L4 스위치 교육

Download Report

Transcript L4 스위치 교육

Alteon L4 Web Swtich

목 차 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved

Ⅰ.

제품소개

1. Alteon L4

스위치 제품 소개

2.

고객사 구축 장비 소개

(180e) 3. Layer 4

스위치 시장 점유율

4. Layer 4

스위치 국내

/

국제 표준 준수

Ⅱ. Layer 4

스위치 용도

/

기능 소개

1. Layer 4

스위치 설치 전 구성

2. Layer 4

스위치 설치 후 구성

3. Layer 4

스위치 기능

4.

구축 사례

Ⅲ. Layer 4

스위치 설정

1. Layer 4

스위치 아키텍처 구조

2. Layer 4

스위치 기본 설정

3.

서버

Load Balancing

이해 - 2 -

Alteon Web Switch

제품 소개

Industry Leading Web Switching (L4-7)

• • •

WSM 4- 10/100 TX or Gig SX ports 80MB of Memory 4M concurrent sessions Alteon Application Switch 2000

• • • • •

184 Nine 10/100/1000 Mbps ports 4 MB of memory per port (1-8) 8 MB of memory on port 9 512K concurrent sessions 8 Gbps backplane capacity 180e

• • • • • •

Eight 10/100/1000 Mbps ports One 1000BASE-SX port 2MB of memory per port 8 Gbps backplane capacity 336K concurrent sessions

• • • • • •

AD4 8 Gbps backplane capacity Eight 10/100 BASE-T ports One 1000BASE-SX uplink 4 MB of memory per port (1-8) 8 MB of memory on port 9 512K concurrent sessions 8 Gbps backplane capacity

• • • • •

AD3 Eight 10/100 BASE-T ports One 1000BASE-SX uplink 2 MB of memory per port 336K concurrent sessions 8 Gbps backplane capacity AD3 AD4

성능

180e

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 3 -

WSM AAS2424 184

Alteon Web Switch

제품 소개

(

계속

)

Alteon Application Switches A2424 A3408 A2224 Alteon Web Switches AD4 AD3

Fast Ethernet Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved Gig Ethernet - 4 -

184 180e Passport 8600 Layer 2-7 Routing Switch

Modular

Alteon WEB Switch 180e

고정형 L4 스위치로 9 Port의 interface는 최대의 확장성을 고려하여 10/100/1000Mbps의 통 신 경로를 제공하며 동일 장비를 이용하여 다중화된 서버나 방화벽 Load Balancing 동시에 지원함 장비 성능  다양한 고속 트래픽 관리 기능 지원과 동시에 혁신적인 분산처리 아키텍처를 기반으로 Layer 2,3와 4∼7 스위칭을 동시에 지원  매초 296,000 Session Capacity 제공  10/100/1000Mbps까지 완벽한 확장성을 제공 (9ports 10/100/1000M)  HTTP, HTTPS, DNS, SMTP, POP3, FTP, RADIUS등 다양한 서버 및 Firewall 서버 Load Balancing 뿐만 아니라 SSL(Secure Sockets Layer)로드 밸런싱 기능 제공  Layer 4레벨의 Application에 따른 우선 순위화 및 서버 퍼포먼스의 최적화를 지원 사양 Concurrent Session L4 Switching 기능 I/O Port L3 Switch 기능 기타 상비 사양 • 8 Gbps Backplane • 336K Sessions • VIP 지원 (256 ea) • Global/Local SLB • FW, Router, IDS L/B • 동시 수행 지원 • 정책필터 : 224 • VLAN : 246 • Cache Redirection • DNS Redirection • 1:N Port Mirroring • 9 * 10/100/1000 Ethernet • RIP1, BGP 지원 • SNMP 지원 • RMON 지원 • Application Health Check Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 5 -

Layer 4

스위치 시장 점유율

L4 Switch 시장 점유율 15% 2.4% 4.6% 1.3% 43% Nortel Cisco Foundry CyberIQ CableTron Extreme 37.5% Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 6 -

Layer 4

스위치 국내

/

국제 표준 준수

구 분 준수 여부

180e

 Spanning Tee (IEEE 802.1d)  Logical Link Control (IEEE 802.2)  10BASE-/100BASE-TX (IEEE 802.3, 802.3u)  Flow Control (IEEE 802.3x)  RMON (RFC 1757)  SNMP (1213 MIB-II, 1643 Ethernet, 1493 Bridge)  1000BASE-SX (IEEE 802.3z)  IPRIPv1, TFTP (RFC 783)  BOOTP (RFC 1542), BOOTP (RFC 951)  Telnet(RFC 854)  802.1Q

