本举例是在F5000-AI160的E8371版本上进行配置和验证的。
如下图所示，用户从两个运营商ISP 1和ISP 2处分别租用了带宽相同的两条链路Link 1和Link 2。属于ISP 1 DNS服务器的IP地址为10.1.2.100，属于ISP 2的DNS服务器的IP地址为20.1.2.100。
当内网用户通过域名www.example.com访问外网的Web服务器Web Server A和Web Server B时，使上网流量均匀地分布在不同的链路上。
图-1 DNS透明代理基本组网配置组网图
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 192.168.1.100 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
配置接口加入安全域。
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/1
[Device-security-zone-Trust] quit
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/3
[Device-security-zone-Untrust] quit
配置安全策略
配置安全策略放行Trust与Untrust安全域、Local与Untrust安全域之间的流量，用于用户访问外网服务器。
# 配置名称为lbrule1的安全策略规则，使用户可以访问外网服务器，具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name lbrule1
[Device-security-policy-ip-1-lbrule1] source-zone trust
[Device-security-policy-ip-1-lbrule1] destination-zone untrust
[Device-security-policy-ip-1-lbrule1] source-ip-subnet 192.168.1.0 255.255.255.0
[Device-security-policy-ip-1-lbrule1] action pass
[Device-security-policy-ip-1-lbrule1] quit
# 配置名称为lblocalout的安全策略规则，使Device可以向链路下一跳发送健康检测报文，具体配置步骤如下。
[Device-security-policy-ip] rule name lblocalout
[Device-security-policy-ip-2-lblocalout] source-zone local
[Device-security-policy-ip-2-lblocalout] destination-zone untrust
[Device-security-policy-ip-2-lblocalout] destination-ip-subnet 10.1.1.0 255.255.255.0
[Device-security-policy-ip-2-lblocalout] destination-ip-subnet 20.1.1.0 255.255.255.0
[Device-security-policy-ip-2-lblocalout] action pass
[Device-security-policy-ip-2-lblocalout] quit
[Device-security-policy-ip] quit
配置链路
# 创建名为link1和link2的链路，指定链路link1出方向的下一跳IP地址为10.1.1.2，指定链路link2出方向的下一跳IP地址为20.1.1.2
[Device] loadbalance link link1
[Device-lb-link-link1] router ip 10.1.1.2
[Device-lb-link-link1] quit
[Device] loadbalance link link2
[Device-lb-link-link2] router ip 20.1.1.2
[Device-lb-link-link2] quit
配置DNS服务器池
# 创建名为dsp的DNS服务器池
[Device] loadbalance dns-server-pool dsp
[Device-lb-dspool-dsp] quit
配置DNS服务器
# 创建名为ds1的DNS服务器，配置其IPv4地址为10.1.2.100，所属DNS服务器池为dsp，并指定ds1对应的链路为link1。
[Device] loadbalance dns-server ds1
[Device-lb-ds-ds1] ip address 10.1.2.100
[Device-lb-ds-ds1] dns-server-pool dsp
[Device-lb-ds-ds1] link link1
[Device-lb-ds-ds1] quit
# 创建名为ds2的DNS服务器，配置其IPv4地址为20.1.2.100，所属DNS服务器池为dsp，并指定ds2对应的链路为link2。
[Device] loadbalance dns-server ds2
[Device-lb-ds-ds2] ip address 20.1.2.100
[Device-lb-ds-ds2] dns-server-pool dsp
[Device-lb-ds-ds2] link link2
[Device-lb-ds-ds2] quit
配置DNS透明代理
# 创建名为dns-proxy1的UDP类型的DNS透明代理，配置其IPv4地址为0.0.0.0，指定DNS服务器池为dsp，并开启DNS透明代理功能。
[Device] loadbalance dns-proxy dns-proxy1 type udp
[Device-lb-dp-udp-dp] ip address 0.0.0.0 0
[Device-lb-dp-udp-dp] default dns-server-pool dsp
[Device-lb-dp-udp-dp] service enable
[Device-lb-dp-udp-dp] quit
# 显示所有DNS服务器的简要信息。
[Device] display loadbalance dns-server brief
DNS server Address Port Link State DNS server pool
ds1 10.1.2.100 0 link1 Active dsp
ds2 20.1.2.100 0 link2 Active dsp
# 显示所有DNS服务器池的详细信息。
[Device] display loadbalance dns-server-pool
DNS server pool: dsp
Description:
Predictor: Round robin
Selected server: Disabled
Probe information:
Probe success criteria: All
Probe method:
Total DNS servers: 2
Active DNS servers: 2
DNS server list:
Name State Address port Link Weight Priority
ds1 Active 10.1.2.100 0 link1 100 4
ds2 Active 20.1.2.100 0 link2 100 4
# 显示所有DNS透明代理的详细信息。
[Device] display loadbalance dns-proxy
DNS proxy: dns-proxy1
Type: UDP
State: Active
Service state: Enabled
VPN instance:
IPv4 address: 0.0.0.0/0
IPv6 address: --
Port: 53
DNS server pool: dsp
Sticky:
LB policy:
Connection synchronization: Enabled
Sticky synchronization: Enabled
Bandwidth busy protection: Disabled
完成上述配置后，负载均衡设备可以将DNS请求报文均匀地分发到DNS Server A和DNS Server B上，从而将内网用户访问外网Web服务器的流量均匀地分配到Link 1和Link 2上。
#
interface GigabitEthernet1/0/1
ip address 192.168.1.100 255.255.255.0
#
interface GigabitEthernet1/0/2
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/3
ip address 20.1.1.1 255.255.255.0
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
import interface GigabitEthernet1/0/3
#
security-policy ip
rule 1 name lbrule1
action pass
source-zone trust
destination-zone untrust
source-ip-subnet 192.168.1.0 255.255.255.0
rule 2 name lblocalout
action pass
source-zone local
destination-zone untrust
destination-ip-subnet 10.1.1.0 255.255.255.0
destination-ip-subnet 20.1.1.0 255.255.255.0
#
loadbalance link link1
router ip 10.1.1.2
#
loadbalance link link2
router ip 20.1.1.2
#
loadbalance dns-server-pool dsp
#
loadbalance dns-server ds1
dns-server-pool dsp
ip address 10.1.2.100
link link1
#
loadbalance dns-server ds2
dns-server-pool dsp
ip address 20.1.2.100
link link2
#
loadbalance dns-proxy dns-proxy1 type udp
ip address 0.0.0.0 0
service enable
default dns-server-pool dsp
#