本举例是在F1090的R8660P33版本上进行配置和验证的。
如下图所示，三台物理服务器Server A、Server B和Server C均可提供HTTP服务，且这三台服务器的硬件配置顺次降低。通过配置服务器负载均衡，在考虑硬件性能的前提下让这三台服务器联合提供HTTP服务，并通过健康检测来监控这些服务器是否可达。
为了在提高用户访问安全性的同时又不增加服务器的负担，在主机与负载均衡设备之间采用通过SSL加密的HTTPS连接，而在负载均衡设备与服务器之间则采用普通的HTTP连接。负载均衡设备在其中需要完成SSL终结的工作，即终结与主机的SSL会话，并与服务器建立TCP连接。
图-1 七层服务器负载均衡SSL终结配置组网图
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 61.159.4.100 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
配置静态路由
本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。
# 请根据组网图中规划的信息，配置静态路由，本举例假设到达Host的下一跳IP地址为61.159.4.1，实际使用中请以具体组网情况为准，具体配置步骤如下。
[Device] ip route-static 1.1.1.1 24 61.159.4.1
配置接口加入安全域。
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1
[Device-security-zone-Untrust] quit
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/2
[Device-security-zone-Trust] quit
配置安全策略
配置安全策略放行Untrust与Local安全域、Local与Trust安全域之间的流量，用于用户访问服务器。
# 配置名称为lblocalin的安全策略规则，使用户可以向Device发送报文，具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name lblocalin
[Device-security-policy-ip-1-lblocalin] source-zone untrust
[Device-security-policy-ip-1-lblocalin] destination-zone local
[Device-security-policy-ip-1-lblocalin] destination-ip-subnet 61.159.4.0 255.255.255.0
[Device-security-policy-ip-1-lblocalin] action pass
[Device-security-policy-ip-1-lblocalin] quit
# 配置名称为lblocalout的安全策略规则，使Device可以向服务器发送报文，具体配置步骤如下。
[Device-security-policy-ip] rule name lblocalout
[Device-security-policy-ip-2-lblocalout] source-zone local
[Device-security-policy-ip-2-lblocalout] destination-zone trust
[Device-security-policy-ip-2-lblocalout] destination-ip-subnet 192.168.1.0 255.255.255.0
[Device-security-policy-ip-2-lblocalout] action pass
[Device-security-policy-ip-2-lblocalout quit
[Device-security-policy-ip] quit
配置实服务组
# 创建SSL类型的NQA模板t1。
[Device] nqa template ssl t1
[Device-nqatplt-ssl-t1] quit
# 创建实服务组sf，配置其调度算法为加权轮转算法，并指定其健康检测方法为t1。
[Device] server-farm sf
[Device-sfarm-sf] predictor round-robin
[Device-sfarm-sf] probe t1
[Device-sfarm-sf] quit
配置SSL服务器端策略
# 配置PKI域1（有关PKI域的具体配置，请参见“安全配置指导”中的“PKI”）。
[Device] pki domain 1
[Device-domain-1] quit
# 创建一个名为ssp的SSL服务器端策略，并使用名为1的PKI域，配置验证客户端身份。
[Device] ssl server-policy ssp
[Device-ssl-server-policy-ssp] pki-domain 1
[Device-ssl-server-policy-ssp] client-verify enable
[Device-ssl-server-policy-ssp] quit
配置实服务器
# 创建实服务器rs1，配置其IPv4地址为192.168.1.1、端口号为8080、权值为150，并加入实服务组sf。
[Device] real-server rs1
[Device-rserver-rs1] ip address 192.168.1.1
[Device-rserver-rs1] port 8080
[Device-rserver-rs1] weight 150
[Device-rserver-rs1] server-farm sf
[Device-rserver-rs1] quit
# 创建实服务器rs2，配置其IPv4地址为192.168.1.2、端口号为8080、权值为120，并加入实服务组sf。
[Device] real-server rs2
[Device-rserver-rs2] ip address 192.168.1.2
[Device-rserver-rs2] port 8080
[Device-rserver-rs2] weight 120
[Device-rserver-rs2] server-farm sf
[Device-rserver-rs2] quit
# 创建实服务器rs3，配置其IPv4地址为192.168.1.3、端口号为8080、权值为80，并加入实服务组sf。
[Device] real-server rs3
[Device-rserver-rs3] ip address 192.168.1.3
[Device-rserver-rs3] port 8080
[Device-rserver-rs3] weight 80