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 7 -

L4

스위치 용도 및 기능 소개

Layer 4

스위치 설치 전 구성

• • • •

CHALLENGES

신뢰할 수 있는

Web Tone

속도에 대한 요구 트래픽 관리 차별성 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 9 -

Layer 4

스위치 설치 후 구성

• • • • 고가용성에 대한 확신

Delivers Web speed

서비스의 차별을 가능하게 함 전례없는 제공

performance

를 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 10 -

Layer 4

스위치 기능 소개

서버 로드밸런싱 보안 서비스 DoS Attack Prevention Application Abuse Protection SSL acceleration / VPN

VPN

네트워크 장비 가속화 Application LB Global Server LB Firewall/VPN/IDS WAN Links Application Health Checks WAP Gateways 애플리케이션 리디렉션 Web Site Cache SSL Appliance Streaming Media 고급 필터링 컨텐츠 인지 Layer 2-7 Attributes Layer 7 Inspect VLAN Filtering Cookie, URL, HTTP Header Accept, Deny, NAT, Redirect User Agent (PDA, Browser) 트래픽 관리 지속성 지원 Bandwidth Management Source IP/Port ToS Marking Cookies SSL Identifier 기본적인 네트워크 서비스 Network Address Translation VLAN Tagging Trunking Layer 2 / 3 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 11 -

Layer 4

스위치 기능 소개

• • • • Local Server Load Balancing » 로컬서버로 유저들의 요구를 배분함으로써 애플리케이션의 수행능력, 유용성, 확장성을 향상시킴 Global Server Load Balancing » 지역적으로 분포된 서버로 유저들의 요구를 배분함으로써 애플리케이션의 수행능력, 유용성 및 확장성을 향상시킴 Firewall Load Balancing » Load share에 의한 Firewall 부하 감소 » Firewall Fail에 대한 Automatic Back-up High Availability Configurations » No single-point-of-failure at system level Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 12 -

Server Load Balancing

 SLB(Server Load Balancing) - I ▶ 기존 DNS를 사용한 Round Robin 방식 - Server Congestion 발생 높음 - Server Down시 감지 불가 - Hardware 사양 적용 불가 ▶ L4 Switch를 사용한 Server Load Balancing - Server congestion 발생 없음.

- Response time 증가 - 신뢰성 증가(다양한 Health Check로 Server Fail 감지.) - Server효율성 향상 - 정책별 Load Balancing : Minimum Misses, Hash, Least Connection, Round Robin - Scheduled Maintenance.

DNS CLients Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 13 CLients

Server Load Balancing(

계속

)

 SLB(Server Load Balancing) - II ▶ Server별 특정 Application 사용 시 - Server의 비 효율적 사용 - Server Fail시 특정 Application Service 불가 Application A Application B Application C ▶ Application 분산 처리 - Layer4 Switch 사용 Server Load Balancing 구현 - Server효율성 향상 - 무 중단 Service 제공 Application A Application B Application C Application A Application B Application C Application A Application B Application C Congestion Wasted Capacity DNS CLients Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 14 CLients

Global Server Load Balancing (GSLB)

 GSLB(Global Server Load Balancing) 서울 전산 센타 L4 Active Switch L4 Stand-by Switch Content Server1 ▶ GSLB 구현 장점 - Server Down 및 Over Flow 방지 - 빠른 Response Time 제공 - 분산처리에 따른 Load 감소 - 원활한 Data Flow 제공 - Server 집중화에 따른 Congestion 방지

PC PC PC PC

L4 Active Switch

PC PC

Content Server 1 Group Content Server2 L4 Stand-by Switch 지역 전산 센타 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 15 -

PC PC

Content Server 2 Group

Global Server Load Balancing (GSLB)

