We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Web Security Service

How do I resolve issues with Web Security Flex traffic being sent to the wrong data center?

  • Type: Knowledgebase
  • Date changed: 6 years ago
Solution #00006293

Scope:
Applies to all Web Security Gateway appliances using the Web Security Flex service.

Answer:
Web Security Flex is designed to provide high performance for telecommuters and other clients that may be subject to sudden moves. To accommodate for this, the Flex service relies upon DNS resolution of the Flex service host domain name, using local DNS root name servers, to focus in on the closest data center. This has proven to be a very reliable and effective way of providing high service levels to both statically located and mobile hosts.

Rarely, the root name server will supply an IP address for the incorrect data center. For instance, a host in Germany may resolve ple7.flex.purewire.com to 64.235.152.12 in San Jose, when it should resolve to 95.172.71.8 in Frankfurt. This results in excessive latency and lower throughput. If you suspect that this might be occurring, use this link (http://myip.flex.cudaops.com/) to test which data center that is being used.

In these cases, the easiest option is to configure a DNS A Record for local DNS servers. A records map domain names to IP addresses. As an example, if the Flex service host is ple7.flex.purewire.com, an A record can be used to map this service host to the Frankfurt IP address of 95.172.71.8. Flex server IPs are dynamic and subject to change. Please contact Barracuda Technical Support for the appropriate IP address for your location. More information on creating A records for Microsoft servers can be found at Microsoft’s Technet (http://technet.microsoft.com/en-us/library/cc772362.aspx). When using an ISP managed DNS server, the ISP may have to be contacted in order to make this change.

If this solution is not possible, in some cases a new authentication key can be mapped to a particular data center. Please note that this key will always point to the same data center, even if that IP address range changes in the future. Please contact Barracuda Technical Support  for more details.