Basic & Advanced Settings – Edgenexus Knowledge Base

Anatomy of a custom cipher jetPACK, and some examples

jsavoor@edgenexus.io — Wed, 05 Feb 2025 11:09:40 +0000

What is a Cipher jetPACK?

A jetPACK is a small text file comprising configuration instructions for the EdgeADC. A jetPACK could be anything from a Cipher to a configuration setting. jetPACKS are very easy to create, but please ensure you know what you are doing when you create one. If in any doubt, please email Edgenexus Support.

Anatomy of a Cipher jetPACK

Let’s take a look at a jetPACK.

#!jetpack
[jetnexusdaemon-cipher-No_SSLv3_No_TLSv1_No_TLSv1.1_No_RC4_No_CBC-strong]
Cipher="ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:HIGH:!3DES:!aNULL:!MD5:!DSS:!MD5:!aNULL:!EDH:!RC4:!SHA1:!SHA256:!SHA384"
Cipher1=""
Cipher2=""
CipherOptions="NO_SSLv3,NO_TLSv1,NO_TLSv1.1,CIPHER_SERVER_PREFERENCE"
Description="No-TLSv1 No-TLSv1.1 No-SSLv3 No-RC4 No-CBC strong"

jetPACK examples

Strong Ciphers

This will add the ability to choose “Strong Ciphers” from the Cipher options list.
Cipher = ALL:RC4+RSA:+RC4:+HIGH:!DES-CBC3-SHA:!SSLv2:!ADH:!EXP:!ADHexport:!MD5

#!jetpack
[jetnexusdaemon-cipher-No_SSLv3_No_TLSv1_No_RC4_stronger]
Cipher="ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:HIGH:!3DES:!aNULL:!MD5:!DSS:!MD5:!aNULL:!EDH:!RC4"
Cipher1=""
Cipher2=""
CipherOptions="NO_SSLv3,NO_TLSv1,CIPHER_SERVER_PREFERENCE"
Description="No-TLSv1 No-SSLv3 No-RC4-stronger"

Anti-Beast

This will add the ability to choose “Anti Beast” from the Cipher Options list.
Cipher = ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

#!update

[jetnexusdaemon-cipher-antiBEAST]
Cipher="ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH"
CipherOptions="CIPHER_SERVER_PREFERENCE"
CipherSuppressVersionAll=
Description="Anti Beast"

No SSLv3

This will add the ability to choose “No SSLv3” from the Cipher Options list.
Cipher = ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4

#!update

[jetnexusdaemon-cipher-NOSSLv3]
Cipher="ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4"
Cipher1=""
Cipher2=""
CipherOptions="NO_SSLv3,CIPHER_SERVER_PREFERENCE"
Description="No SSLv3"

No SSLv3 No TLSv1 No RC4

This will add the ability to choose “No-TLSv1 No-SSLv3 No-RC4” from the Cipher Options list.
Cipher = ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4

#!update

[jetnexusdaemon-cipher-No-SSLv3-No-TLSv1-No-RC4]
Cipher="ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4"
Cipher1=""
Cipher2=""
CipherOptions="NO_SSLv3,NO_TLSv1,CIPHER_SERVER_PREFERENCE"
Description="No-TLSv1 No-SSLv3 No-RC4"

No TLSv1

This will add the ability to choose “NO_TLSv1.1” from the Cipher Options list.
Cipher= ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128: DH+AES:RSA+AESGCM:RSA+AES:HIGH:!3DES:!aNULL:!MD5:!DSS:!MD5:!aNULL:!EDH:!RC4

#!jetpack

[cipher-No-SSLv3-No-TLSv1.0-v1.1-No-RC4-strong] 
Cipher="ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:HIGH:!3DES:!aNULL:!MD5:!DSS:!MD5:!aNULL:!EDH:!RC4" 
Cipher1="" 
Cipher2="" 
CipherOptions="NO_SSLv3,NO_TLSv1,NO_TLSv1.1,CIPHER_SERVER_PREFERENCE" 
Description="No-TLSv1 v1.1 No-SSLv3 No-RC4-strong"

Enabling, Disabling and Adding Ciphers on the EdgeADC

jsavoor@edgenexus.io — Wed, 05 Feb 2025 10:28:11 +0000

There are occasions when you may wish to enable or disable, or even add new ciphers in the EdgeADC.

