12-可靠性配置指导

· 配置接口IP地址

[LB] interface gigabitethernet 1/0/1

[LB-GigabitEthernet1/0/1] ip address 61.159.4.100 24

[LB-GigabitEthernet1/0/1] quit

[LB] interface gigabitethernet 1/0/2

[LB-GigabitEthernet1/0/2] ip address 192.168.1.100 24

[LB-GigabitEthernet1/0/2] quit

[LB] nqa template icmp t1

# 创建ICMP类型的NQA模板t1。

[LB-nqatplt-icmp-t1] quit

# 创建实服务组sf，配置其调度算法为加权轮转算法，并指定其健康检测方法为t1。

[LB-sfarm-sf] predictor round-robin

[LB-sfarm-sf] probe t1

[LB-sfarm-sf] quit

# 创建实服务器rs1，配置其IPv4地址为192.168.1.1、端口号为21、权值为150，并加入实服务组sf。

[LB-rserver-rs1] ip address 192.168.1.1

[LB-rserver-rs1] port 21

[LB-rserver-rs1] weight 150

[LB-rserver-rs1] server-farm sf

[LB-rserver-rs1] quit

# 创建实服务器rs2，配置其IPv4地址为192.168.1.2、端口号为21、权值为120，并加入实服务组sf。

[LB-rserver-rs2] ip address 192.168.1.2

[LB-rserver-rs2] port 21

[LB-rserver-rs2] weight 120

[LB-rserver-rs2] server-farm sf

[LB-rserver-rs2] quit

# 创建实服务器rs3，配置其IPv4地址为192.168.1.3、端口号为21、权值为80，并加入实服务组sf。

[LB-rserver-rs3] ip address 192.168.1.3

[LB-rserver-rs3] port 21

[LB-rserver-rs3] weight 80

[LB-rserver-rs3] server-farm sf

[LB-rserver-rs3] quit

[LB] virtual-server vs type tcp

# 创建TCP类型的虚服务器vs，配置其VSIP为61.159.4.100，指定其默认的主用实服务组为sf，并开启此虚服务器。

[LB-vs-tcp-vs] virtual ip address 61.159.4.100

[LB-vs-tcp-vs] default server-farm sf

[LB-vs-tcp-vs] service enable

[LB-vs-tcp-vs] quit

在三台物理服务器Server A、Server B和Server C上，将默认网关都配置为192.168.1.100。

4. 验证配置

# 显示所有实服务器的简要信息。

Real server Address Port State Server farm

rs1 192.168.1.1 21 Active sf

rs2 192.168.1.2 21 Active sf

rs3 192.168.1.3 21 Active sf

# 显示所有实服务组的详细信息。

Server farm: sf

Description:

Predictor: Round robin

NAT: Enabled

SNAT pool:

Failed action: Keep

Active threshold: Disabled

Slow-online: Disabled

Selected server: Disabled

Total real server: 3

Active real server: 3

Real server list:

Name State Address Port Weight Priority

rs1 Active 192.168.1.1 21 150 4

rs2 Active 192.168.1.2 21 120 4

rs3 Active 192.168.1.3 21 80 4

# 显示所有虚服务器的详细信息。

Virtual server: vs

Description:

Type: TCP

State: Active

VPN instance:

Virtual IPv4 address: 61.159.4.100/32

Virtual IPv6 address: --

Port: 0

Default server farm: sf (in use)

Backup server farm:

Sticky:

LB policy:

Connection limit: --

Rate limit:

Connections: --

Bandwidth: --

Inbound bandwidth: --

Outbound bandwidth: --

Connection synchronization: Disabled

Sticky synchronization: Disabled

2.13.2 四层服务器负载均衡双机热备配置举例

1. 组网需求

· 三台物理服务器Server A、Server B和Server C均可提供FTP服务，且这三台服务器的硬件配置顺次降低。通过配置负载均衡，在考虑硬件性能的前提下让这三台服务器联合提供FTP服务，并通过健康检测来监控这些服务器是否可达。

