Configuring the SaaS Accelerator

You can accelerate SaaS application traffic by registering a SteelHead with a SteelConnect Manager (SCM) that is set up for SaaS acceleration.

When you set up SaaS acceleration on SCM, SCM deploys and manages a SaaS service cluster in the cloud. Once registered, SteelHeads (and SteelHead Mobile clients) peer with the SaaS service cluster to accelerate the SaaS traffic.

The SaaS Accelerator feature also includes proxy certificate management to simplify the deployment process.

SaaS Accelerator through SteelConnect is a Riverbed end-to-end solution and simplifies deployment and certificate management. It is intended as a replacement for SteelHead Cloud Accelerator with Akamai, which has been renamed to Legacy Cloud Accelerator.

Before you can set up the SteelHead and accelerate SaaS traffic, you need to perform these steps on the SteelConnect Manager:

SaaS Accelerator requires an additional license, but the license is not installed on the SteelHead; it is installed on the SteelConnect Manager. In addition, SteelHead models CX580, CX780, and CX3080 require the Standard license tier or higher to accelerate SaaS traffic. Without a license, SaaS traffic is passed through.

2. Enable automatic signing and certificate management capabilities. On the SteelConnect Manager, choose Optimization > SSL Optimization.

3. Configure SaaS applications for acceleration. On the SteelConnect Manager, choose Optimization > SaaS Accelerator.

See the SteelConnect Manager User Guide and the SaaS Accelerator User Guide for detailed configuration information.

When you have configured SteelConnect Manager for SaaS acceleration, you can configure SteelHead as a client.

We strongly recommend that you configure and push SaaS acceleration policies from a SteelCentral Controller for SteelHead to the SteelHeads, particularly with large scale deployments and production networks with multiple SteelHeads. For details, see Configuring SaaS acceleration on multiple SteelHeads using SCC.

1. On the SteelConnect Manager, choose Optimization > SaaS Client Appliances and copy the registration token.

2. On the SteelHead, choose Optimization > SaaS: SaaS Accelerator and add these values:

– SteelConnect Manager Port. The client-side SteelHead uses port 3900 on the primary interface to communicate with SCM, and the port needs to be open on the branch firewall. You cannot change this value.

– Registration Token. Paste the registration token you copied in Step 1 to this field.

When the registration process completes, the registration details and a helpful list of remaining configuration tasks appear on the page. Completed tasks are prefaced by a check mark.

A new SaaS Acceleration section also appears on the page where you can view the current status and monitor acceleration status.

Choose Optimization > SSL: SSL Main Settings, and in the General SSL Settings area select Enable SSL Optimization and click Apply.

Newly added appliances always appear on the graylist in the Access List column. You need to change their status to the whitelist to allow acceleration.

Choose Optimization > SaaS Client Appliances and click the appliance serial number to display the details panel.

Under Access List and Notes, select Whitelist from the Access List drop-down menu and click Submit.

6. Enable SaaS acceleration on this appliance. Choose Optimization > SaaS: SaaS Accelerator, select Enable Acceleration, and click Apply.

When you click Apply, be patient. It can take several minutes to start acceleration.

The in-path rule lets the SteelConnect Manager associate the IP address of the SaaS service cluster in the cloud with the SteelHead and associates the SaaS service cluster with the accelerated application.

Choose Optimization > Network Services: In-Path Rules and click Add a New In-Path Rule. For the Destination Subnet, choose SaaS Application. A second menu appears to the right. In the second menu, choose a SaaS application (such as SharePoint for Business) or an application group (such as Microsoft Office 365) for acceleration. Only applications set up for SaaS acceleration on the SteelConnect Manager appear in the list. Click Add.

At the initial release of SteelHead 9.9.2, you need to configure a unique in-path rule for each Microsoft Office 365 application, such as SharePoint and Exchange Online. An upcoming release of SteelConnect Manager will let you define a single in-path rule for all Office 365 traffic. When available, Microsoft Office 365 will automatically appear as an option for a SaaS application in-path rule.

See Configuring In-Path Rules for more information.

In SCC 9.9.1 and later, you can configure SaaS acceleration on managed SteelHeads. SaaS Accelerator requires an additional license, but the license is not installed on the SCC and SteelHeads; it is installed on SCM.

To accelerate SaaS application traffic using your managed SteelHeads, register your SCC with an SCM that is set up for SaaS acceleration. After registering the SCC with SCM, register selected SteelHeads or a group of SteelHeads with SCM. Once registered, SteelHeads peer with the SaaS service cluster to accelerate the SaaS traffic. Make sure you move the registered SCC and SteelHead appliances to the whitelist on SCM.

On the SCC policies that include SaaS acceleration, make sure you perform these configurations:

For more details about configuring SaaS acceleration on managed SteelHeads, see the SteelCentral Controller for SteelHead User Guide.

Once configured, you can use the SaaS Acceleration Status panel to monitor activity. This panel shows all SaaS applications configured for acceleration and shows the status of their in-path rules.

The SteelHead gets data from the SteelConnect Manager every five minutes and shows the time for the displayed data. Click Refresh Data to get the latest information.

To cancel the acceleration, click Deregister. This action also removes all related in-path rules.