The following guide shows an example of a configuration used to balance load from MFDs between multiple Dispatcher Paragon servers that form a Spooler Controller Group.

Prerequisites

• HAproxy is installed and generally configured (this guide only shows steps specific to Dispatcher Paragon settings)
• Dispatcher Paragon servers are configured and successfully formed a Spooler Controller Group. See Near Roaming in chapter Configuring Print Roaming
• Dispatcher Paragon servers are configured and ready to be used in connection with a 3rd party load balancer. See chapter Configuring a Third-party Load Balancer for Terminal Failover
• For load balancing running on OSI layer 7, a certificate and private key is needed. This certificate is issued for the IP address or hostname of the HAproxy frontends and is presented from the load balancer to the MFDs.
  • Save the file so that both private key (without a passphrase) and the public certificate are in one file. In example below, it is /etc/haproxy/haproxy.pem
  • The structure of the file will look like the following (order of key and certificate does not matter):
    -----BEGIN CERTIFICATE-----
    MIIF4z...
    -----END CERTIFICATE-----
    -----BEGIN PRIVATE KEY-----
    MIIF4z...
    -----END PRIVATE KEY-----

Terminology

• frontend - specification of IP addresses/hostnames, ports and protocols on which HAproxy accepts communication to be balanced.
• backend - specification of servers that are used for balancing purposes.

Configuration

There are two options how the HAproxy can be configured:

• TCP mode - using balancing on OSI layer 4 (recommended)
  
  • This mode passes the session from MFD to a chosen Dispatcher Paragon server.
• HTTP mode - using balancing on OSI layer 7
  • This mode terminates communication from MFD at HAproxy and initiates a new connection to the Dispatcher Paragon servers.

Both of the proposed configurations are made for the following example environment:

• Dispatcher Paragon running Konica Minolta embedded terminals
• Three Site Servers in a Spooler Controller Group running on IP addresses 10.0.125.1, 10.0.125.2 and 10.0.125.3.
  • First server also acts as a Management Server.
• Affinity is set based on hash of the source (MFD) IP address and currently alive backend servers.
  • If a server is active, MFD will keep being routed to it. When any server goes down or up, affinity is reset for all servers and balancing starts again.
  • See example of round robin balancing that is added as a comment in the backend.
• Statistics are available on http://<HAproxy IP>:1936/stats 

When changing configuration, you can use the following steps to validate it and reload it.

1. Validate the configuration works with no issues
   sudo haproxy -f /etc/haproxy/haproxy.cfg -c
2. Restart the service to apply the configuration.
   sudo systemctl restart haproxy.service

Note that in the examples below, the sections global, defaults and stats can be configured differently. They are included to show the complete file. The important parts are under the backend and frontend sections.

Example configuration for Layer 4 balancing (pass through) - recommended

Following is content of /etc/haproxy/haproxy.cfg

In the setup below, only one backend is used because HAproxy does not perform any decryption/encryption.

As this uses Layer 4 (mode tcp in the setting below), the HAproxy is not modifying the communication and is transferring it to the selected server. There is no need for a certificate on HAproxy as the device sees and uses the certificate of the Dispatcher Paragon Terminal Server directly.

Example configuration for Layer 7 balancing

Following is content of /etc/haproxy/haproxy.cfg 

In the setup below, a specific backend and fronted is used for SSL and non-SSL communication. This is needed so as not to route non-SSL traffic as SSL incorrectly.

As this uses Layer 7 (mode http in the setting below), the HAproxy is terminating the SSL communication and begins a new communication to the Dispatcher Paragon server. So there are two connections: MFD → HAproxy and then HAproxy → Terminal Server.
The backend servers have the parameter "ssl verify none" which means the certificate of the Dispatcher Paragon is not checked as is implicitly trusted. For a production environment, this should be removed and a trusted certificates should be used on the Terminal Server of Dispatcher Paragon.