· 为了提高可靠性，由两台负载均衡设备采用双机热备方式进行组网。在这两台负载均衡设备上，要实现会话扩展信息和持续性表项的实时批量备份，以确保主备倒换过程中服务不中断。

2. 组网图

图2-8 四层服务器负载均衡双机热备配置组网图

3. 配置步骤

[LB] track 1 interface gigabitethernet 1/0/1

· 配置IRF

将两台负载均衡设备配置成一台IRF设备，它们在IRF中的成员编号分别为1和2，配置过程略。

· 配置以太网冗余接口

# 创建以太网冗余接口Reth1，为其配置IP地址并添加成员接口。

[LB] interface reth 1

[LB-Reth1] ip address 61.159.4.100 24

[LB-Reth1] member interface gigabitethernet 1/0/1 priority 20

[LB-Reth1] member interface gigabitethernet 2/0/1 priority 10

[LB-Reth1] quit

# 创建以太网冗余接口Reth2，为其配置IP地址并添加成员接口。

[LB] interface reth 2

[LB-Reth2] ip address 192.168.1.100 24

[LB-Reth2] member interface gigabitethernet 1/0/2 priority 20

[LB-Reth2] member interface gigabitethernet 2/0/2 priority 10

[LB-Reth2] quit

· 配置冗余组

# 分别创建四个Track项，各自监视一个以太网接口的状态。

[LB] track 2 interface gigabitethernet 1/0/2

[LB] track 3 interface gigabitethernet 2/0/1

[LB] track 4 interface gigabitethernet 2/0/2

# 创建冗余组bkp，并为其添加成员接口Reth1和Reth2。

[LB] redundancy group bkp

[LB-redundancy-group-bkp] member interface reth 1

[LB-redundancy-group-bkp] member interface reth 2

# 创建冗余组主节点1（优先级为100），将其与成员设备1绑定，并关联Track项1和2。

[LB-redundancy-group-bkp] node 1

[LB-redundancy-group-bkp-node-1] priority 100

[LB-redundancy-group-bkp-node-1] bind slot 1

[LB-redundancy-group-bkp-node-1] track 1 interface gigabitethernet 1/0/1

[LB-redundancy-group-bkp-node-1] track 2 interface gigabitethernet 1/0/2

[LB-redundancy-group-bkp-node-1] quit

# 创建冗余组备节点2（优先级为50），将其与成员设备2绑定，并关联Track项3和4。

[LB-redundancy-group-bkp] node 2

[LB-redundancy-group-bkp-node2] priority 50

[LB-redundancy-group-bkp-node2] bind slot 2

[LB-redundancy-group-bkp-node2] track 3 interface gigabitethernet 2/0/1

[LB-redundancy-group-bkp-node2] track 4 interface gigabitethernet 2/0/2

[LB-redundancy-group-bkp-node2] quit

[LB-redundancy-group-bkp] quit

[LB] nqa template icmp t1

# 创建ICMP类型的NQA模板t1。

[LB-nqatplt-icmp-t1] quit

# 创建实服务组sf，配置其调度算法为加权轮转算法，并指定其健康检测方法为t1。

[LB-sfarm-sf] predictor round-robin

[LB-sfarm-sf] probe t1

[LB-sfarm-sf] quit

# 创建实服务器rs1，配置其IPv4地址为192.168.1.1、端口号为21、权值为150，并加入实服务组sf。

[LB-rserver-rs1] ip address 192.168.1.1

[LB-rserver-rs1] port 21

[LB-rserver-rs1] weight 150

[LB-rserver-rs1] server-farm sf

[LB-rserver-rs1] quit

# 创建实服务器rs2，配置其IPv4地址为192.168.1.2、端口号为21、权值为120，并加入实服务组sf。

[LB-rserver-rs2] ip address 192.168.1.2

[LB-rserver-rs2] port 21

[LB-rserver-rs2] weight 120

[LB-rserver-rs2] server-farm sf