[Device-rserver-rs3] server-farm sf
[Device-rserver-rs3] quit
配置虚服务器
# 创建HTTP类型的虚服务器vs，配置其VSIP为61.159.4.200、端口号为443，指定其缺省主用实服务组为sf，引用SSL服务器端策略ssp，并开启此虚服务器。
[Device] virtual-server vs type http
[Device-vs-http-vs] virtual ip address 61.159.4.200
[Device-vs-http-vs] port 443
[Device-vs-http-vs] default server-farm sf
[Device-vs-http-vs] ssl-server-policy ssp
[Device-vs-http-vs] service enable
#指定发送免费ARP报文或者ND报文的接口。当设备接口IP地址与虚服务器的IP地址同网段时，通过指定接口发送免费ARP报文或者ND报文。
[Device-vs-http-vs] arp-nd interface gigabitethernet 1/0/1
[Device-vs-http-vs] quit
在三台物理服务器Server A、Server B和Server C上，将缺省网关都配置为192.168.1.100。
# 显示所有实服务器的简要信息。
[Device] display real-server brief
Real server Address Port State VPN instance Server farm
rs1 192.168.1.1 8080 Active sf
rs2 192.168.1.2 8080 Active sf
rs3 192.168.1.3 8080 Active sf
# 显示所有实服务组的详细信息。
[Device] display server-farm
Server farm: sf
Description:
Predictor: Round robin
Proximity: Disabled
NAT: Enabled
SNAT pool:
Failed action: Keep
Active threshold: Disabled
Slow-online: Disabled
Selected server: Disabled
Total real server: 3
Active real server: 3
Real server list:
Name State VPN instance Address Port Weight Priority
rs1 Active 192.168.1.1 8080 150 4
rs2 Active 192.168.1.2 8080 120 4
rs3 Active 192.168.1.3 8080 80 4
# 显示所有虚服务器的详细信息。
[Device] display virtual-server
Virtual server: vs
Description:
Type: HTTP
State: Active
VPN instance:
Virtual IPv4 address: 61.159.4.200/32
Virtual IPv6 address: --
Port: 443
Default server farm: sf (in use)
Backup server farm:
Sticky:
LB policy:
LB limit-policy:
HTTP parameter profile:
Connection limit: --
Rate limit:
Connections: --
Bandwidth: --
Inbound bandwidth: --
Outbound bandwidth: --
SSL server policy: ssp
SSL client policy:
Redirect relocation:
Redirect return-code: 302
Connection synchronization: Disabled
Sticky synchronization: Disabled
Bandwidth busy protection: Disabled
Interface bandwidth statistics: Disabled
Route advertisement: Disabled
#
interface GigabitEthernet1/0/1
ip address 61.159.4.100 255.255.255.0
#
interface GigabitEthernet1/0/2
ip address 192.168.1.100 255.255.255.0
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
#
security-zone name Trust
import interface GigabitEthernet1/0/2
#
security-policy ip
rule 1 name lblocalin
action pass
source-zone untrust
destination-zone local
source-ip-subnet 61.159.4.0 255.255.255.0
rule 2 name lblocalout
action pass
source-zone local
destination-zone trust
destination-ip-subnet 192.168.1.0 255.255.255.0
#
nqa template ssl t1
#
pki domain 1
#
ssl server-policy ssp
pki-domain 1
client-verify enable
version ssl3.0 disable
version tls1.0 disable
#
server-farm sf
probe t1
#
real-server rs1
ip address 192.168.1.1
port 21
weight 150
server-farm sf
#
real-server rs2
ip address 192.168.1.2
port 8080
weight 120
server-farm sf
#
real-server rs3
ip address 192.168.1.3
port 8080
weight 80
server-farm sf
#
virtual-server vs type http
port 443
virtual ip address 61.159.4.200
default server-farm sf
ssl-server-policy ssp
arp-nd interface GigabitEthernet1/0/1
service enable