Short Lived DNS Round Robin Proxy Nodes

In this case we will deploy as many proxy nodes as needed and add IP address of each node to one short lived DNS A record. The browsers will access the proxy by this FQDN and because of round robin IP resolve scheme load will be more or less evenly distributed among all nodes.

Please note, this is not a real high availability solution as DNS server cannot track if a node in the cluster went down. Client browsers may still try connecting to a non-available cluster node for a short period of time.

To configure DNS round robin scheme, on your Windows DNS server, first create new type A record for proxy.example.lan and set the TTL to 15 seconds with IP address 192.168.178.10 for example.

Then create new type A record for the same proxy.example.lan and set the TTL to 15 seconds with IP address 192.168.178.11 for example.

From another workstation check that nslookup is able to correctly resolve proxy.example.lan record into two IP addresses configured.

Next deploy two virtual appliances of Web Safety and assign IP address of 192.168.178.10 for the first node and 192.168.178.11 for the second node.

Finally, follow the usual Active Directory configuration steps described in previous articles for each virtual appliance, but when configuring Kerberos authenticator provide the SPN based on proxy.example.lan and check the Use GSS_C_NO_NAME checkbox. This will let the node process requests for Kerberos authentication from browsers based on credentials contained in the request and not based on SPN (SPN still needs to be configured though).

Proceed to adjusting configuration sync for these two nodes.