F5-BIG-IP-LTM-負(fù)載均衡器培訓(xùn)課件

地址:廣州市體育西路1-3號(hào)19樓

郵編:510620

電話:(020)85239088

傳真:(020)85239899

熱線:(020)85239199

網(wǎng)址:F5BIG-IPLTM負(fù)載均衡器培訓(xùn)地址:廣州市體育西路1-3號(hào)19樓

郵編:510620

電話內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)內(nèi)容BIG-IPLTM產(chǎn)品介紹F5BIG-IP產(chǎn)品分類BIG-IPLC鏈路接入優(yōu)化BIG-IPLTM應(yīng)用流量管理BIG-IPGTM廣域網(wǎng)流量?jī)?yōu)化F5BIG-IP產(chǎn)品分類BIG-IPLC鏈路接入優(yōu)化LTM—LocalTrafficManager局域網(wǎng)流量管理器Page46800640034001500SimplifiedManagement:LightsOutManagementMulti-BootSupportLCDforSimplifiedManagementHot-SwappablePartsRedundantPower/FansPortFlexibilityPCISlotsIndependentSecureManagementAccessPowerful:PacketVelocityASIC2HighPerformanceSSL&CompressionHighPerformanceSwitchingFabricDualProcessor*AllModelsInclude100TPSSSLAcceleration8400LTM—LocalTrafficManager局域網(wǎng)流F5

BIG-IP1500介紹2個(gè)千兆光纖端口，4個(gè)千兆電口內(nèi)置獨(dú)立管理機(jī)-生產(chǎn)系統(tǒng)與管理系統(tǒng)分離，進(jìn)一步提高系統(tǒng)可靠性768MB內(nèi)存，單CPUBIGIP1500LTM全面支持多應(yīng)用負(fù)載均衡：12種負(fù)載均衡算法可編程控制架構(gòu)：50多個(gè)事件，200多個(gè)函數(shù)處理內(nèi)置100TPSSSL加速功能，獨(dú)立NP處理SSL對(duì)稱算法和非對(duì)稱算法多種可擴(kuò)展模塊：SSL加速、帶寬控制、內(nèi)存Cache、HTTP壓縮F5BIG-IP1500介紹2個(gè)千兆光纖端口，4個(gè)千兆電BIG-IP3400介紹Page62個(gè)千兆光纖端口，8個(gè)千兆電口內(nèi)置獨(dú)立管理機(jī)-生產(chǎn)系統(tǒng)與管理系統(tǒng)分離，進(jìn)一步提高系統(tǒng)可靠性PacketVelocityASIC2提供高性能四-七層處理1GB內(nèi)存，超線程2.8GhzCPUBIGIP3400LTM全面支持多應(yīng)用負(fù)載均衡：12種負(fù)載均衡算法可編程控制架構(gòu)：50多個(gè)事件，200多個(gè)函數(shù)處理內(nèi)置100TPSSSL加速功能，獨(dú)立NP處理SSL對(duì)稱算法和非對(duì)稱算法多種可擴(kuò)展模塊：SSL加速、帶寬控制、內(nèi)存Cache、HTTP壓縮BIG-IP3400介紹2個(gè)千兆光纖端口，8個(gè)千兆電口BIG-IPLTM6400/68004個(gè)千兆光纖端口，16個(gè)千兆電口內(nèi)置獨(dú)立管理機(jī)-生產(chǎn)系統(tǒng)與管理系統(tǒng)分離，進(jìn)一步提高系統(tǒng)可靠性PacketVelocityASIC2提供高性能四-七層處理2GB內(nèi)存，雙64位高速CPUBIGIP6400LTM全面支持多應(yīng)用負(fù)載均衡：12種負(fù)載均衡算法可編程控制架構(gòu)：50多個(gè)事件，200多個(gè)函數(shù)處理內(nèi)置100TPSSSL加速功能，獨(dú)立NP處理SSL對(duì)稱算法和非對(duì)稱算法多種可擴(kuò)展模塊：SSL加速、帶寬控制、內(nèi)存Cache、HTTP壓縮、ApplicationSecurityBIG-IPLTM6400/68004個(gè)千兆光纖端口，1BIG-IP3400ApplicationSwitch內(nèi)部構(gòu)造ProcessorboardPage8SwitchboardProcessorSSLcardBASCCPASIC2SwitchchipsDEFCF&HDCBIG-IP3400ApplicationSwitchBIG-IP邏輯示意圖Page9BIG-IP邏輯示意圖PlatformSizingGuidePage10BIG-IP1500BIG-IP3400BIG-IP6400BIG-IP6800BIG-IP8400Layer4Connections/sec30,000