Distribute load across mirrored sites or reverse caching sites

Reverse Cache Web Servers

• • » Switching, 로컬 및 글로벌 서버 Load Balancing • Simple configuration » » 스위치와 DNS 만의 구성 라우터의 교체 , 네트웍구성의 변화 불필요 No added latency » DNS Request 에 의한 Request Origination » » 모든 스위치에서의 다이나믹한 상태점검 각 사이트에서 이루어지는 즉각적인 의사결정 Optimized for consistent response times no matter which site services a request » » 사이트의 수행능력에 따른 로드분산 가장 뛰어난 사이트는 타 사이트를 압도하지 않고 우위를 점함 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 16 -

Firewall Load Balancing

 FLB(Firewall Load Balancing) plus SLB External Clients Dirty Network Load Balanced Firewalls Clean Network Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved Firewall Load Balancing • Load share에 의한 Firewall 부하 감소 • Firewall Fail에 대한 Automatic Back-up - 17 Load Balanced FTP/ Web Servers

Firewall Load Balancing & WCR

 FLB plus WCR(Web Cache Redirection) External Clients Dirty Network Load Balanced Firewalls Clean Network Cache Cache Cache Web Cache Redirection Private Network FLB Hot Standby • Load share에 의한 Firewall 부하 감소 • Firewall Fail에 대한 Automatic Back-up • Cache Server Redirection 기능 지원 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 18 -

Active-Active

이중화 구성

Internet

Active VIP #1 VIP = 205.178.13.226

Active VIP #2 VIP = 205.178.13.227

Active VIP #3 VIP = 205.178.13.228

VIP #1

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved

Active VIP #2 Active Active VIP #1 VIP = 205.178.13.226

Active VIP #2 VIP = 205.178.13.227

Active VIP #3 VIP = 205.178.13.228

Link with traffic Link without traffic

…….

VIP #3

- 19 -

Active-Active

이중화 구성

(

계속

)

VIP_1

DfGw = A DfGw = B • VRRP-based with Alteon extensions » Virtual L3/L4 (VIP) interfaces 는 2 또는 그 이상의 스위치를 놓을 수 있다 .

Switch A

Master VIP_1 Backup VIP_2 VRRP

Switch B VIP_2

» Master 와 backup 은 모든 가상 인터페이스를 위한 트래픽을 Process 할 수 있다 .

» 운용의 편이를 위한 모든 서버들의 동일한 기본값 게이트웨이 Address » Incoming Traffic 을 위한 OSPF load sharing » 스위치는 WAN 라우터를 통해 외부로 나가는 트래픽을 Load Balancing 한다 .

• Advantages: Master VIP_2 Backup VIP_1 » Performance 의 최대화 » 무제한의 리얼서버 , addressing 및 동시 세션을 가능하게 하는 확장성 있는 Load Balancing 시스템 » Switching 중단의 영향을 최소화 » 극히 소수의 중단률 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 20 -

Web

기반 관리 기능

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 21 -

Layer 4

스위치 구축 사례

▶ “D사”

#1

- 문제점 : ⓐ Firewall의 Load 집중 (Active, Stand-by), ⓑ Cyber Trading Server의 Load 분산 처리 필요 - 적용내용 : ⓐ Firewall Load Balancing, ⓑ Server Load Balancing - 적용방법 : ACedirector2를 이용한 Firewall, Cyber Trading Server의 Load 재분배 - 적용구성도 본사 LAN Switch Private Network

HUB

F/W 3 FLB F/W 1 Internet Network Internet SLB Router F/W 2

Switching HUB

DMS, Web Server DMZ Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 22 -

Layer 4

스위치 구축 사례

▶ “L사”

#2

- 문 제 점 : Cyber Trading Server의 Load 분산 처리 필요 - 적용내용 : Server Load Balancing - 적용방법 : Alteon Layer4 Switch를 사용 Cyber Trading Server의 Load 재분배 - 적용구성도 1. Internet User Internet 1. Home Line User 3. VPDN User VPDN (014xx) Router Router F/W AlteonL4 Switch Server Farm F/W AlteonL4 Switch Server Farm Router 4. X.25 User X.25

Router Router F/W

Switching HUB

Router F/W AlteonL4 Switch Server Farm Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 23 -

Layer 4

스위치 구축 사례

▶ “K사”

#3

- 문 제 점 : ⓐ Dual Router Load 분산 처리 필요 ⓑ Cyber Trading Server Load 분산 처리 필요 - 적용내용 : ⓐ Router Load Balancing ⓑ Server Load Balancing - 적용방법 : Alteon Layer4 Switch를 사용 Router와 Cyber Trading Server의 Load 재분배 - 적용구성도 본사 LAN SLB Switch Private Network Internet Network F/W 2 Active Switch Router2 RLB