[LB-rserver-rs2] quit

# 创建实服务器rs3，配置其IPv4地址为192.168.1.3、端口号为21、权值为80，并加入实服务组sf。

[LB-rserver-rs3] ip address 192.168.1.3

[LB-rserver-rs3] port 21

[LB-rserver-rs3] weight 80

[LB-rserver-rs3] server-farm sf

[LB-rserver-rs3] quit

[LB] virtual-server vs type tcp

# 创建TCP类型的虚服务器vs，配置其VSIP为61.159.4.100，指定其默认的主用实服务组为sf，分别开启会话扩展信息和持续性表项的备份功能，并开启此虚服务器。

[LB-vs-tcp-vs] virtual ip address 61.159.4.100

[LB-vs-tcp-vs] default server-farm sf

[LB-vs-tcp-vs] connection-sync enable

[LB-vs-tcp-vs] sticky-sync enable

[LB-vs-tcp-vs] service enable

[LB-vs-tcp-vs] quit

[LB] display redundancy group bkp

在三台物理服务器Server A、Server B和Server C上，将默认网关都配置为192.168.1.100。

4. 验证配置

# 显示冗余组bkp的相关信息。

Redundancy group bkp (ID 1):

Node ID Slot Priority Status Track weight

1 Slot1 100 Primary 255

2 Slot2 50 Secondary 255

Preempt delay time remained : 0 min

Preempt delay timer setting : 1 min

Remaining hold-down time : 0 sec

Hold-down timer setting : 1 sec

Manual switchover request : No

Member interfaces:

Reth1 Reth2

Member failover groups:

Node 1:

Track info:

Track Status Reduced weight Interface

1 Positive 255 GE1/0/1

2 Positive 255 GE1/0/2

Node 2:

Track info：

Track Status Reduced weight Interface

3 Negative 255 GE2/0/1

4 Negative 255 GE2/0/2

# 显示所有实服务器的简要信息。

Real server Address Port State Server farm

rs1 192.168.1.1 21 Active sf

rs2 192.168.1.2 21 Active sf

rs3 192.168.1.3 21 Active sf

# 显示所有实服务组的详细信息。

Server farm: sf

Description:

Predictor: Round robin

NAT: Enabled

SNAT pool:

Failed action: Keep

Active threshold: Disabled

Slow-online: Disabled

Selected server: Disabled

Total real server: 3

Active real server: 3

Real server list:

Name State Address Port Weight Priority

rs1 Active 192.168.1.1 21 150 4

rs2 Active 192.168.1.2 21 120 4

rs3 Active 192.168.1.3 21 80 4

# 显示所有虚服务器的详细信息。

Virtual server: vs

Description:

Type: TCP

State: Active

VPN instance:

Virtual IPv4 address: 61.159.4.100/32

Virtual IPv6 address: --

Port: 0

Default server farm: sf (in use)

Backup server farm:

Sticky:

LB policy:

Connection limit: --

Rate limit:

Connections: --

Bandwidth: --

Inbound bandwidth: --

Outbound bandwidth: --

Connection synchronization: Enabled

Sticky synchronization: Enabled

2.13.3 七层服务器负载均衡基本功能配置举例

1. 组网需求

三台物理服务器Server A、Server B和Server C均可提供HTTP服务，且这三台服务器的硬件配置顺次降低。通过配置负载均衡，在考虑硬件性能的前提下让这三台服务器联合提供HTTP服务，并通过健康检测来监控这些服务器是否可达。

