The decision has been made that the plug-in servers will be Windows 2008 servers so now we are wondering if we want to use IIS or IHS for the HTTP Plug-ins. My experience is with IIS only so I’m hoping that some of you have had experienced with both and would be willing to share their thoughts and preferences.

Thanks in advance

Hi Tony,

  I have worked with IIS (several times), IHS (usually), Apache (usually) and Domino (few times).

  From my experience normally with IHS or Apache, the websphere administrator has the control over they. With IIS and Domino there are another admins.

  With IHS and Apache you have control from Admin console to start/stop but with IIS and Domino no.

  If you want to consolidate diference plugins in one you can do it with IIS or IHS.

  From point of view of the generation and propagation you have the same functionality.

  From the point of view of the administration IIS has GUI and i think that some task like requiered ssl certificate are more easy than in IHS or Apache.  But with the v7 (and above) of WAS some task are easy from admin console:

    - Create virtual host
    - The control (and interchange) of the ssl certificates

  As WAS Admin i work with all of them and i'm afraid to say that if some of them is better than others.  All of them has their tricks

regards,

Hello Tony.

I, too, run the WebSphere plugin on a Windows server. The web server of choice, I opted to run IIS.

The reasons for the IIS decision were specifically because:
1. We knew we would share our Web Server across teams and applications.
2. Our depth of knowledge in Microsoft technology was very impressive, compared to IHS
3. It provided a platform for developers to run .Net code or other applications

At the time, we felt that providing a platform for others at the same time was the optimal business decision.

(Note: Keep in mind that this satisfied our business decision, and obviously each organization is different.)

I can say that the plugin on IIS does work fine, and we haven't had many, if any, issues with it in our years doing so. Unfortunately, some of the IBM tools don't behave well during the install, and I tend to configure everything manually (IBM doesn't really account for multiple web sites in IIS that aren't all running the Plugin...)

I think that Gabriel provided great technical points, and thus, my above perspective from the business. Hopefully this helps.

Erik

Gabriel and Erik

Thanks for your insight and experience, Although my experience is with IIS I’m leaning towards using IHS. I just built a sandbox and used IHS and I see the advantages that Gabriel talks about.

I have a second question along this line and I should open a new post but thought I would ask you two first.

I have a WebSphere Admin coming from a different agency that is involved in this new design and he does not want to use the WebSphere Plugins for the following reasons that I have never seen myself. Have any of you ever seen this?

WebSphere Plug-in takes precedence so protecting the WebSphere environment becomes more of a challenge.

If the reverse proxy group decides to consolidate IP addresses, you will have an issue if a website has the same context pointing to two different hostnames. i.e. you can only have one plug-in a process.

I haven't had direct experience implementing a Reverse Proxy for WebSphere, but you might find the following interesting: www.ibm.com/developerworks/websphere/tec...

The article does a good job of calling out the advantages of this topology, and even goes so far as to address the concerns of a DMZ accessible implementation.  Although, I feel what might interest you the most is the sectionin entitled "Cluster support" (under "Load balancing and failover".)

I'm not sure I understand all of the details, but based on my understanding of the Reverse Proxy setup available in WebSphere, it seems as though having a cluster spanning multiple hostnames is a non-issue as the proxy ultimately does run a type of HTTP plug-in (although not static in that it actually reads the configuration from the WAS Admin similar to the ODR in WebSPhere Virtual Enterprise.)

Hopefully this helps.  If not, post some additional details and I'll see what I can do.

Erik  
  
 
 

Erik

Thanks again and i want to share this with the group on what types of reverse proxies are supported by IBM WebSphere.

publib.boulder.ibm.com/httpserv/ihsdiag/...

 

Hi Erik and Tony,

  Erik very good article, I have no any experience with either WebSphere proxy or DMZ secure proxy, but i'm installing one now :-)

  With the plugin we have "problems" when we stop some application in only one member of cluster, the plugin only is aware of cluster members not of their applications status. I want to check "Therefore, the proxy server is able to use an application "runtime view" of the cluster during selection, so only running members of the application are included, plus any run time configuration settings that have been made."


  Tony thanks for information too, I have experience with WebSeal (works fine but WebSpheresecurity configuration is bit more complex because the TAM   and we have do test in IHS with mod_proxy module but with the unknowledge of it isn't a supported configuration


regards,

Great updates guys!

Based on what you've posted, it oesn't appear that there are additional licensing concerns when deploying a WebSphere Reverse Proxy within an environment either. The doc Tony posted sounds as though if you own PVUs of WebSphere then you can deploy the proxy elsewhere in your environment without having to licenses anything (additional) for the server hosting that service as it apparently qualifies as part of the supplements.

If this is the case on licensing, I may need to isntall this in a sandbox as well!

Erik  

I found this discussion interesting and decide to reply.
 
For IHS and IIS decsion,  here is what I would consider:

1)  is the web server only used as reverse proxy and will serve no content ?  Let's say your company decides to run some aspx pages on that web server as well,  then you probably won't want IHS.
2)  I don't have much experience about IIS,  but my understanding is that it is quite integrated with the OS.   IHS is relatively more separate from the OS, which makes role and responsiblity (Windows Admin vs Middleware Admin) more clear.

Regarding DMZ proxy,  I tried it before.  My experience is that it is interesting but I won't put it on production unless there is a business requirement that only DMZ proxy can do but not IHS.    It is not that it doesn't work well,  but it is just very different than IHS with plugin. If both solutions do very similar thing,   why uses the one that is not that popular ?