Below is a list of Ciphers and the method for uploading what we refer to as jetPACK. Each Cipher is a text module and must be saved to your local computer as a text file using a plain text editor such as Notepad or Visual Code Editor. Do not use editors such as Word, etc., to do this, as they add hidden characters that will disrupt the ADC and may require advanced support. Remember to give it an appropriate name when you save it with an extension of .txt.

Uploading a jetPACK

Please follow the instructions below to upload the jetPACK.

Log into the ADC using admin credentials.
Navigate to Advanced > Configuration.

Click the Browse button.
Navigate to, and open the jetPACK you need.
Click the Upload Config or jetPACK button.
The jetPACK will now be uploaded and available from the IP Services > Real Servers > Advanced Tab

You can find more information in the jetPACKs article.

Does the EdgeADC support DSR, or Direct Server Return?

jsavoor@edgenexus.io — Thu, 04 Apr 2024 10:09:35 +0000

Yes, the EdgeADC does support DSR, aka Direct Server Return.

Direct Server Return or DSR also known DR – Direct Routing, allows the server behind the load balancer to respond directly to the client bypassing the ADC on the response. DSR is only suitable for use with Layer 4 load balancing. Therefore, Caching and Compression are not available with this option chosen.

This mode can only be used with TCP, UDP, and TCP/UDP service types.

Load balancing persistence policies are also restricted to Least Connections, Shared IP List Based, Round Robin and IP List Based.

Using DSR also requires Real Server changes to be done. Please refer to the Real Server Changes section in the Administrator guide.

Does the EdgeADC support Gateway mode?

jsavoor@edgenexus.io — Thu, 04 Apr 2024 10:03:43 +0000

Yes, the EdgeADC supports Gateway mode, and you can set this using the Connectivity option in the Advanced tab of the Real Servers section.

Gateway mode allows you to route all traffic through the ADC, allowing the Real Servers to be routed via the ADC to other networks via the ADC virtual services or hardware interfaces. Using the device as a gateway device for Real Servers is ideal when running in multi-interface mode.
Load balancing persistence policies are also restricted to Least Connections, Shared IP List Based, Round Robin and IP List Based.

This method requires that the Real Server sets its default gateway to the ADC’s local interface address (eth0, eth1, etc.). Please refer to the Real Server Changes section in the Administration Guide.

Please note that Gateway mode does not support failover in a cluster environment.

Does the EdgeADC support Reverse Proxy?

jsavoor@edgenexus.io — Thu, 04 Apr 2024 09:06:37 +0000

Yes. The EdgeADC does support a full reverse proxy that has been written by Edgenexus, and is not open source based.

You can choose to use Reverse Proxy (default method), or use Gateway or DSR mode. Setting can be found in the Advanced tab of the Real Servers section when defining a Virtual Service.

Can I automatically switch my Real Server offline if a health check fails?

jsavoor@edgenexus.io — Wed, 03 Apr 2024 15:54:56 +0000

There may be a requirement to place a server offline should it fail a health check.

If this is needed you can achieve this by using the setting in the Real Server’s Advanced tab. See image below.

The one condition here is that you will need to bring the Real Server online manually.

Does the EdgeADC support Persistence based load-balancing?

jsavoor@edgenexus.io — Thu, 28 Mar 2024 14:33:13 +0000

Persistence, also known as sticky sessions, in the context of load balancers, refers to a method used to maintain a consistent user session on the same server during multiple requests. When a user first connects to a web application via a load balancer, persistence ensures that all subsequent requests from that user during the session are directed to the same backend server. This is crucial for applications where the session state is stored locally on the server, such as in shopping carts or user login sessions. Persistence is achieved through various mechanisms, such as IP hashing, where the user’s IP address determines the server, or cookie insertion, where the load balancer places a special cookie in the user’s browser to track the server assignment. This approach enhances the user experience by ensuring continuity and consistency in their interaction with the application.

The EdgeADC supports several Persistence based load-balancing policies.

