f5負(fù)載原理和技術(shù)

F5負(fù)載原理和技術(shù)

F5NetworksTraining劉召兵益泰售前工程iuzhaobing@

目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)ADN廣域網(wǎng)元素BIG-IPGTMFast-引導(dǎo)用戶到最快的站點(diǎn)Available-多站點(diǎn)負(fù)載均衡，冗余備份Secure-分布式結(jié)構(gòu)，降低攻擊風(fēng)險(xiǎn)GTMGTMGTMDial-upFast-出，入流量的智能鏈路選擇Fast-應(yīng)用級(jí)帶寬控制，提升性能Available-針對(duì)鏈路的健康檢查，確保鏈路高可用Secure-集成的安全過濾功能，提高系統(tǒng)安全性O(shè)racleVoIPSAPOracleVoIPSAPBroadbandRemoteBIG-IPLCServersADN廣域網(wǎng)元素BIG-IPLinkControllerISP1ISP2ISP3InternetADN端到端支持元素-WanJetFast-大幅度提高端到端數(shù)據(jù)傳輸速度，TDR壓縮，TCP優(yōu)化，QOSSecure-支持SSL通道加密，保證數(shù)據(jù)安全Available-故障或關(guān)電后全透明傳輸，提高系統(tǒng)可靠性ADN端到端支持元素SSL-VPNInternetLaptopMobileDevicePartner應(yīng)用訪問門戶訪問網(wǎng)絡(luò)訪問KioskSecuredbySSLIntranetSecure-標(biāo)準(zhǔn)SSL加密傳輸、支持多種認(rèn)證方式、從client開始的安全Fast-獨(dú)有的數(shù)據(jù)壓縮優(yōu)化技術(shù)提高傳輸速率Available-任何用戶、任何設(shè)備、任何地點(diǎn)ADN服務(wù)器端支持元素BIG-IPLTM手機(jī)個(gè)人數(shù)字助理筆記本臺(tái)式機(jī)托管主機(jī)AvailableFastSecureSiebel

BEA

Legacy

.NET

SAP

People-Soft

IBM

企業(yè)資

源規(guī)劃

SFA

（銷售

力量

自動(dòng)化）

定制應(yīng)用Fast-業(yè)界唯一的四層硬件ASIC加速芯片，RAMcache,compression,TCPexpress,OneConnectSecure-防DDOS攻擊，最強(qiáng)SSL加解密處理性能Available-服務(wù)器健康檢查，雙機(jī)冗余,全冗余的硬件配置ADN服務(wù)器端支持元素

ASM

合法流量惡意應(yīng)用行為應(yīng)用級(jí)Floods網(wǎng)絡(luò)攻擊和Floods不支持的ServicesTrafficShield?Intranet/ExtranetInternetWebServersApplicationServersDatabasesSecure-可防范未知蠕蟲攻擊Secure-嚴(yán)格訪問流程控制，杜絕黑客Fast-獨(dú)有硬件SSL加速功能Available-高可用性設(shè)計(jì)，可與BIGIP配合ADN整合解決方案數(shù)據(jù)中心

應(yīng)用MobileWorker(FirePassClient)BIG-IPLinkController/GTMFirewallBranchOfficeBIG-IPUntrustedPublicNetworkFirewallRouterWANJetSwitchTrafficShieldWebAcceleratorWANJetFirePassDMZ異地?cái)?shù)據(jù)中心BIG-IPGTM目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)Module1-InstallationInternetBIG-IPsClientsServersApplicationSwitchProcessorboardSwitchboardProcessorSSLcardBASCCPASIC2SwitchchipsDEFCF&HDC流量處理過程管理InterfaceNaming1.12.110/100/1000Portsnumbered:toptobottom,lefttoright1.8MiniGbgPortsstartat2.1mgmteth0ManagementPortiseth0usbconsolefailoverSetup/ConfigurationAccessTwomethodsWebInterface

https(remote)CommandLinessh(remote)SerialTerminalWebConfigurationutility目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)Module2–LoadBalancing12345678InternetPoolMembersandNodesInternet:8080:80:4002:80PoolMembersNodesrefertoPoolMembersIPAddressonlyPool-GroupingofMembersInternetClientsRouterBIG-IPControllerServersVirtualServerInternet:8080:4002:80VirtualServerBasicmechanismtomanagetrafficIPAddress+Service(Port)CombinationVirtualserversnormallyAssociatedwithoneormoremember7:80VirtualServertoPoolMembersInternet:8080:80:4002:80VirtualServer7:80PoolMembersMapstoVirtualServer-AddressTranslationBIG-IPperformsnetworkaddresstranslationtorealserveraddressessuchthatallmachinesareviewedasoneVirtualServerRealServerAddressNetworkAddressTranslationVirtualServerAddressInternet7:80:8080:80:4002:80NetworkFlow-Packet#1resolvestoBIG-IPVirtualServerAddress7:80

