of the Jabber Software Foundation. SorensonTM SparkTM video compression and decompression technology licensed from Sorenson Media, Inc. Copyright © 2002-2005 Macromedia, Inc. All rights reserved. This manual may not be copied, photocopied, reproduced, translated, or converted to any electronic or machine-readable form in whole or in part without written approval from Macromedia, Inc. Notwithstanding the foregoing, the owner or authorized user of a valid copy of the software with which this manual was provided may print out one copy of this manual from an electronic version of this manual for the sole purpose of such owner or authorized user learning to use such software, provided that no part of this manual may be printed out, reproduced, distributed, resold, or transmitted for any other purposes, including, without limitation, commercial purposes, such as selling copies of this documentation or providing paid-for support services. Acknowledgments Project Management: Suzanne Smith Writing: John Norton, Suzanne Smith Editing: Evelyn Eldridge, Mary Ferguson, Lisa Stanziano, Anne Szabla Production Management: Adam Barnett Media Design and Production: Aaron Begley, Paul Benkman, John Francis, Mario Reynoso First Edition: October 2005 Macromedia, Inc. 601 Townsend St. San Francisco, CA 94103 Contents Using Edge and Origin Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Introducing edge servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 How edge servers work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Caching data in edge servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Deploying edge servers in the DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Explicit and implicit proxies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Reverse proxies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 Routing information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Connecting to an edge server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Detecting the presence of proxy servers . . . . . . . . . . . . . . . . . . . . . 13 Chaining edge servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Configuring edge servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Deploying a cluster of edge servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Connecting to a cluster of edge servers . . . . . . . . . . . . . . . . . . . . . . 16 Enrolling proxy servers in the cluster . . . . . . . . . . . . . . . . . . . . . . . . 16 Accessing applications through an edge cluster . . . . . . . . . . . . . . 16 Clustering reverse proxies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Setting up origin and proxy servers . . . . . . . . . . . . . . . . . . . . . . . . . 18 Maintaining edge server clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Clearing the edge server cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 3 4 Contents Using Edge and Origin Servers This chapter describes the various strategies for deploying Flash Media Server with edge and origin servers. Introducing edge servers Until this release of Flash Media Server, clients always connected directly to the computer where the application was running. These applications were running locally, since their execution occurred on the same computer that the clients were connected to. This release of Flash Media Server introduces the concept of remote execution of applications. Flash Media Server can now run applications locally as an origin server or remotely as edge servers. Edge servers are not a different kind of Flash Media Server, rather, they are configured to run applications remotely. Deploying edge servers in your organization offers significant benefits. Enhanced security is one benefit. Applications running on the origin server are no longer directly exposed to the Internet. All requests for Flash Media Server services are routed through known and secure connection points. These connectors are called edge, or proxy, servers; the terms are interchangeable. Administrators can monitor the traffic on edge servers. The access log files for each edge server lets administrators verify that the connections are authorized. The log files also identify unauthorized requests for connections. The edge server-origin server deployment is flexible. Edge servers let administrators scale up or redistribute access to Flash Media Server without dismantling their current deployment. Administrators can add edge servers. Administrators can reallocate edge servers to match realignments of users and sites within an organization, or changes in the flow of traffic among the sites. 5 Deploying edge servers lets administrators distribute the incoming connection requests for Flash Media Server services. Traffic between clients and the origin server uses the existing bandwidth and system resources more efficiently. More traffic occurs locally between the clients' computers and the edge server. Without edge servers, all clients have to connect to a Flash Media Server origin server, no matter where that server is located. Edge servers mediate communications traffic between the organization's trusted network and an untrusted network such as the Internet. Using edge servers does not remove the need for a firewall to manage the traffic at an IP level, but does provide an additional layer of security at the application level. How edge servers work With an edge-origin deployment strategy, all connection requests from users' computers for Flash Media Server services are redirected to an edge server. The edge server