LB 服務器負載均衡【旁路部署】

LB旁路部署案例
1、 需求

• 爲了實現服務器對外網用戶提供服務的可靠性，客戶在現網中部署了LB設備，LB採用旁路方式部署，要求外網主機訪問時的流量通過LB輪詢到內部服務器，一臺服務器down機不影響其正常業務。
  2、 拓撲環境
  
  3、 配置思路
• 配置各個設備ip地址及路由，保證ip可達
• 配置檢測模板
• 配置ip地址池
• 配置實服務組，調用檢測模板和ip地址池
• 配置實服務，關聯實服務組
• 配置虛服務器，關聯實服務組
• 測試
  4、 配置步驟
  配置腳本以下所示：
  出口NAT設備配置：

  sysname NAT
  #
  system-working-mode standard
  xbar load-single
  password-recovery enable
  lpu-type f-series
  #
  vlan 1
  #
  interface Serial1/0
  #
  interface Serial2/0
  #
  interface Serial3/0
  #
  interface Serial4/0
  #
  interface NULL0
  #
  interface GigabitEthernet0/0
  port link-mode route
  combo enable copper
  ip address 192.168.34.4 255.255.255.0
  #
  interface GigabitEthernet0/1
  port link-mode route
  combo enable copper
  ip address 100.1.46.4 255.255.255.0
  nat outbound
  nat server protocol tcp global 100.1.46.4 2323 inside 192.168.35.5 2323
  #
  interface GigabitEthernet0/2
  port link-mode route
  combo enable copper
  #
  interface GigabitEthernet5/0
  port link-mode route
  combo enable copper
  #
  interface GigabitEthernet5/1
  port link-mode route
  combo enable copper
  #
  interface GigabitEthernet6/0
  port link-mode route
  combo enable copper
  #
  interface GigabitEthernet6/1
  port link-mode route
  combo enable copper
  #
  scheduler logfile size 16
  #
  line class aux
  user-role network-operator
  #
  line class console
  user-role network-admin
  #
  line class tty
  user-role network-operator
  #
  line class vty
  user-role network-operator
  #
  line aux 0
  user-role network-operator
  #
  line con 0
  user-role network-admin
  #
  line vty 0 63
  user-role network-operator
  #
  ip route-static 0.0.0.0 0 100.1.46.6
  ip route-static 192.168.1.0 24 192.168.34.3
  ip route-static 192.168.2.0 24 192.168.34.3
  ip route-static 192.168.35.0 24 192.168.34.3
  #
  domain system
  #
  domain default enable system
  #
  role name level-0
  description Predefined level-0 role
  #
  role name level-1
  description Predefined level-1 role
  #
  role name level-2
  description Predefined level-2 role
  #
  role name level-3
  description Predefined level-3 role
  #
  role name level-4
  description Predefined level-4 role
  #
  role name level-5
  description Predefined level-5 role
  #
  role name level-6
  description Predefined level-6 role
  #
  role name level-7
  description Predefined level-7 role
  #
  role name level-8
  description Predefined level-8 role
  #
  role name level-9
  description Predefined level-9 role
  #              
  role name level-10
  description Predefined level-10 role
  #
  role name level-11
  description Predefined level-11 role
  #
  role name level-12
  description Predefined level-12 role
  #
  role name level-13
  description Predefined level-13 role
  #
  role name level-14
  description Predefined level-14 role
  #
  user-group system

LB關鍵配置：

interface GigabitEthernet1/0/1
 port link-mode route
 combo enable copper
 ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/2
 port link-mode route
 combo enable copper
 ip address 192.168.35.5 255.255.255.0

loadbalance snat-pool pool
 ip range start 192.168.35.5 end 192.168.35.5
#
server-farm sf
 snat-pool pool
 probe t1
#
real-server rs1
 ip address 192.168.1.1
 port 23
 weight 150
 server-farm sf
#
real-server rs2
 ip address 192.168.2.2
 port 23
 weight 120    
 server-farm sf
#
virtual-server vs type tcp
 port 2323 
 virtual ip address 192.168.35.5
 default server-farm sf
 service enable
 #
 ip route-static 0.0.0.0 0 192.168.35.3
#
acl basic 2000
 rule 0 permit
security-zone name Trust
 import interface GigabitEthernet1/0/2
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
zone-pair security source Any destination Any
 packet-filter 2000
#
return

