Deploy Secure Private Access as a cluster
The Secure Private Access on-premises solution can be deployed as a cluster to provide high availability, high throughput, and scalability. It is recommended to deploy standalone Secure Private Access nodes for large deployments (for example, more than 5000 users).
If you are using NetScaler Gateway versions 13.0 or 13.1 build 48.47 or earlier, it is recommended that you co-host Secure Private Access with StoreFront.
Create Secure Private Access nodes
-
Create a new Secure Private Access site. For details, see Setup a Secure Private Access site.
-
Add the required number of cluster nodes to the Secure Private Access site. For details, see Setup Secure Private Access by joining an existing site.
-
In each Secure Private Access node, configure the same server certificates. The certificate subject common name or subject alternative name must match the load balancer FQDN.
Load balancer configuration
There are no specific load balancing configuration requirements for the Secure Private Access cluster setup. If you are using NetScaler as the load balancer, note the following:
- Secure Private Access services (both admin and runtime) are stateless, and so persistency is not required.
- Secure Private Access services are recommended to run as HTTPS but this is not a mandatory requirement. Secure Private Access services can be deployed as HTTP as well.
- SSL offload or SSL bridge is supported, so any load balancer configuration can be used. When using SSL bridge, ensure to configure the same server certificates in each Secure Private Access node. Also, the certificate subject common name or subject alternative name (SAN) must match the load balancer FQDN. Also, SAN must be configured in the Load Balancer service.
-
Load balancers (for example NetScaler) have default built-in monitors (probes) for back-end servers. If you must configure a custom HTTP based monitor (probe) for Secure Private Access on-premises servers, the following endpoint can be used:
/secureAccess/healthExpected response:
Http status code: 200 OK Payload: {"status":"OK","details":{"duration":"00:00:00.0084206","status":"OK"}} <!--NeedCopy-->
For details about configuring a NetScaler load balancer, see Setup basic load balancing.