Option	Description
Persistent Cookie	Layer 7 Session Affinity/Persistence The IP list-based load balancing mode is used for each first request. The ADC inserts a cookie into the headers of the first HTTP response. After that, the ADC uses the client cookie to route traffic to the same back-end server. This cookie is used for persistence when the client must go to the same back-end server each time. The cookie will expire after 2 hours, and the connection will be load balanced according to an IP List Based algorithm. This expiry time is configurable using a jetPACK.
IP Bound	Layer 3 Session Affinity/Persistence Cookie. In this mode, the client’s IP address forms the basis to select which Real Server will receive the request. This action provides persistence. HTTP and Layer 4 protocols can use this mode. This method is helpful for internal networks where the network topology is known, and you can be confident that there are no “super proxies” upstream. With Layer 4 and proxies, all the requests can look as if they are coming from one client, and as such, the load would not be even. With HTTP, the header (X-Forwarder—For) information is used when present to cope with proxies.
IP List Based	The connection to the Real Server initiates using “Least connections” then, session affinity is achieved based on the client’s IP address. A list is maintained for 2 hours by default, but this can be changed using a jetPACK.
Shared IP List Based	This service type is only available when the Connectivity Mode is set to Direct Server Return. It has been primarily added for support with VMware load balancing.
Persistent Cookie	Layer 7 Session Affinity/Persistence The IP list-based load balancing mode is used for each first request. The ADC inserts a cookie into the headers of the first HTTP response. After that, the ADC uses the client cookie to route traffic to the same back-end server. This cookie is used for persistence when the client must go to the same back-end server each time. The cookie will expire after 2 hours, and the connection will be load balanced according to an IP List Based algorithm. This expiry time is configurable using a jetPACK.
Classic ASP Session Cookie	Active Server Pages (ASP) is a Microsoft server-side technology. With this option selected, the ADC will maintain session persistence to the same server if an ASP cookie is detected and found in its known cookies list. On detection of a new ASP cookie, it will be load balanced using the Least Connections algorithm.
ASP.NET Session Cookie	This mode applies to ASP.net. With this mode selected, the ADC will maintain session persistence to the same server if an ASP.NET cookie is detected and found in its list of known cookies. On detection of a new ASP cookie, it will be load balanced using the Least Connections algorithm.
JSP Session Cookie	Java Server Pages (JSP) is an Oracle server-side technology. With this mode selected, the ADC will maintain session persistence to the same server if a JSP cookie is detected and found in its known cookies list. On detection of a new JSP cookie, it will be load balanced using the Least Connections algorithm.
JAX-WS Session Cookie	Java web services (JAX-WS) is an Oracle server-side technology. With this mode selected, the ADC will maintain session persistence to the same server if a JAX-WS cookie is detected and found in its list of known cookies. On detection of a new JAX-WS cookie, it will load balanced using the Least Connections algorithm.
PHP Session Cookie	Personal Home Page (PHP) is an open-source server-side technology. With this mode selected, the ADC will maintain session persistence to the same server when a PHP cookie is detected.
RDP Cookie Persistence	This load balancing method uses the Microsoft-created RDP Cookie based on username/domain to provide persistence to a server. The advantage of this method means maintaining a connection to a server is possible even if the IP address of the client changes.

What are the Load Balancing Policies supported in the EdgeADC?

jsavoor@edgenexus.io — Thu, 28 Mar 2024 14:21:31 +0000

A load-balancing policy is a set of rules or algorithms determining how incoming network traffic will be distributed across multiple servers. This is crucial for ensuring that no single server becomes a bottleneck, leading to improved application responsiveness and availability. Load balancing policies play a vital role in managing the workload on a network, especially in environments with varying traffic patterns or situations where high availability is critical.