2. 组网图

图2-9 七层服务器负载均衡基本功能配置组网图

3. 配置步骤

· 配置接口IP地址

[LB] interface gigabitethernet 1/0/1

[LB-GigabitEthernet1/0/1] ip address 61.159.4.100 24

[LB-GigabitEthernet1/0/1] quit

[LB] interface gigabitethernet 1/0/2

[LB-GigabitEthernet1/0/2] ip address 192.168.1.100 24

[LB-GigabitEthernet1/0/2] quit

# 创建HTTP类型的NQA模板t1。

[LB] nqa template http t1

[LB-nqatplt-http-t1] quit

# 创建实服务组sf，配置其调度算法为加权轮转算法，并指定其健康检测方法为t1。

[LB-sfarm-sf] predictor round-robin

[LB-sfarm-sf] probe t1

[LB-sfarm-sf] quit

# 创建实服务器rs1，配置其IPv4地址为192.168.1.1、端口号为8080、权值为150，并加入实服务组sf。

[LB-rserver-rs1] ip address 192.168.1.1

[LB-rserver-rs1] port 8080

[LB-rserver-rs1] weight 150

[LB-rserver-rs1] server-farm sf

[LB-rserver-rs1] quit

# 创建实服务器rs2，配置其IPv4地址为192.168.1.2、端口号为8080、权值为120，并加入实服务组sf。

[LB-rserver-rs2] ip address 192.168.1.2

[LB-rserver-rs2] port 8080

[LB-rserver-rs2] weight 120

[LB-rserver-rs2] server-farm sf

[LB-rserver-rs2] quit

# 创建实服务器rs3，配置其IPv4地址为192.168.1.3、端口号为8080、权值为80，并加入实服务组sf。

[LB-rserver-rs3] ip address 192.168.1.3

[LB-rserver-rs3] port 8080

[LB-rserver-rs3] weight 80

[LB-rserver-rs3] server-farm sf

[LB-rserver-rs3] quit

[LB] virtual-server vs type http

# 创建HTTP类型的虚服务器vs，配置其VSIP为61.159.4.100，指定其默认的主用实服务组为sf，并开启此虚服务器。

[LB-vs-http-vs] virtual ip address 61.159.4.100

[LB-vs-http-vs] default server-farm sf

[LB-vs-http-vs] service enable

[LB-vs-http-vs] quit

在三台物理服务器Server A、Server B和Server C上，将默认网关都配置为192.168.1.100。

4. 验证配置

# 显示所有实服务器的简要信息。

Real server Address Port State Server farm

rs1 192.168.1.1 8080 Active sf

rs2 192.168.1.2 8080 Active sf

rs3 192.168.1.3 8080 Active sf

# 显示所有实服务组的详细信息。

Server farm: sf

Description:

Predictor: Round robin

NAT: Enabled

SNAT pool:

Failed action: Keep

Active threshold: Disabled

Slow-online: Disabled

Selected server: Disabled

Total real server: 3

Active real server: 3

Real server list:

Name State Address Port Weight Priority

rs1 Active 192.168.1.1 8080 150 4

rs2 Active 192.168.1.2 8080 120 4

rs3 Active 192.168.1.3 8080 80 4

# 显示所有虚服务器的详细信息。

Virtual server: vs

Description:

Type: HTTP

State: Active

VPN instance:

Virtual IPv4 address: 61.159.4.100/32

Virtual IPv6 address: --

Port: 80

Default server farm: sf (in use)

Backup server farm:

Sticky:

LB policy:

HTTP parameter profile:

Connection limit: --

Rate limit:

Connections: --

Bandwidth: --

Inbound bandwidth: --

Outbound bandwidth: --

SSL server policy:

SSL client policy:

Redirect relocation:

Redirect return-code: 302

Sticky synchronization: Disabled

2.13.4 七层服务器负载均衡SSL终结配置举例

1. 组网需求

· 三台物理服务器Server A、Server B和Server C均可提供HTTP服务，且这三台服务器的硬件配置顺次降低。通过配置负载均衡，在考虑硬件性能的前提下让这三台服务器联合提供HTTP服务，并通过健康检测来监控这些服务器是否可达。