Switching HUB

F/W 1 Stand-by Switch Router1 DMS, Web Server DMZ Internet Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 24 -

Layer 4

스위치 해외 구축 사례

▶ ISPs/Web Hosters/Portals - Yahoo, WebTV, EDS, Digex, ANS, TCG CerfNet, Concentric, Netcom, Rogers, Verio, Bell South.Net, Sandpiper Travelogix, DataReturn, First Net, OneNet, Dacom(Korea), Pacific Internet(Singapore), Sing Net(Singapore) Cyber Net(Singapore), Telstra(Australia), Pacific Access(Australia), Shanghai Online(Chine), StarInternet (Hong Kong), Hong Kong Telecom, Cable & Wireless(UK), British Telecom, Radio Online Berlin, Teleglove JavaNet, France Telecom 외...

▶ Academic/Research - Brookhaven National Lab, Christopher Newport University, Chemnitz University, Wide Project(Japan), CREN (Switzerland), University of Ryuku(Japan) 외...

▶ Hardware/Software Mfg - Portal Software, Qualcomm 외...

▶ Entertainment/Broadcast/Video - IMIS(UK), Matsushita computer 외...

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 25 -

L4

스위치 하드웨어 아키텍처 구조

Layer 4

스위치 전면부

Selectable 8 x 10/100 or 1000SX Ethernet ports 6 LEDs/port - Data - Link - Active

Alteon 180e

1- 100 or Gigabit Ethernet uplink on Port 9 AC and DC power available Console port Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 27 -

Alteon Web Switch 180e

내부 구조

RISC Management Module Memory RISC Flash 8 Gbps Switch Backplane Switch Ports RISC RISC Fwd Engine WebIC Memory RISC RISC Fwd Engine WebIC Memory ...

RISC RISC Fwd Engine WebIC Memory • • •

Distributed processing with dedicated RISC processors on every data path

WebIC ASIC: 하드웨어를 지원하는 포트마다 두개의 forwarding engine 과 속도와 유동성을 위해 각 RISC 프로세서가 있음 management, routing update, server 포함한 중앙기능 들을 위해 와 site monitoring, data path 전용의 processor 를 분리 Processing 을 Processing 의 집적과 멀티서비스세션의 스위칭을 위해 최적화 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 28 -

Virtual Matrix Architecture (VMA)

Client DA_X SA_1 DA_Y SA_2 DA_X SA_1 DA_X SA_3 CPU CPU CPU CPU DA_X, SA_3, RIP_A DA_X, SA_1, RIP_A CPU CPU DA_Y, SA_2, RIP_B CPU CPU

DA_X, SA_1, RIP_A

Server Unattached port Server

Performance of distributed architecture with centralized

architecture’s resource utilization

– Each ingress packet hashed to one of 8 ports for L4-7 processing – Hashing algorithm ensures even distribution of Internet traffic – Packets in same session always hashed to the same CPU Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 29 -

L4

스위치 기본 설정

Switch Basics

• • • • • • The switch is a Layer 2 device with Layer 3 functionality All Layer 4 to 7 features are off by default Allows for a single instance of Spanning Tree Supports 10/100/1000Mbps Ethernet Supports Telnet, SSH and CLI Boots in 10 seconds!! Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 31 -

Console Connection

• Requires standard DB9 cable with male connection • Standard connection » 9600 baud » 8 data bits » No parity bit » 1 stop bit » No flow control • Hyperterminal or any other terminal emulator Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 32 -

Upgrading Switch Code

• Two software images plus boot image • Upgrading procedure » Option 1 - Download image from tftp server to switch » Option 2 – Load image via serial download(33,6k, 56k) • /boot menu » gtimg – » downloads new image via TFTP Where to put image » » TFTP server IP address Image file name • _mp vs. _boot & bin • 180e vs. 184 » ptimg – transfers image to a TFTP server • Reset switch with /boot/reset command Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 33 -

Setting the Switch Configuration Block

• Two user configuration blocks or a factory configuration • /boot/conf command » active » backup » factory Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 34 -

Setting Telnet

• Telnet capabilities • Enable/disable telnet » /cfg/sys/tnet » From console port only » Telnet timeout default set to 5 minutes Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 35 -