The load-balancing policies supported in the EdgeADC are:

Option	Description
Least Connections	The load balancer will keep track of the number of current connections to each Real Server. The Real Server with the least number of connections receives the subsequent new request.
Fastest	The Fastest load balancing policy automatically calculates the response time for all requests per server smoothed over time. The Calculated Weight column contains the automatically calculated value. Manual entry is only possible when using this load balancing policy.
Persistent Cookie	Layer 7 Session Affinity/Persistence The IP list-based load balancing mode is used for each first request. The ADC inserts a cookie into the headers of the first HTTP response. After that, the ADC uses the client cookie to route traffic to the same back-end server. This cookie is used for persistence when the client must go to the same back-end server each time. The cookie will expire after 2 hours, and the connection will be load balanced according to an IP List Based algorithm. This expiry time is configurable using a jetPACK.
Round Robin	Round Robin is commonly used in firewalls and basic load balancers and is the simplest method. Each Real Server receives a new request in sequence. This method is only proper when you need to load balance requests to servers evenly; an example would be look-up web servers. However, when you need to load balance based on application load or the server load, or even ensure that you use the same server for the session, the Round Robin method is inappropriate.
IP Bound	Layer 3 Session Affinity/Persistence Cookie. In this mode, the client’s IP address forms the basis to select which Real Server will receive the request. This action provides persistence. HTTP and Layer 4 protocols can use this mode. This method is helpful for internal networks where the network topology is known, and you can be confident that there are no “super proxies” upstream. With Layer 4 and proxies, all the requests can look as if they are coming from one client, and as such, the load would not be even. With HTTP, the header (X-Forwarder—For) information is used when present to cope with proxies.
IP List Based	The connection to the Real Server initiates using “Least connections” then, session affinity is achieved based on the client’s IP address. A list is maintained for 2 hours by default, but this can be changed using a jetPACK.
Shared IP List Based	This service type is only available when the Connectivity Mode is set to Direct Server Return. It has been primarily added for support with VMware load balancing.
Persistent Cookie	Layer 7 Session Affinity/Persistence The IP list-based load balancing mode is used for each first request. The ADC inserts a cookie into the headers of the first HTTP response. After that, the ADC uses the client cookie to route traffic to the same back-end server. This cookie is used for persistence when the client must go to the same back-end server each time. The cookie will expire after 2 hours, and the connection will be load balanced according to an IP List Based algorithm. This expiry time is configurable using a jetPACK.
Classic ASP Session Cookie	Active Server Pages (ASP) is a Microsoft server-side technology. With this option selected, the ADC will maintain session persistence to the same server if an ASP cookie is detected and found in its known cookies list. On detection of a new ASP cookie, it will be load balanced using the Least Connections algorithm.
ASP.NET Session Cookie	This mode applies to ASP.net. With this mode selected, the ADC will maintain session persistence to the same server if an ASP.NET cookie is detected and found in its list of known cookies. On detection of a new ASP cookie, it will be load balanced using the Least Connections algorithm.
JSP Session Cookie	Java Server Pages (JSP) is an Oracle server-side technology. With this mode selected, the ADC will maintain session persistence to the same server if a JSP cookie is detected and found in its known cookies list. On detection of a new JSP cookie, it will be load balanced using the Least Connections algorithm.
JAX-WS Session Cookie	Java web services (JAX-WS) is an Oracle server-side technology. With this mode selected, the ADC will maintain session persistence to the same server if a JAX-WS cookie is detected and found in its list of known cookies. On detection of a new JAX-WS cookie, it will load balanced using the Least Connections algorithm.
PHP Session Cookie	Personal Home Page (PHP) is an open-source server-side technology. With this mode selected, the ADC will maintain session persistence to the same server when a PHP cookie is detected.
RDP Cookie Persistence	This load balancing method uses the Microsoft-created RDP Cookie based on username/domain to provide persistence to a server. The advantage of this method means maintaining a connection to a server is possible even if the IP address of the client changes.
Cookie-ID Based	A new method very much like “PhpCookieBased” and other load-balancing methods, but using CookieIDBased and cookie RegEx h=[^;]+ This method will use the value set in the Real Server’s notes field “ID=X;” as the cookie value to identify the server. This, therefore, means it is a similar methodology as CookieListBased but uses a different cookie name and stores a unique cookie value, not the scrambled IP, but the ID from the Real Server (read in at load-time.) The Default value is CookieIDName=”h”; however, if there is an override value in the virtual server’s advanced settings configuration, use this instead. NOTE: We overwrite the cookie expression above to replace h= with the new value if this value is set. The last bit is that if an unknown cookie value arrives and matches one of the Real Server IDs, it should select that server; otherwise, use the next method (delegate.)