LB旁路部署案例
一、 需求
- 爲了實現服務器對外網用戶提供服務的可靠性，客戶在現網中部署了LB設備，LB採用旁路方式部署，要求外網主機訪問時的流量經過LB輪詢到內部服務器，一臺服務器down機不影響其正常業務。
二、 拓撲環境![LB 服務器負載均衡【旁路部署】]()
三、 配置思路 - 配置各個設備ip地址及路由，保證ip可達
- 配置檢測模板
- 配置ip地址池
- 配置實服務組，調用檢測模板和ip地址池
- 配置實服務，關聯實服務組
- 配置虛服務器，關聯實服務組
- 測試
四、 配置步驟
配置腳本如下所示：
出口NAT設備配置：sysname NAT # system-working-mode standard xbar load-single password-recovery enable lpu-type f-series # vlan 1 # interface Serial1/0 # interface Serial2/0 # interface Serial3/0 # interface Serial4/0 # interface NULL0 # interface GigabitEthernet0/0 port link-mode route combo enable copper ip address 192.168.34.4 255.255.255.0 # interface GigabitEthernet0/1 port link-mode route combo enable copper ip address 100.1.46.4 255.255.255.0 nat outbound nat server protocol tcp global 100.1.46.4 2323 inside 192.168.35.5 2323 # interface GigabitEthernet0/2 port link-mode route combo enable copper # interface GigabitEthernet5/0 port link-mode route combo enable copper # interface GigabitEthernet5/1 port link-mode route combo enable copper # interface GigabitEthernet6/0 port link-mode route combo enable copper # interface GigabitEthernet6/1 port link-mode route combo enable copper # scheduler logfile size 16 # line class aux user-role network-operator # line class console user-role network-admin # line class tty user-role network-operator # line class vty user-role network-operator # line aux 0 user-role network-operator # line con 0 user-role network-admin # line vty 0 63 user-role network-operator # ip route-static 0.0.0.0 0 100.1.46.6 ip route-static 192.168.1.0 24 192.168.34.3 ip route-static 192.168.2.0 24 192.168.34.3 ip route-static 192.168.35.0 24 192.168.34.3 # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system
LB關鍵配置：
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/2
port link-mode route
combo enable copper
ip address 192.168.35.5 255.255.255.0
loadbalance snat-pool pool
ip range start 192.168.35.5 end 192.168.35.5
#
server-farm sf
snat-pool pool
probe t1
#
real-server rs1
ip address 192.168.1.1
port 23
weight 150
server-farm sf
#
real-server rs2
ip address 192.168.2.2
port 23
weight 120
server-farm sf
#
virtual-server vs type tcp
port 2323
virtual ip address 192.168.35.5
default server-farm sf
service enable
#
ip route-static 0.0.0.0 0 192.168.35.3
#
acl basic 2000
rule 0 permit
security-zone name Trust
import interface GigabitEthernet1/0/2
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
zone-pair security source Any destination Any
packet-filter 2000
#
return五、 測試
外網主機telnet外網映射到LB的地址和端口，看是否可以訪問到內部服務器
<Client>telnet 100.1.46.4 2323
Trying 100.1.46.4 ...
Press CTRL+K to abort
Connected to 100.1.46.4 ...
<ServerA>
<ServerA>
<ServerA>dis ip int brief
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP Address Description
GE0/0 down down -- --
GE0/1 up up 192.168.1.1 --
測試後可以正常訪問到服務器A
退出登錄後再嘗試登錄下，測試看是否可以輪詢到另一個服務器
<ServerA>quit
The connection was closed by the remote host!
<Client>telnet 100.1.46.4 2323
Trying 100.1.46.4 ...
Press CTRL+K to abort
Connected to 100.1.46.4 ...
<ServerB>
<ServerB>dis ip int brief
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP Address Description
GE0/0 up up 192.168.2.2 --
LB>dis real-server statistics
Slot 1:
Real server: rs1
Total connections: 7
Active connections: 0
Max connections: 1
Connections per second: 0
Max connections per second: 1
Server input: 13601 bytes
Server output: 15872 bytes
Throughput: 0 bytes/s
Inbound throughput: 0 bytes/s
Outbound throughput: 0 bytes/s
Max throughput: 3612 bytes/s
Max inbound throughput: 1359 bytes/s
Max outbound throughput: 2253 bytes/s
Received packets: 252
Sent packets: 238
Dropped packets: 0
Received requests: 0
Dropped requests: 0
Sent responses: 0
Dropped responses: 0
Connection failures: 0
Real server: rs2
Total connections: 8
Active connections: 1
Max connections: 1
Connections per second: 0
Max connections per second: 1
Server input: 15552 bytes
Server output: 17213 bytes
Throughput: 0 bytes/s
Inbound throughput: 0 bytes/s
Outbound throughput: 0 bytes/s
Max throughput: 5796 bytes/s
Max inbound throughput: 2451 bytes/s
Max outbound throughput: 3345 bytes/s
Received packets: 288
Sent packets: 264
Dropped packets: 0
Received requests: 0
Dropped requests: 0
Sent responses: 0
Dropped responses: 0
Connection failures: 0
<LB>dis virtual-server statistics
Slot 1:
Virtual server: vs
Total connections: 15
Active connections: 1
Max connections: 2
Connections per second: 0
Max connections per second: 1
Client input: 29257 bytes
Client output: 33165 bytes
Throughput: 0 bytes/s
Inbound throughput: 0 bytes/s
Outbound throughput: 0 bytes/s
Max throughput: 5796 bytes/s
Max inbound throughput: 2451 bytes/s
Max outbound throughput: 3345 bytes/s
Received packets: 542
Sent packets: 504
Dropped packets: 0
六、 注意事項
- 該拓撲圖中，如果只是單純配置服務器負載均衡，不針對外網進來的源做snat的話，是無法訪問到服務器的，原因是，外網終端向LB發起訪問，但是數據包回覆時卻是內網服務器直接給予的迴應，服務器回包時，數據包到核心設備，直接按照缺省路由去做轉發了，即使客戶端收到數據包，由於發起和迴應的地址不一致，則會認爲數據包不是自己想要的，會直接丟棄
- 配置LB時，新建實服務，關聯實服務組，最後在虛服務器下做關聯時，設備會根據檢測模板去輪詢看是否和服務器可達，如果可達，將處於active狀態，如果檢測不可達，處於Probe-failed