110,000220,000220,000>300,000Layer7Connections/sec22,000

50,00075,000110,000120,000Max.throughput500Mbps

1Gbps

2Gbps

4Gbps10GbpsMax.conc.conn.4Million

4Million8Million8Million8MillionMax.SSLTPS2,0005,00015,00020,00022,000Max.SSLBulk500Mbps

1Gbps2Gbps2Gbps2.2GbpsMax.SSLconc.conn.100,000

200,000500,000500,000500,000Mpression100Mbps500Mbps2Gbps2Gbps3GbpsSwitchbackplane14Gbps

22Gbps44Gbps48Gbps80GbpsPlatformSizingGuideBIG-IP15內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)Page11內(nèi)容BIG-IPLTM產(chǎn)品介紹應(yīng)用交換機(jī)的基本工作截獲和檢查流量,保證只有合適的數(shù)據(jù)包才能通過服務(wù)器監(jiān)控和健康檢查,隨時(shí)了解服務(wù)器群的可用性狀態(tài)負(fù)載均衡和應(yīng)用交換功能,通過各種策略導(dǎo)向到合適的服務(wù)器會(huì)話的保持以實(shí)現(xiàn)與應(yīng)用系統(tǒng)完美結(jié)合截取監(jiān)控保持負(fù)載均衡應(yīng)用交換機(jī)的基本工作截獲和檢查流量,保證只有合適的數(shù)據(jù)包才能BIG-IP-LTM的工作模式virtualserver

:80pool(name=cgi_boxes)member(server=:80)member(server=:80)member(server=:80)pool(name=asp_boxes)member(server=:80)member(server=:80)member(server=:80)virtualaddr

virtualserver

:443pool(name=ssl_boxes)member(server=:443)member(server=:443)member(server=:443)virtualaddr

負(fù)載均衡智能流量控制

（通過檢查URL，Header，Cookie，TCP/UDP內(nèi)容）基于端口的流量導(dǎo)向基于地址的流量導(dǎo)向用戶請(qǐng)求iRulesBIG-IP-LTM的工作模式virtualserver

單臺(tái)服務(wù)器到多臺(tái)服務(wù)器的轉(zhuǎn)變InternetBIG-IPLTMsClientsServersClientsInternet單臺(tái)服務(wù)器到多臺(tái)服務(wù)器的轉(zhuǎn)變InternetBIG-IPL什么叫服務(wù)器負(fù)載均衡Page1512345678ClientsClientsInternet什么叫服務(wù)器負(fù)載均衡12345678ClientsClienBIG-IP-LTM基本功能-服務(wù)器負(fù)載均衡123123

最多的負(fù)載均衡模式(12種)其中觀察模式,預(yù)測(cè)模式是F5的專利會(huì)話保持技術(shù)最多(8種)其中Cookie會(huì)話保持技術(shù)向所有的競(jìng)爭(zhēng)對(duì)手收取專利費(fèi)服務(wù)器健康檢查最徹底專有的EAV、ECV健康檢查模式性能最好,速度最快:270,000S/SLay4;110,000S/SLay7;10Gbps;會(huì)話保持?jǐn)?shù)量第一達(dá)到:800萬支持最多的VIP:4萬個(gè)唯一交換機(jī)廠商有開放的APIBIG-IP

applicationswitchcomboLinkController外部應(yīng)用驗(yàn)證EAV(ExtendedApplicationVerification)EAV是一種狀態(tài)檢查，可通過遠(yuǎn)程運(yùn)行應(yīng)用對(duì)節(jié)點(diǎn)上的應(yīng)用進(jìn)行驗(yàn)證。EAV狀態(tài)檢查只是LTM系統(tǒng)上可用的三種狀態(tài)檢查類型之一。請(qǐng)參閱“狀態(tài)檢查，狀態(tài)Monitor”和“外部Monitor”。擴(kuò)展內(nèi)容驗(yàn)證ECV(ExtendedContentVerification)ECV是一種狀態(tài)檢查，它使您能夠根據(jù)節(jié)點(diǎn)是否返回特定內(nèi)容來確定節(jié)點(diǎn)是Up還是Down。ECV狀態(tài)檢查只是LTM系統(tǒng)上可用的三種狀態(tài)檢查類型之一。請(qǐng)參閱“狀態(tài)檢查”。BIG-IP-LTM基本功能-服務(wù)器負(fù)載均衡123123 最I(lǐng)nternetVirtualServer&NAT