Switch Timeout

• Switch CLI session timeout » 1 to 60 minutes » Default set to 5 minutes • /cfg/sys/idle » Set time from 1 to 60 minutes Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 36 -

Setting Switch Date and Time

• /cfg/sys/date • /cfg/sys/time <24 hour time> Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 37 -

Port Configurations

• Configure individual physical switch ports » /cfg/port fast menu » Link speed - speed » » » Duplex mode - mode Flow control - fctl Autonegotiation enable/disable - auto • Enable/disable a switch port » /cfg/port menu » ena/dis (or shorter term e/d) Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 38 -

IP Interfaces

• Switch supports 256 IP Interfaces • Switch supports 246 Vlans • The interfaces are

logical

and are associated with Vlans • Vlans are in turn associated with Physical ports • Each port can support 246 Vlans by using Vlan Tagging • All IP interfaces can be on different subnets all in the same Vlan • Interfaces need to be enabled in order to become active Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 39 -

IP Interfaces

VLAN's IP I/F's Routing Protocols Routes Static Routes ARP Cache STP Domains MAC Addresses AD3/4 and 180e/184

246 256 RIP I, BGP Lite (up to 4 peers) 1K 64 (128) 4K 1 (8) 2K

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 40 -

Changing Password

• Default Password is admin • To change a user level password » Administrator access to switch with admin password » /cfg/sys/user menu then select user to change » admpw » » » » » » l4apw usrpw sopw l4opw opw sapw Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 41 -

Switch Administration Security Protection

• • • user » Generic switch access to view switch statistics and status information » Default - user • slboper » Operator that manages web servers and other Internet services and their loads l4oper » Operator that manages traffic on the lines leading to the Internet services oper » Operator that manages all functions of the switch and is permitted to reset ports or the entire switch Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 42 -

Switch Administration Security Protection

• slbadmin » Administrator that configures and manages web servers and other Internet services and their loads • l4admin » Administrator that configures and manages the traffic on the lines leading to the shares Internet services » Default - l4admin • admin » The Superuser Administrator that has access to all of the switch's management and configuration features » Default - admin • Password determines user level Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 43 -

Setting Up a Syslog

• Configure up to two hosts to capture syslog messages • /cfg/sys/syslog/host • Eight different types of syslog messages » EMERG: system is unusable » ALERT: immediate action required » CRIT: critical condition » ERR: error condition/operation » WARNING: warning condition » NOTICE: normal but significant condition » INFO: information message » DEBUG: debug level message Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 44 -

Setting Up SNMP

• Allows for the switch to support SNMP network management » /cfg/snmp menu  System name, system location, contact information (64 characters each)  Read/write community strings (32 characters)  IP address of up to 2 hosts to receive system traps (allows for community string access) » /cfg/sys/snmp menu  Current SNMP access: disabled  Enter new SNMP access (disabled/read-only/read-write) [d/r/w]: Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 45 -

Command Line Basics

» » » » » » »

/

Move back to Main menu

..

Move back one menu level

.

Show menu for current context

apply

Makes changes active in volatile RAM

save

Save changes to non-volatile Active Flash bank.

diff [flash]

View un-applied [applied but un-saved] changes

revert [apply]

Revert un-applied [applied but not saved] changes Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 46 -

Useful Reference Material

• • • • • • • /info/link

View physical port Link state

/info/vrrp

Show VRRP information

/info/ip

Show IP Interface Information

/info/route/dump

Dump the routing table

/info/slb/dump

Show SLB state and information

/info/slb/sess/

Dump session table or find entry by clients IP address

/stat/slb/

View SLB statistics for Virtual Server, Real Server or Group

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 47 -

Useful Reference Material

• Glossary »

Service

» » Part of a Virtual Server which associates a TCP or UDP port and Group to be load balanced

Virtual Server

Comprises of a

VIP

and up to

8 services

.