· 为了在提高用户访问安全性的同时又不增加服务器的负担，在主机与负载均衡设备之间采用通过SSL加密的HTTPS连接，而在负载均衡设备与服务器之间则采用普通的HTTP连接。负载均衡设备在其中需要完成SSL终结的工作，即终结与主机的SSL会话，并与服务器建立TCP连接。

2. 组网图

图2-10 七层服务器负载均衡SSL终结配置组网图

3. 配置步骤

· 配置接口IP地址

[LB] interface gigabitethernet 1/0/1

[LB-GigabitEthernet1/0/1] ip address 61.159.4.100 24

[LB-GigabitEthernet1/0/1] quit

[LB] interface gigabitethernet 1/0/2

[LB-GigabitEthernet1/0/2] ip address 192.168.1.100 24

[LB-GigabitEthernet1/0/2] quit

# 创建HTTP类型的NQA模板t1。

[LB] nqa template http t1

[LB-nqatplt-http-t1] quit

# 创建实服务组sf，配置其调度算法为加权轮转算法，并指定其健康检测方法为t1。

[LB-sfarm-sf] predictor round-robin

[LB-sfarm-sf] probe t1

[LB-sfarm-sf] quit

# 创建实服务器rs1，配置其IPv4地址为192.168.1.1、端口号为8080、权值为150，并加入实服务组sf。

[LB-rserver-rs1] ip address 192.168.1.1

[LB-rserver-rs1] port 8080

[LB-rserver-rs1] weight 150

[LB-rserver-rs1] server-farm sf

[LB-rserver-rs1] quit

# 创建实服务器rs2，配置其IPv4地址为192.168.1.2、端口号为8080、权值为120，并加入实服务组sf。

[LB-rserver-rs2] ip address 192.168.1.2

[LB-rserver-rs2] port 8080

[LB-rserver-rs2] weight 120

[LB-rserver-rs2] server-farm sf

[LB-rserver-rs2] quit

# 创建实服务器rs3，配置其IPv4地址为192.168.1.3、端口号为8080、权值为80，并加入实服务组sf。

[LB-rserver-rs3] ip address 192.168.1.3

[LB-rserver-rs3] port 8080

[LB-rserver-rs3] weight 80

[LB-rserver-rs3] server-farm sf

[LB-rserver-rs3] quit

[LB] virtual-server vs type http

# 创建HTTP类型的虚服务器vs，配置其VSIP为61.159.4.100、端口号为443，指定其默认的主用实服务组为sf，引用SSL服务器端策略ssp（有关SSL服务器端策略的具体配置，请参见“安全配置指导”中的“SSL”），并开启此虚服务器。

[LB-vs-http-vs] virtual ip address 61.159.4.100

[LB-vs-http-vs] port 443

[LB-vs-http-vs] default server-farm sf

[LB-vs-http-vs] ssl-server-policy ssp

[LB-vs-http-vs] service enable

[LB-vs-http-vs] quit

在三台物理服务器Server A、Server B和Server C上，将默认网关都配置为192.168.1.100。

4. 验证配置

# 显示所有实服务器的简要信息。

Real server Address Port State Server farm

rs1 192.168.1.1 8080 Active sf

rs2 192.168.1.2 8080 Active sf

rs3 192.168.1.3 8080 Active sf

# 显示所有实服务组的详细信息。

Server farm: sf

Description:

Predictor: Round robin

NAT: Enabled

SNAT pool:

Failed action: Keep

Active threshold: Disabled

Slow-online: Disabled

Selected server: Disabled

Total real server: 3

Active real server: 3

Real server list:

Name State Address Port Weight Priority

rs1 Active 192.168.1.1 8080 150 4

rs2 Active 192.168.1.2 8080 120 4

rs3 Active 192.168.1.3 8080 80 4

# 显示所有虚服务器的详细信息。