虛擬服務(wù)器與網(wǎng)絡(luò)地址轉(zhuǎn)換Page17真實(shí)服務(wù)器RealServer網(wǎng)絡(luò)地址轉(zhuǎn)換VirtualServerAddress7:80RealServerAddress7:80Internet虛擬服務(wù)器:8080:8080:8080:8080InternetVirtualServer&NAT

虛擬NetworkFlow-Packet#1Page18Internet域名IP地址7VirtualServerAddress7:80:8080:8080:808:8080NetworkFlow-Packet#1InternNetworkFlow-Packet#1Page19LTMtranslatesDestAddresstoNodebasedonLoadBalancingInternetPacket#1Src-0:4003Dest–7:80Packet#1Src–0:4003Dest–:808007:80:8080:8080:8080:8080NetworkFlow-Packet#1LTMtrNetworkFlow–Packet#1ReturnPage20LTMtranslatesSrcAddressbacktoVirtualServerAddressInternetPacket#1-returnDest-0:4003Src–7:80Packet#1-returnDest–0:4003Src–:808007:80:8080:8080:8080:8080NetworkFlow–Packet#1ReturNetworkFlow-Packet#2Page21InternetPacket#2Src-1:4003Dest–7:80Packet#2Src–1:4003Dest–:808017:80:8080:8080:8080:8080NetworkFlow-Packet#2InternNetworkFlow–Packet#2ReturnPage22InternetPacket#2-returnDest-1:4003Src–7:80:8080Packet#2-returnDest–1:4003Src–:808017:80:8080:8080:8080NetworkFlow–Packet#2ReturNetworkFlow-Packet#3Page23InternetPacket#3Src-5:4003Dest–7:80Packet#3Src–5:4003Dest–:808057:80:8080:8080:8080:8080NetworkFlow-Packet#3InternNetworkFlow–Packet#3ReturnPage24InternetPacket#3-returnDest-5:4003Src–7:80:8080Packet#3-returnDest–5:4003Src–:808057:8080:8080:8080NetworkFlow–Packet#3ReturConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressVirtualServer0:40037:801:40037:80……0:40057:801:40087:805:40037:80Page25客戶端負(fù)載均衡器ConnectionTable連接表SrcIPAddConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressRealServer0:4003:80801:4003:8080……0:4005:80801:4008:80805:4003:8080Page26服務(wù)器端負(fù)載均衡器ConnectionTable連接表SrcIPAddF5負(fù)載均衡的基本構(gòu)件

Pool、PoolMembers與NodesPage27Internet:8080:80:4002:80PoolMembersNodesrefertoPoolMembersIPAddressonlyF5負(fù)載均衡的基本構(gòu)件