Up to 256 Virtual Servers per switch

VIP

(Virtual IP Address) » » Destination IP to load balance service requests from clients

Real [server]

A physical server - May have more than 1 RIP bound to it

RIP

(Real IP Address) IP address on a Real server - Up to 256 (4096) RIP per switch Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 48 -

Server Load Balancing

Server Load Balancing

• •

Internet Traffic comes into a Virtual IP address which is resolved via DNS The VIP (Virtual IP Address) is associated with a Group of Real

Servers The Alteon load balances the requests

to the Real Servers Request forwarding is determined using an algorithm to establish the

load on each Real Server Health checks are used to determine Real Server responsiveness and availability VIP Servers Virtual Web Site

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 50 -

Server Load Balancing

• Real Servers » Can have Public or Private IP Addresses » Must run a TCP/UDP service » Up to 1024 Real Servers can be configured (Version 10) » Must Belong to a Group but can be a member of multiple Groups » Can be gracefully enabled or disabled from Groups on the fly » Can have maximum connections and timeout values assigned • Groups » Support of up to 256 Groups » A Group can support 1024 Real Servers » Requires a

Health Check

metric » Requires a

Load Balancing

Metric Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 51 -

Server Load Balancing

• Virtual IP Address (VIP) » Also called

Virtual Server

» Up to 256 VIPs can be configured » Each VIP must have at least one service (TCP/UDP port such as HTTP, HTTPS, FTP etc.) associated with it » Must have a Group associated with each service » Each VIP can support 8 Services » Support Port Mapping from any Vport to any Rport – up to 16 Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 52 -

Server Load Balancing

• Client / Server processing » Changes DIP from VIP to Real server IP and vice-versa » Client processing also creates session binding entry based on client SIP and Sport

Client 200.20.20.1

SIP 200.20.20.1

DIP 100.10.10.1

DMAC = V-MAC VIP 100.10.10.1

Client processing SIP 200.20.20.1

DIP 192.168.1.1

DMAC = R-MAC Server 192.168.1.1

Server processing SIP 100.10.10.1

DIP 200.20.20.1

DMAC = C-MAC SIP 192.168.1.1

DIP 200.20.20.1

DMAC = DGW-MAC

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 53 -

Server Load Balancing

• Client processing

MAC TCP Dst MAC Src MAC Src IP Address Dst IP Address IP Checksum Src Port Dst Port TCP Checksum

Vmac Cmac CIP VIP B62A 2155 80 037A Vmac Cmac CIP VIP B62A 2155 80 037A Rmac Cmac CIP RIP 48A0 2155 80 C107 Client Alteon Switch Rmac Cmac CIP RIP 48A0 2155 80 C107 Real Server

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 54 -

Server Load Balancing

• Server processing

MAC TCP Dst MAC Src MAC Src IP Address Dst IP Address IP Checksum Src Port Dst Port TCP Checksum

Cmac Vmac VIP CIP 644B 80 2155 761A Cmac Vmac VIP CIP 644B 80 2155 761A Cmac Rmac RIP CIP 823F 80 2155 0A15 Client Alteon Switch Cmac Rmac RIP CIP 823F 80 2155 0A15 Real Server

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 55 -

Load Balancing Metrics

• Used to determine which server/service should receive the inbound traffic • Granularity from IP Address to Cookies/URL, URI and HTTP Headers • Decision is made during Client processing • Group configuration item for Layer 4 function • VIP and Filter configuration item for Layer 7 functions Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 56 -

Load Balancing Metrics

• Load Based or Persistent Based • Load Based: » Round Robin / Weighted Round Robin » Least Connections / Weighted Least Connections » Response Time » Bandwidth • Persistent Based » Hash : Weight has no effect, and Maxconn is supported » Minimum Misses » SSL ID » Cookie Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 57 -

Health Checks

• •

Health check types are:

» ICMP » TCP - 3 way handshake on configured Service port » Content - HTTP » Application specific – Radius, SSL, POP, DNS etc.

» Scripted – send sequence, expected response Note: » If you put all Services on a Real server into one Group and one service fails, all services in that Group will be marked Failed or Blocked » It is therefore recommended that Services are put into different Groups when adding more than 1 service per Real server Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 58 -

Server Load Balancing

• All configuration happens under the /cfg/slb/ menu • Steps: » Turn on SLB » Set up Real Servers » Set up Groups » Configure VIP with required services » Enable correct processing (client/servers) is on for ports Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 59 -

Server Load Balancing

• Troubleshooting » Is SLB enabled » Are the Reals enabled » Is the Virt enabled » Are the Groups associated with the correct Service • Use the /info or /stat menus to get SLB information Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 60 -

질의/응답

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 61 -

Copyrightⓒ 2004 RingNet Ltd., All Rights Reserved - 62 -