本举例是在M9000-AI-E8的R9071版本上进行配置和验证的。
如下图所示，用户从两个运营商ISP 1和ISP 2处分别租用了链路Link 1和Link 2，这两条链路的路由器跳数、带宽和成本均相同，但Link 1的网络延迟小于Link 2。通过配置链路负载均衡，使Host访问Server时优先选择这两条链路中的最优链路。
图-1 出方向链路负载均衡基本组网配置组网图
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 10.1.1.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
配置接口加入安全域。
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2
[Device-security-zone-Untrust] quit
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/3
[Device-security-zone-Trust] quit
配置安全策略
配置安全策略放行Trust与Untrust安全域、Local与Untrust安全域之间的流量，用于用户访问外网服务器。
# 配置名称为lbrule1的安全策略规则，使用户可以访问外网服务器，具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name lbrule1
[Device-security-policy-ip-1-lbrule1] source-zone trust
[Device-security-policy-ip-1-lbrule1] destination-zone untrust
[Device-security-policy-ip-1-lbrule1] source-ip-subnet 192.168.1.0 255.255.255.0
[Device-security-policy-ip-1-lbrule1] action pass
[Device-security-policy-ip-1-lbrule1] quit
# 配置名称为lblocalout的安全策略规则，使Device可以向链路下一跳发送健康检测报文，具体配置步骤如下。
[Device-security-policy-ip] rule name lblocalout
[Device-security-policy-ip-2-lblocalout] source-zone local
[Device-security-policy-ip-2-lblocalout] destination-zone untrust
[Device-security-policy-ip-2-lblocalout] destination-ip-subnet 10.1.1.0 255.255.255.0
[Device-security-policy-ip-2-lblocalout] destination-ip-subnet 20.1.1.0 255.255.255.0
[Device-security-policy-ip-2-lblocalout] action pass
[Device-security-policy-ip-2-lblocalout] quit
[Device-security-policy-ip] quit
配置链路组
# 创建ICMP类型的NQA模板t1，并配置每次探测结果发送机制。
[Device] nqa template icmp t1
[Device-nqatplt-icmp-t1] reaction trigger per-probe
[Device-nqatplt-icmp-t1] quit
# 指定缺省就近性探测方法为t1，并配置就近性计算的网络延迟权值为200。
[Device] loadbalance proximity
[Device-lb-proximity] match default probe t1
[Device-lb-proximity] rtt weight 200
[Device-lb-proximity] quit
# 创建链路组lg，开启就近性功能，关闭NAT功能。
[Device] loadbalance link-group lg
[Device-lb-lgroup-lg] proximity enable
[Device-lb-lgroup-lg] transparent enable
[Device-lb-lgroup-lg] quit
配置链路
# 创建链路link1和link2，配置link1的下一跳IPv4地址为10.1.1.2，link2的下一跳IPv4地址为20.1.1.2，并加入链路组lg。
[Device] loadbalance link link1
[Device-lb-link-link1] router ip 10.1.1.2
[Device-lb-link-link1] link-group lg
[Device-lb-link-link1] quit
[Device] loadbalance link link2
[Device-lb-link-link2] router ip 20.1.1.2
[Device-lb-link-link2] link-group lg
[Device-lb-link-link2] quit
配置虚服务器
# 创建LINK-IP类型的虚服务器vs，配置其VSIP为通配0.0.0.0/0，指定其缺省主用链路组为lg，并开启此虚服务器。
[Device] virtual-server vs type link-ip
[Device-vs-link-ip-vs] virtual ip address 0.0.0.0 0
[Device-vs-link-ip-vs] default link-group lg
[Device-vs-link-ip-vs] service enable
[Device-vs-link-ip-vs] quit
# 显示所有链路的简要信息。
[Device] display loadbalance link brief
Link Route IP State VPN instance Link group
link1 10.1.1.2 Active lg
link2 20.1.1.2 Active lg
# 显示所有链路组的详细信息。
[Device] display loadbalance link-group
Link group: lg
Description:
Predictor: Round robin
Proximity: Enabled
NAT: Disabled
SNAT pool:
Failed action: Keep
Active threshold: Disabled
Slow-online: Disabled
Selected link: Disabled
Probe information:
Probe success criteria: All
Probe method:
t1
Total link: 2
Active link: 2
Link list:
Name State VPN instance Router IP Weight Priority
link1 Active 10.1.1.2 100 4
link2 Active 20.1.1.2 100 4
# 显示所有虚服务器的详细信息。
[Device] display virtual-server
Virtual server: vs
Description:
Type: LINK-IP
State: Active
VPN instance:
Virtual IPv4 address: 0.0.0.0/0
Virtual IPv6 address: --
Port: 0
Primary link group: lg (in use)
Backup link group:
Sticky:
LB policy:
LB limit-policy:
Connection limit: --
Rate limit:
Connections: --
Bandwidth: --
Inbound bandwidth: --
Outbound bandwidth: --
Connection synchronization: Disabled
Sticky synchronization: Disabled
Bandwidth busy protection: Disabled
Interface bandwidth statistics: Disabled
Route advertisement: Disabled
# 显示所有IPv4就近性表项的简要信息。
[Device] display loadbalance proximity ip
(*) - Real server object
Slot 1:
IPv4 address/Mask length Timeout Best link
------------------------------------------------------------
10.1.0.0/24 50 link1
#
interface GigabitEthernet1/0/1
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/2
ip address 20.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/3
ip address 192.168.1.1 255.255.255.0
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
import interface GigabitEthernet1/0/2
#
security-zone name Trust
import interface GigabitEthernet1/0/3
#
security-policy ip
rule 1 name lbrule1
action pass
source-zone trust
destination-zone untrust
source-ip-subnet 192.168.1.0 255.255.255.0
rule 2 name lblocalout
action pass
source-zone local
destination-zone untrust
destination-ip-subnet 10.1.1.0 255.255.255.0
destination-ip-subnet 20.1.1.0 255.255.255.0
#
nqa template icmp t1
reaction trigger per-probe
#
loadbalance proximity
rtt weight 200
match default probe t1
#
loadbalance link-group lg
proximity enable
transparent enable
#
loadbalance link link1
router ip 10.1.1.2
link-group lg
#
loadbalance link link2
router ip 20.1.1.2
link-group lg
#
virtual-server vs type link-ip
virtual ip address 0.0.0.0 0
default link-group lg
service enable
#