Pool、PoolMembersPools,MembersandNodesPage28Node=IPaddress:80:80:80PoolMember

=Node+PortPool

=GroupofpoolmembersPools,MembersandNodes172.16PoolMembers的端口與地址問題Page29注意：1、PoolMember的端口可以不一樣2、PoolMember不一定需要與BIG-IP相連或在同一網(wǎng)段InternetVirtualServer7:80PoolMembers/24/24路由器:8080:80:4002:80PoolMembers的端口與地址問題注意：Interne虛擬服務(wù)器VirtualServerPage30Internet:8080:4002:80VirtualServerIPAddress+Service(Port)Combination端口可以為Any(0)準(zhǔn)備了負(fù)載均衡器是否需要對(duì)流過的網(wǎng)絡(luò)流量作處理一般與Pool相關(guān)聯(lián)7:80虛擬服務(wù)器VirtualServerInternet172如何選擇服務(wù)器--負(fù)載均衡算法RoundRobinRatioLeastConnectionsFastestObservedPredictiveDynamicRatioPriorityGroupActivationFallbackHostPage31StaticDynamicFailureMechanisms主要使用輪詢、最少連接如何選擇服務(wù)器--負(fù)載均衡算法RoundRobinStatBIG-IPLTM負(fù)載均衡模式輪詢（RoundRobin）：順序循環(huán)將請(qǐng)求一次順序循環(huán)地連接每個(gè)服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從順序循環(huán)隊(duì)列中拿出，不參加下一次的輪詢，直到其恢復(fù)正常。比率（Ratio）：給每個(gè)服務(wù)器分配一個(gè)加權(quán)值為比例，根椐這個(gè)比例，把用戶的請(qǐng)求分配到每 個(gè)服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，直到其恢復(fù)正常。優(yōu)先權(quán)（Priority）：給所有服務(wù)器分組，給每個(gè)組定義優(yōu)先權(quán)，BIG/IP用戶的請(qǐng)求，分配給優(yōu)先級(jí)最高的服務(wù)器組（在同一組內(nèi)，采用輪詢或比率算法，分配用戶的請(qǐng)求）；當(dāng)最高優(yōu)先級(jí)中所有服務(wù)器出現(xiàn)故障，BIG/IP才將請(qǐng)求送給次優(yōu)先級(jí)的服務(wù)器組。這種方式，實(shí)際為用戶提供一種熱備份的方式。最小的連接數(shù)（LeastConnection）：傳遞新的連接給那些進(jìn)行最少連接處理的服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，直到其恢復(fù)正常。最快模式（Fastest）：傳遞連接給那些響應(yīng)最快的服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，直到其恢復(fù)正常。觀察模式（Observed）：連接數(shù)目和響應(yīng)時(shí)間以這兩項(xiàng)的最佳平衡為依據(jù)為新的請(qǐng)求選擇服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，直到其恢復(fù)正常。預(yù)測(cè)模式（Predictive）：BIG/IP利用收集到的服務(wù)器當(dāng)前的性能指標(biāo)，進(jìn)行預(yù)測(cè)分析，選擇一臺(tái)服務(wù)器在下一個(gè)時(shí)間片內(nèi)，其性能將達(dá)到最佳的服務(wù)器相應(yīng)用戶的請(qǐng)求。(被big/ip進(jìn)行檢測(cè))規(guī)則模式（iRule）：針對(duì)不同的數(shù)據(jù)流設(shè)置導(dǎo)向規(guī)則，用戶可自行編輯流量分配規(guī)則，BIG/IP利用這些規(guī)則對(duì)通過的數(shù)據(jù)流實(shí)施導(dǎo)向控制。BIG-IPLTM負(fù)載均衡模式輪詢（RoundRobin）如何識(shí)別不可用的服務(wù)器—

服務(wù)器健康檢查HealthMonitorsPage33Internet:80如何識(shí)別不可用的服務(wù)器—

服務(wù)器健康檢查HealthMo服務(wù)健康檢查MonitorConcepts網(wǎng)絡(luò)連通性檢查AddressCheckNode–IPAddress端口ServiceCheckIP:port內(nèi)容檢查ContentCheckIP:portpluscheckdatareturnedPage34服務(wù)健康檢查MonitorConcepts網(wǎng)絡(luò)連通性檢查A網(wǎng)絡(luò)連通性檢查

AddressCheckPage35InternetICMP網(wǎng)絡(luò)連通性檢查

AddressCheckInternet1端口ServiceCheckPage36InternetTCPConnection:80:80:80端口ServiceCheckInternetTCPCon內(nèi)容檢查ContentCheckPage37Internet:80:80httpGET/:80內(nèi)容檢查ContentCheckInternet172.1會(huì)話保持PersistencePage38123123會(huì)話保持Persistence123123ConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressRealServer0:4003:80801:4003:8080……0:4005:80801:4008:80805:4003:8080Page39服務(wù)器端負(fù)載均衡器ConnectionTable連接表SrcIPAddSourceAddressPersistenceTableSrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:8080???1:40087:80:8080???5:40037:80:8080SrcIPAddressRealServer01……5Page40PersistenceTable負(fù)載均衡器SourceAddressPersistenceTabSourceAddressPersistenceBasedonClientSourceIPAddressNetmask->AddressRangePage4112312301IfNetmaskis07SourceAddressPersistenceBaseCookiePersistenceInsertmodeBIG-IPLTMInsertsacookieintothestreamRewritemodeWebservercreatescookieandBIG-IPLTMchangesitPassivemodeWebservercreatescookieandBIG-IPLTMreadsitPage42CookiePersistenceInsertmodeCookieInsertModePage43ClientServerHTTPrequest(nospecialcookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecialcookie)HTTPreply(nospecialcookie)HTTPreply(withinsertedcookie)pick