Internet:8080:80:4002:80DNSServer7:80NetworkFlow-Packet#1BIG-IPtranslatesDestAddresstoNodebasedonLoadBalancingInternetPacket#1Src-0:4003Dest–7:80:8080:80:4002:80Packet#1Src–0:4003Dest–:8007:80NetworkFlow–Packet#1ReturnBIG-IPtranslatesSrcAddressbacktoVirtualServerAddressInternetPacket#1-returnDest-0:4003Src–7:80:8080:80:4002:80Packet#1-returnDest–0:4003Src–:8007:80NetworkFlow-Packet#2InternetPacket#2Src-1:4003Dest–7:80:8080:80:4002:80Packet#2Src–1:4003Dest–:400217:80NetworkFlow–Packet#2ReturnInternetPacket#2-returnDest-1:4003Src–7:80:8080:80:4002:80Packet#2-returnDest–1:4003Src–:400217:80NetworkFlow-Packet#3InternetPacket#3Src-5:4003Dest–7:80:8080:80:4002:80Packet#3Src–5:4003Dest–:808057:80NetworkFlow–Packet#3ReturnInternetPacket#3-returnDest-5:4003Src–7:80:8080:80:4002:80Packet#3-returnDest–5:4003Src–:808057LoadBalancingModesRoundRobinRatioLeastConnectionsFastestObservedPredictiveDynamicRatioPriorityGroupActivationFallbackHostStaticDynamicFailureMechanismsRoundRobinClientsRouterBIG-IPControllerServersClientrequestsaredistributedevenly12345678InternetRatioClientsRouterBIG-IPControllerServersAdministratorsetsratiofordistributingClientrequests3:2:1:11234891011Internet571214613FastestClientsRouterBIG-IPControllerServersNextrequestsgotoNodewithfastestresponsetime25Internet10ms10ms10ms17msCurrentResponseTimes1436FastestClientsRouterBIG-IPControllerServersSometimelater,responsetimeschange102104Internet10ms10ms7ms7msCurrentResponseTimes101103LeastConnectionsClientsRouterBIG-IPControllerServers12InternetNextrequestsgoestoNodewithfewestopenconnections459460461470CurrentConnections3456LeastConnectionsClientsRouterBIG-IPControllerServersInternetSometimelater,numberofconnectionschange6163280290111112CurrentConnections62ObservedClientsRouterBIG-IPControllerServersNextrequestsgoestoNodewithcombinationoffewestconnectionsandbestresponse12InternetPredictiveClientsRouterBIG-IPControllerServers12InternetNextrequestsgoestoNodewithcombinationoffewestconnectionsandbestresponseovertimePriorityGroupActivationClientsRouterBIG-IPControllerServers135246InternetPriority1Priority10IfyousetPriorityGroupActivationto2,and3ofthehighestprioritymembersareavailable,thenlowerprioritymemberswillnotbeused.PriorityGroupActivationClientsRouterBIG-IPControllerServers15InternetPriority1Priority10324678IfnumberofmembersfallsbelowPriorityGroupActivation(2),thenthenexthighestprioritymembersareusedalso.可以看出這里是lessthan2FallbackHostClientsRouterBIG-IPControllerServersInternetIfallmembersfail,thenclientissentanhttpredirecttoandalternateserver.PoolMembervs.NodeLoadBalancingby:PoolMemberIPAddress&serviceNodeTotalservicesforoneIPAddressIfusingMemberInternetNexthttprequestsgoestoPoolMemberwithfewesthttpconnectionsCurrentConnectionshttp107108106ftp232512IfhttppoolusesLeastConnections(member)loadbalancingmethod,then…7:80:8020.2:8020.3:80IfusingNode12InternetNexthttprequestsgotoIPAddresswithfewesttotalconnectionsCurrentConnectionshttp107108106ftp2325IfhttppoolusesLeastConnections(Node)loadbalancingmethod,then…7:80:8020.2:8020.3:80目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)Module3–MonitorsInternet:80MonitorConceptsAddressCheckNode–IPAddressServiceCheckIP:portContentCheckIP:portpluscheckdatareturnedInteractiveCheckPathCheckAddressCheckStepsPacketssenttoIPAddressesIfnoresponse,thennotrafficsenttomembersusingthatnodeaddressExample-ICMPInternetICMPServiceCheckStepsOpensTCPconnection(IPAddress:service)ConnectionclosedIfTCPconnectionfails,thennotrafficsenttoassociatedMembersExample–TCPInternet:80:80:80TCPConnectionContentCheckInternet:80:80:80StepsOpensTCPconnection(IPAddress:service)SendsarequestResponsereturnsdataConnectionclosedIfReceiveRulenotfoundindata,thennotrafficsenttoassociatedMembersExample–httphttpGET/InteractiveCheckInternet:80:80:80StepsOpensTCPconnection(IPAddress:service)Interactiveconversationtosimulatereal-worldConnectionclosedIfexpectedresultsdonotoccur,thennotrafficsenttoassociatedMembersExample–SQLrequestconversationPathCheckStepsSendspacketthrough,nottothedeviceCancheckIPAddress,ServiceorContentIfconditionnotmet,thennotrafficsentthroughassociatedmemberLinkCntlISP2ISP1ISP1ConfiguringMonitorsSystemSuppliedMonitors(Templates)AddressChecks(icmp)ServiceChecks(tcp)ContentChecks(http)InteractiveChecks(ftp)Availability:AlltemplatescanbecustomizedSomecanbeAssigned“as-is”SomecanonlybeusedasTemplatesforCustomMonitors目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)Module4–ProfilesInternetVirtualServerProfilesdeterminehowVirtualServertrafficisprocessedonBIG-IPProfileConceptsAProfileis:SingleplacetodefinetrafficbehaviorSSL,compression,persistence…ApplybehaviortomultipleVS’sUserdefinedbuiltfromtemplateDependentonotherprofilesProfileScenario#1–Persistence123123Scenario#2–SSLTerminationDecryptedEncryptedProfileDependenciesSomecan’tbecombinedinVSSomedependentonothersThinkintermsofOSIModelTCPHTTPCookieUDPFTPNetworkDataLinkPhysicalVirtualServerDefaultProfilesAllVirtualServershaveatleastoneProfileTCP:forvirtualserversprocessingTCPdataUDP:forvirtualserversprocessingUDPdataFastL4:forvirtualserversthatuseacceleration(PVA)目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)Module5-Persistence123123Module5–OutlineSourceAddressPersistenceSourceAddressPersistLabCookiePersistenceInsert,Rewrite,Passive&HashCookiePersistLabSourceAddressPersistenceBasedonClientSourceIPAddressNetmask->AddressRange12312301IfNetmaskis07CookiePersistenceInsertmodeBIG-IPInsertsacookieintothestreamRewritemodeWebservercreatescookieandBIG-IPControllerchangesitPassivemodeWebservercreatescookieandBIG-IPControllerReadsitHashmodeMapsacookievaluetoaspecificnodeWebservermustgenerateacookieClientServerHTTPrequest(nospecialcookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecialcookie)HTTPreply(nospecialcookie)HTTPreply(withinsertedcookie)pick