receives the request from the user's computer, but the edge server is not running the application. The edge server makes the connection to another computer, called the origin server, where the application is running. When the origin server fulfills the request for Flash Media Server services, it sends the application's data back to the edge server, which in turn forwards the data to the client (the user's computer). It may seem to the users that they are directly connected to the origin server where the application is located. The edge server does make it appear as if it is running the application. The edge server's role, however, is to mediate the communications between clients and the origin server. Edge servers authenticate the users and authorize their requests for web services. For example, when Flash Media Server is deployed solely on one computer and is running just one application instance, system and network resources may not always be sufficient when a large number of users in an organization want to connect almost simultaneously to Flash Media Server from multiple locations. Such might be the case in an enterprise-wide meeting or conference. When too many users want to access the same application at the same time, the existing bandwidth and system resources can be overwhelmed. Increased latency is another indication that resources need to be reconfigured or reallocated. Every connection into the origin server consumes resources independent of the actual data flowing through the connection. As the number of connections increase, this load can become inordinately large and adversely affect the server performance. The edge server greatly mitigates this problem by aggregating connections. The edge multiplexes the connections from a large number of clients on to one connection to the origin server. 6 Using Edge and Origin Servers Such constraints may prompt the Flash Media Server and network administrators to consider a different deployment strategy. The strategy involves configuring Flash Media Server to redistribute the load on system and bandwidth resources by running some virtual hosts as edge servers and other virtual hosts as origin servers. Rather than forwarding every request to the origin server and consuming resources for such repetitive tasks, the edge server collects the requests from a large number of clients and aggregates them into one connection to the origin server. All communications between edge and origin servers happen transparently to the users. End User End User End User End User End User Edge Server Tokyo End User End User Origin Server Chicago End User End User End User Edge Server Paris To distribute the demands on network and system resources, administrators can assign the users in a geographical region or functional area of the organization to a specific edge server. For example, one edge server might aggregate and forward requests from users in Tokyo and another might aggregate and forward requests from Paris. The edge servers in Paris and Tokyo gather the requests from their clients and forward them to the origin server located in another secured location, such as Chicago. Introducing edge servers 7 Users in these zones always access the origin server through their assigned edge servers. These edge servers receive the responses from the origin server, then distribute them back to the clients (the users' computers) in their respective zones: Paris or Tokyo. The edge also stores the data received from the origin server in a cache, and makes it available to other clients that connect to this edge server. Recycling the data is one more way that edge servers use resources efficiently. Caching static content reduces the overall load placed on the origin server. A networked Flash Media Server deployment involves multiple edge servers; these can be deployed individually or in clusters. Edge servers can also be chained, where one edge server collects and aggregates the connection requests from other edge servers and their clients, then transmits the requests to an origin server. Edge Server Client (Users) Client (Users) Client (Users) Client (Users) Edge Server Edge Server Edge Server Client (Users) Client (Users) Edge Server Edge Server Origen Server Edge Server Client (Users) Client (Users) Edge Server Edge Server Client (Users) Client (Users) Edge Server Edge Server 8 Using Edge and Origin Servers Caching data in edge servers An edge server is designed to intercept the requests for Flash Media Server services from users in a particular zone, collect or aggregate these requests, and transmit them to the origin server. The origin server returns the results to the edge server, which in turn sends the data back to the user's client computer. The edge server also stores this information in its cache, where other users or clients assigned to the same edge server can access it. In this scenario, fewer requests for services are forwarded to the origin server. The edge server caches data such as video streams and shared objects. When a user requests data that is found in the edge server's cache, it returns the data to the requesting client (the user's computer) without ever calling upon the origin server. This detour is transparent to the user. The edge server is conserving bandwidth by not connecting to the origin server. In this scenario, no demands are placed on the origin server. Deploying edge servers in the DMZ Edge servers may be deployed in the demilitarized zone (DMZ) of a corporate network. A DMZ is an isolated network placed between an organization's ...