serverHTTPrequest(withsamecookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecial

cookie)HTTPreply(nospecialcookie)HTTPreply(updatedcookie)cookie

specifies

serverFirstHitSecondHitCookieInsertModeClientServer源地址轉(zhuǎn)換SNATs多對(duì)一的轉(zhuǎn)換Many-to-onemappingTraffictoSNATAddressisrefusedCanshareIPwithVirtualServerPage44

Internet02源地址轉(zhuǎn)換SNATs多對(duì)一的轉(zhuǎn)換Many-to-onemSNATs–TypicalTrafficFlowPage45

Internet02:400103:8002:3300103:80SourceaddresstranslatedtoSNATaddressNotesourceportServer03:80SNATs–TypicalTrafficFlowSNATs–ResponseTrafficFlowPage46

InternetSNATIPAddress0203:80:400103:80

02:33001ResponsepackettranslatedbackServer03:80SNATs–ResponseTrafficFlowSNATTableSrcIPAddressSNATAddressDestinationIP:400102:3300103:80:400102:3300203:80………:400302:3300503:80:400302:3300603:80:400102:3300703:80SrcIPAddressRealServer02:3300103:8002:3300203:80……02:3300503:8002:3300603:8002:3300703:80Page47服務(wù)器端負(fù)載均衡器SNATTableSrcIPAddressSNATASourceAddressPersistenceTableSrcIPAddressSNATAddressDestinationIP:400102:3300103:80:400102:3300203:80………:400302:3300503:80:400302:3300603:80:400102:3300703:80SrcIPAddressDstIPAddress03:8002:3300103:8002:33002……03:8002:3300503:8002:3300603:8002:33007Page48服務(wù)器的回應(yīng)負(fù)載均衡器SourceAddressPersistenceTab內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置

配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)Page49內(nèi)容BIG-IPLTM產(chǎn)品介紹InstallationPage50InternetBIG-IPLTMsClientsServersInstallationInternetBIG-IPLTMInitialBIG-IPLTMSetup設(shè)定管理網(wǎng)口地址通過LCD設(shè)置通過Console線設(shè)置Configutility從網(wǎng)絡(luò)通過缺省地址上去再修改Configutility激活LicenseSetuputilityRootpasswordWebAdminpasswordSSHAccessAssigninterfacestoVLANsIPAddressforVLANsPage51InitialBIG-IPLTMSetup設(shè)定管理網(wǎng)口BIG-IP接口說明(以3400為例)Page521.12.110/100/1000M電口1.1~1.8端口編號(hào):從上到下，從左到右1.8千兆光纖接口2.12.2mgmteth0管理網(wǎng)口eth0，主機(jī)接口usbconsolefailoverBIG-IP接口說明(以3400為例)1.12.110/1ConfigUtilityPage53InitialIPAddressis45ConfigUtilityInitialIPAddreSetup/ConfigurationAccessTwomethodsWebInterface

https(remote)CommandLinessh(remote)SerialTerminalPage54Setup/ConfigurationAccessTwLicenseProcess–ManualPage55PCBIG-IPF5LicenseServeractivate.F5.comInternetCopyProductDossiertoPCPasteProductDossiertoF5MovePCtoInternetDownloadLicensetoPCUpload&InstallLicensefileRunSetuputility手動(dòng)激活方式PChttps://activate.F5.comMovePCbackReboot(v9.2)LicenseProcess–ManualPCBIGLicenseProcess–AutomatedPage56InternetRunSetuputility

