HT5590: OS X Server (Mountain Lion): Advanced configuration of the Caching serviceLearn about OS X Server (Mountain Lion): Advanced configuration of the Caching service
Currently Being ModeratedNov 4, 2013 1:51 PM (in response to logant1337)
If your sites have their own external 'Public' IP then you'd want a caching server at each site. After a week or so of testing we've found it great for delivering cached Apps (iOS & Mac) to Mac's but not so great for delivering to iOS devices
Currently Being ModeratedNov 4, 2013 10:03 PM (in response to logant1337)
So If we can set up the firewall NAT rule, we can get away with just 1 caching server (unless of course it gets overloaded and we need another).
The OP's original problem was that one server for multiple locations wasn't viable since it would overload the WAN links between the hub and each location. This may or may not be an issue for you, depending on your network topology, but it's something to consider.
So does anyone have the information needed to create a custom NAT in the firewall?
No one here can answer that for you since we don't know what router/firewall you're using.
You may be thinking of using the firewall built-in to Mac OS X, but this will not be appropriate here. You need to look at whatever device is performing NAT at your network edge. I highly doubt that's a Mac OS X Server.
Currently Being ModeratedNov 5, 2013 5:57 AM (in response to Camelot)
Overloading the WAN links shouldn't be a problem. The only problem I could see is that we are running this on a Mac Mini and I could see that getting overloaded. So having additional ones to share the load may be needed.
As far as the custom NAT rule, I'm not looking for directions or anything (and I'm not the firewall guy here). I'm looking for the information such as URLs, IPs, ports, etc that we would need to create a rule. I'm assuming we could set a rule saying any traffic going to these locations uses this public IP. If I can get this information, I can give it to our firewall guy and see what he can do with it.
Currently Being ModeratedJan 15, 2014 5:24 AM (in response to Camelot)
Does anyone ever answer a question without a question in these forums? Can anyone point to a white paper, or design guide to use this? Servicing over 35,000 in a school district, it is not even an option to have one outbound address when we are multi homed (mulitiple ISP providers) So if I want to direct all of my traffic down one pipe to Apple represented by one ip address... what is the address range I would create the rule with? Searching Apple support I can find no design guides or references... just a bunch of people chiming in with more problems.
Currently Being ModeratedJan 16, 2014 7:50 AM (in response to K-12 Admin)
I contacted Apple to ask them about the IP addresses I would need and they pointed me here: http://support.apple.com/kb/ht3923 They said it would be the same addresses for the caching server. So we created a rule with those as the destination and it didin't do anything.
Apple owns the entire 220.127.116.11/8 range. So we tested a rule by saying any traffic going to 18.104.22.168/8 will get a specific external IP, which is the same external IP as the caching server. That worked great. But we would really like to be able to narrow it down to more specific IP addresses. However, as we monitor a device going out to get updates, we seem to get different IP addresses every time.
Currently Being ModeratedJan 16, 2014 11:15 AM (in response to logant1337)
After testing the last few hours, I found that the network of 22.214.171.124/24 seems to be Apple's update servers for apps. So I've created a rule and have apps from 3 of our schools caching now.
Currently Being ModeratedJan 28, 2014 8:53 AM (in response to logant1337)
This is exactly what we want to do, but I'm not sure what needs to be done or even what to google to get it done. What changes exactly did you need to make in your firewall? What kind of firewall are you working with?
Currently Being ModeratedJan 28, 2014 9:09 AM (in response to Nathan Carter1)
We are using a Checkpoint firewall. Here's what we did:
- Added the Apple Cache server as a host with a single, unique external IP address
- Created a group (Group_AppleCacheTest) and added the network ranges for each of our 3 sites we wanted to cache (this was just to test as we didn't want to change all 50 sites at once without first testing to make sure it worked)
- Added Apple's network as a network with the 126.96.36.199/24 IP range
- Created a NAT rule
- Original Packet Source: Group AppleCacheTest
- Original Packet Destination: Network 188.8.131.52/24
- Original Packet Service: Any
- Translated Packet Source: Host Apple Cache Server
- Translated Packet Destination: Original
- Translated Packet Service: Original
So basically we just wanted to create a rule to make any traffic from our test sites to 184.108.40.206/24 use the same external IP as the Apple Cache Server. As long as the external IP is the same, the information gets cached. Eventually I belive we'll be removing the group of 3 sites and just cache all sites on our network (so the Original Packet Source would just be Any).
Hope this helps!