serverHTTPrequest(withsamecookie)TCPhandshakeTCPhandshakeHTTPrequest(withsamecookie)HTTPreply(nospecialcookie)HTTPreply(updatedcookie)cookie

specifies

serverFirstHitSecondHitCookieInsertModeClientServerHTTPrequest(nospecialcookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecialcookie)HTTPreply(withblankcookie)HTTPreply(withrewrittencookie)pick

serverHTTPrequest(withsamecookie)TCPhandshakeTCPhandshakeHTTPrequest(withsamecookie)HTTPreply(withblankcookie)HTTPreply(withupdatedcookie)cookie

specifies

serverFirstHitSecondHitCookieRewriteModeClientServerHTTPrequest(nospecialcookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecialcookie)HTTPreply(withspecialcookie)HTTPreply(withspecialcookie)pick

serverHTTPrequest(withsamecookie)TCPhandshakeTCPhandshakeHTTPrequest(withsamecookie)HTTPreply(withspecialcookie)HTTPreply(withspecialcookie)cookie

specifies

serverFirstHitSecondHitCookiePassiveModeClientServerHTTPrequest(nospecialcookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecialcookie)HTTPreply(withcookie)HTTPreply(withcookie)pick

serverHTTPrequest(withsamecookie)TCPhandshakeTCPhandshakeHTTPrequest(withsamecookie)HTTPreply(withcookie)HTTPreply(withcookie)cookie

hashspecifies

serverFirstHitSecondHitThirdHitServerTCPhandshakeHTTPrequest(withsamecookie)HTTPreply(withcookie)cookie

hashspecifies

serverTCPhandshakeHTTPrequest(withsamecookie)HTTPreply(withcookie)CookieHashMode目錄F5產(chǎn)品類型硬件平臺(tái)和管理方式負(fù)載均衡原理健康檢查profile策略會(huì)話保持SSL加解密NAT和SNAT雙機(jī)Module6–SSLTerminationDecryptedEncryptedModule6–OutlineClientSSLServerSSLSSLTerminationDecryptedEncryptedTrafficFlowthroughBIG-IPClientsendsEncryptedpacketInternetBIG-IPtakespacketoffNetworkandDecryptsVSloadbalancestoNodesResponsepacketisRe-encryptedbeforeexternalNetworkClientSSLPlusServerSSLEncr