Skip navigation

HT5590: OS X Server (Mountain Lion): Advanced configuration of the Caching service

Learn about OS X Server (Mountain Lion): Advanced configuration of the Caching service

HT5590 Use caching server with multiple public Addresses?

3863 Views 23 Replies Latest reply: Jan 28, 2014 9:32 AM by Nathan Carter1 RSS
  • Taffy Apple_ Level 1 Level 1 (0 points)

    If your sites have their own external 'Public' IP then you'd want a caching server at each site. After a week or so of testing we've found it great for delivering cached Apps (iOS & Mac) to Mac's but not so great for delivering to iOS devices

  • Camelot Level 8 Level 8 (45,670 points)

    So If we can set up the firewall NAT rule, we can get away with just 1 caching server (unless of course it gets overloaded and we need another).

    The OP's original problem was that one server for multiple locations wasn't viable since it would overload the WAN links between the hub and each location. This may or may not be an issue for you, depending on your network topology, but it's something to consider.

     

    So does anyone have the information needed to create a custom NAT in the firewall?

     

    No one here can answer that for you since we don't know what router/firewall you're using.

    You may be thinking of using the firewall built-in to Mac OS X, but this will not be appropriate here. You need to look at whatever device is performing NAT at your network edge. I highly doubt that's a Mac OS X Server.

  • logant1337 Calculating status...

    Overloading the WAN links shouldn't be a problem. The only problem I could see is that we are running this on a Mac Mini and I could see that getting overloaded. So having additional ones to share the load may be needed.

     

    As far as the custom NAT rule, I'm not looking for directions or anything (and I'm not the firewall guy here). I'm looking for the information such as URLs, IPs, ports, etc that we would need to create a rule. I'm assuming we could set a rule saying any traffic going to these locations uses this public IP. If I can get this information, I can give it to our firewall guy and see what he can do with it.

     

    Thanks!

  • K-12 Admin Calculating status...

    Does anyone ever answer a question without a question in these forums? Can anyone point to a white paper, or design guide to use this? Servicing over 35,000 in a school district, it is not even an option to have one outbound address when we are multi homed (mulitiple ISP providers) So if I want to direct all of my traffic down one pipe to Apple represented by one ip address... what is the address range I would create the rule with?  Searching Apple support I can find no design guides or references... just a bunch of people chiming in with more problems.

  • logant1337 Level 1 Level 1 (0 points)

    I contacted Apple to ask them about the IP addresses I would need and they pointed me here: http://support.apple.com/kb/ht3923 They said it would be the same addresses for the caching server. So we created a rule with those as the destination and it didin't do anything.

     

    Apple owns the entire 17.0.0.0/8 range. So we tested a rule by saying any traffic going to 17.0.0.0/8 will get a specific external IP, which is the same external IP as the caching server. That worked great. But we would really like to be able to narrow it down to more specific IP addresses. However, as we monitor a device going out to get updates, we seem to get different IP addresses every time.

  • logant1337 Level 1 Level 1 (0 points)

    After testing the last few hours, I found that the network of 17.173.66.0/24 seems to be Apple's update servers for apps. So I've created a rule and have apps from 3 of our schools caching now.

  • Nathan Carter1 Calculating status...

    This is exactly what we want to do, but I'm not sure what needs to be done or even what to google to get it done.  What changes exactly did you need to make in your firewall?  What kind of firewall are you working with?

  • logant1337 Level 1 Level 1 (0 points)

    Hi Nathan,

     

    We are using a Checkpoint firewall. Here's what we did:

     

    • Added the Apple Cache server as a host with a single, unique external IP address
    • Created a group (Group_AppleCacheTest) and added the network ranges for each of our 3 sites we wanted to cache (this was just to test as we didn't want to change all 50 sites at once without first testing to make sure it worked)
    • Added Apple's network as a network with the 17.173.66.0/24 IP range
    • Created a NAT rule
      • Original Packet Source: Group AppleCacheTest
      • Original Packet Destination: Network 17.173.66.0/24
      • Original Packet Service: Any
      • Translated Packet Source: Host Apple Cache Server
      • Translated Packet Destination: Original
      • Translated Packet Service: Original

     

    So basically we just wanted to create a rule to make any traffic from our test sites to 17.173.66.0/24 use the same external IP as the Apple Cache Server. As long as the external IP is the same, the information gets cached. Eventually I belive we'll be removing the group of 3 sites and just cache all sites on our network (so the Original Packet Source would just be Any).

     

    Hope this helps!

     

    -Logan

  • Nathan Carter1 Level 1 Level 1 (0 points)

    Very helpful.  Thanks very much!

1 2 Previous Next

Actions

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.