Clustering Virtual Office and Netstorage Services in a DMZ

Question

Gudday Guys,
We are relative novices with implementing Virtual Office and Netstorage
but we currently have it set up to front end our student storage system.
As the system will support 40,000 students, we are looking to move from a
single server implementation to a cluster with it running on at least two
servers to share the load. In addition, in order for students to access
their files from home, we intend deploying the cluster into the DMZ and
using SSL to connect from outside.
Before we set this up, I have a few questions. Firstly, can we set the
cluster up in its own tree so that its replication etc can be confined in
the DMZ or are we forced to set it up in our existing tree which is where
the users and storage reside? We could then pass the authentication
traffic through the conduits to our replica servers. If we can do this,
are there any special tricks/tips?
Any help or suggestions would be greatly appreciated. Thanks. Bill G.

Answer 1

> We don't allow http access directly from the outside - PERIOD! That's a
> Policy.
no problaem, that's fine.
> We use iChain to front end some of our existing Webapps but we decided to
> do this slightly differently this time and host the webapp itself in the
> DMZ and the services behind the firewall. That way we can easily access it
> both from within and outside the district.
well.......
> I've opened conduits for Authentication to the other tree (Port 524 tcp
> and udp) and also SLP (Port 427 TCP and UDP). I'm having trouble getting
> access to the DAs in the other tree. Any Thoughts?
you need to open up more ports. The client uses a "high" port as the source
port and 427 as the destination port when talking SLP. The DA will respond
to the client's source port. The source port from the server will be 427 but
the destination port will not be. You will need to open ports from the
client to allow high ports. 1024 to <whatever> is the normal range.
<whatever> supposedly never goes over 1500 or so.
NETSTAT -A will show you what its using.
Cheers!
Richard Beels
~ Network Consultant
~ Sysop, Novell Support Connection
~ MCNE, CNE*, CNA*, CNS*, N*LS