EnterRegistrationKeyPCBIG-IPLicensethebox

GetLicensefromF5

SelectparametersF5LicenseServeractivate.F5.comReboot(v9.2)LicenseProcess–AutomatedInWEB管理界面：SetupUtilityPage57https://ManagementIPAddressWEB管理界面：SetupUtilityhttps://MSetupUtility–NetworkPage58SetupUtility–NetworkExternalVLAN與InternalVLANPage59真實(shí)服務(wù)器RealServerVirtualServerAddress7:80Internet:8080:8080:8080:8080RealServerAddress7:80Internet虛擬服務(wù)器ExternalVLANSelfIPInternalVLANSelfIP54ExternalVLAN與InternalVLAN真實(shí)服創(chuàng)建VLANPage60NetworkVLANSCreate創(chuàng)建VLANNetworkVLANSCreate為VLAN設(shè)置SelfIP地址Page61為VLAN設(shè)置SelfIP地址PortLockdownDefaultsare:UDP–DNS,SNMP&RIPTCP–SSH,DNS,SNMP,HTTPS&iQueryPage62PortLockdownDefaultsare:設(shè)置路由與網(wǎng)關(guān)Page63設(shè)置路由與網(wǎng)關(guān)限制SSH訪問Page64

Internet250DenyAllow216.34.94.*限制SSH訪問Internet2F5WEB配置界面Page65系統(tǒng)通用屬性設(shè)置網(wǎng)絡(luò)設(shè)置:VLAN/IP/路由負(fù)載均衡相關(guān)設(shè)置性能與統(tǒng)計(jì)F5WEB配置界面系統(tǒng)通用屬性設(shè)置網(wǎng)絡(luò)設(shè)置:VLAN/I用戶配置Page66用戶配置備份/恢復(fù)BIG-IPLTM配置Page67SystemArchives，點(diǎn)擊Create:如果在另外一臺(tái)BIG-IP上恢復(fù)備份的配置，需要重新激活License備份/恢復(fù)BIG-IPLTM配置SystemArchiSSH登陸方式SecureShellClientTeraTermwithSecureShellextension(TTSSH)PuTTYPage68SSH登陸方式SecureShellClient重置BIG-IP的設(shè)置bdballresetbreset

bsave

bbasereset

bselfallow{defaulttcpsshtcphttpsudpefstcpsnmpprotoospfudpdomainudpsnmptcp4353tcpdomainudp4353}bbasesave最后運(yùn)行config設(shè)置管理口IP，然后用reboot重啟。Page69在命令行執(zhí)行以下命令：重置BIG-IP的設(shè)置bdballreset在命令行執(zhí)內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡

雙機(jī)配置BIG-IP命令行典型組網(wǎng)Page70內(nèi)容BIG-IPLTM產(chǎn)品介紹配置服務(wù)器負(fù)載均衡的步驟創(chuàng)建HealthMonitor創(chuàng)建Pool并為PoolMember關(guān)聯(lián)相應(yīng)的Monitor創(chuàng)建Profile創(chuàng)建PersistenceProfile創(chuàng)建VirtualServer并為VirtualServer選擇相應(yīng)的Profile與PoolPage71配置服務(wù)器負(fù)載均衡的步驟創(chuàng)建HealthMonitor配置Monitors系統(tǒng)內(nèi)置的Monitor(Templates)AddressChecks(icmp)ServiceChecks(tcp)ContentChecks(http)InteractiveChecks(ftp)Availability:AlltemplatescanbecustomizedSomecanbeAssigned“as-is”SomecanonlybeusedasTemplatesforCustomMonitorsPage72配置Monitors系統(tǒng)內(nèi)置的Monitor(Templa定制MonitorsPage73定制Monitors配置檢測(cè)時(shí)間間隔時(shí)間超時(shí)時(shí)間Page74推薦配置–3n+1配置檢測(cè)時(shí)間間隔時(shí)間推薦配置–3n+1配置健康檢測(cè)參數(shù)配置健康檢測(cè)參數(shù)配置Nodes的健康檢測(cè)HealthMonitorsPage76配置Nodes的健康檢測(cè)HealthMonitors配置PoolsPage77配置PoolsAssigningMonitorstoPoolsPage78ForoneMemberAssigningMonitorstoPoolsForMemberandNodeStatusPage79Parent-ChildStatus節(jié)點(diǎn)Node節(jié)點(diǎn)成員Member池Pool虛擬服務(wù)器VirtualServer狀況綠色－可用