5、 測試
外網主機telnet外網映射到LB的地址和端口，看是否能夠訪問到內部服務器
<Client>telnet 100.1.46.4 2323
Trying 100.1.46.4 ...
Press CTRL+K to abort
Connected to 100.1.46.4 ...

<ServerA>
<ServerA>
<ServerA>dis ip int brief
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP Address Description
GE0/0 down down -- --
GE0/1 up up 192.168.1.1 --
測試後能夠正常訪問到服務器A

退出登陸後再嘗試登陸下，測試看是否能夠輪詢到另外一個服務器
<ServerA>quit

The connection was closed by the remote host!
<Client>telnet 100.1.46.4 2323
Trying 100.1.46.4 ...
Press CTRL+K to abort
Connected to 100.1.46.4 ...

<ServerB>
<ServerB>dis ip int brief
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP Address Description
GE0/0 up up 192.168.2.2 --

LB>dis real-server statistics
Slot 1:
Real server: rs1
Total connections: 7
Active connections: 0
Max connections: 1
Connections per second: 0
Max connections per second: 1
Server input: 13601 bytes
Server output: 15872 bytes
Throughput: 0 bytes/s
Inbound throughput: 0 bytes/s
Outbound throughput: 0 bytes/s
Max throughput: 3612 bytes/s
Max inbound throughput: 1359 bytes/s
Max outbound throughput: 2253 bytes/s
Received packets: 252
Sent packets: 238
Dropped packets: 0
Received requests: 0
Dropped requests: 0
Sent responses: 0
Dropped responses: 0
Connection failures: 0

Real server: rs2
Total connections: 8
Active connections: 1
Max connections: 1
Connections per second: 0
Max connections per second: 1
Server input: 15552 bytes
Server output: 17213 bytes
Throughput: 0 bytes/s
Inbound throughput: 0 bytes/s
Outbound throughput: 0 bytes/s
Max throughput: 5796 bytes/s
Max inbound throughput: 2451 bytes/s
Max outbound throughput: 3345 bytes/s
Received packets: 288
Sent packets: 264
Dropped packets: 0
Received requests: 0
Dropped requests: 0
Sent responses: 0
Dropped responses: 0
Connection failures: 0

<LB>dis virtual-server statistics
Slot 1:
Virtual server: vs
Total connections: 15
Active connections: 1
Max connections: 2
Connections per second: 0
Max connections per second: 1
Client input: 29257 bytes
Client output: 33165 bytes
Throughput: 0 bytes/s
Inbound throughput: 0 bytes/s
Outbound throughput: 0 bytes/s
Max throughput: 5796 bytes/s
Max inbound throughput: 2451 bytes/s
Max outbound throughput: 3345 bytes/s
Received packets: 542
Sent packets: 504
Dropped packets: 0
6、 注意事項

• 該拓撲圖中，若是隻是單純配置服務器負載均衡，不針對外網進來的源作snat的話，是沒法訪問到服務器的，緣由是，外網終端向LB發起訪問，可是數據包回覆時倒是內網服務器直接給予的迴應，服務器回包時，數據包到核心設備，直接按照缺省路由去作轉發了，即便客戶端收到數據包，因爲發起和迴應的地址不一致，則會認爲數據包不是本身想要的，會直接丟棄
• 配置LB時，新建實服務，關聯實服務組，最後在虛服務器下作關聯時，設備會根據檢測模板去輪詢看是否和服務器可達，若是可達，將處於active狀態，若是檢測不可達，處於Probe-failed