紅色－不可用

藍(lán)色－未知

MemberandNodeStatusParent-C配置負(fù)載算法Page80配置負(fù)載算法Profiles屬性集Page81InternetVirtualServerVirtualServer是BIG-IP上地址加端口的組合，決定是BIG-IP是否需要對(duì)到達(dá)其上的網(wǎng)絡(luò)流量進(jìn)行處理。而應(yīng)該如何來處理，是根據(jù)VirtualServer上所關(guān)聯(lián)的Profile來決定的。Profiles屬性集InternetVirtualSeProfile使用AProfileis:定義了流量處理的處理方式TCP，HTTP,FTP,SSL,compression,persistence…并將處理方式適用到關(guān)聯(lián)的VirtualServer上可以從Profile模板的基礎(chǔ)上加以創(chuàng)建具有依賴與繼承性：依賴于其它相關(guān)的ProfilePage82Profile使用AProfileis:Profile的類型Page83Profile的類型常用的ProfileTCPFASTL4HTTPFTPSSL常用的ProfileTCPConfiguringCookiePersistenceThensetCookiePersistprofileCookiePersistrequireshttpprofileConfiguringCookiePersistence配置虛擬服務(wù)器Scrolldown配置虛擬服務(wù)器Scrolldown配置虛擬服務(wù)器－參數(shù)Page87配置虛擬服務(wù)器－參數(shù)SNAT配置

Internet02SNAT配置Internet0217SNATTimeoutPage89SNATTimeoutStatistics和StatisticsTypeSummaryVirtualServersPoolsNodesPage90Statistics和StatisticsTypeSum內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)內(nèi)容BIG-IPLTM產(chǎn)品介紹RedundantPairRedundantPairConceptsSetupofaRedundantPairSynchronizationPage92InternetClientsServersBIG-IPLTMsRedundantPairRedundantPairC雙機(jī)配置Page93ExternalIP10.10.X.32InternetExternalIP10.10.X.31FloatingIP10.10.X.33Failover172.16.X.32Failover172.16.X.31InternalIP172.16.X.32InternalIP172.16.X.31FloatingIP172.16.X.3321浮動(dòng)地址設(shè)備ID故障切換雙機(jī)配置ExternalIP10.10.X.32Inte雙機(jī)配置參數(shù)雙機(jī)配置參數(shù)配置同步設(shè)置Page95SyncOtherConfigCurrentConfig配置同步設(shè)置SyncOtherCurrent主備設(shè)置主備設(shè)置手動(dòng)切換主備狀態(tài)FromActiveLTM-notStandbyPage97CommandLine:bfailoverstandbyScrolldown手動(dòng)切換主備狀態(tài)FromActiveLTM-not內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)Page98內(nèi)容BIG-IPLTM產(chǎn)品介紹CommandLine-bigpipePage99bigpipevirtualVS_httpdestination10.10.X.100:httpprofilehttptcppersistsrc_persistpoolhttp_poolCommandLine-bigpipebigpipebigtopCommandsqbigtop–delay#bigtop–nbigtop–oncebigtop–once|morePage100bigtopCommandsqbigtopCommandsPage101bigtopCommandsbigstartCommandsActionsStop,Start,RestartStartonBoot,IncludeinDefaultProcessesbigd–Monitorsalertd-NotificationPage102bigstartCommandsActionsOtherCommandsifconfignetstatpstailBooksand“man”pagesPage103OtherCommandsifconfig內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)Page104內(nèi)容BIG-IPLTM產(chǎn)品介紹BIG-IP雙機(jī)接線方式四—BIG-IP旁掛方式Page105推薦使用BIGIP3400負(fù)載均衡器Server3Server4Server2Server1中心交換InternetBIGIP3400負(fù)載均衡器在同一個(gè)交換機(jī)上劃分多個(gè)VLAN的做法，雙機(jī)自動(dòng)切換機(jī)制采用VLAN監(jiān)控方式ExternalVlanExternalVlanInternalVlanInternalVlan優(yōu)點(diǎn)：易于管理維護(hù)，擴(kuò)展性高（不依賴于負(fù)載均衡器端口數(shù)目）缺點(diǎn)：需要?jiǎng)澐植煌腣LAN，適合于新上線系統(tǒng)BIG-IP雙機(jī)接線方式四—BIG-IP旁掛方式推薦使用BIBIG-IP旁掛方式的一些變化Page106TrunkClient1Client2Server1Server2BIGIP3400BIGIP3400ExternalVlanExternalVlanSwitchInternalVlanInternalVlan通過LinkAggregation（PortChannel)提高鏈路可靠性F5LinkAggregation與華為交換機(jī)兼容用于提高帶寬和鏈路可靠性BIG-IP旁掛方式的一些變化TrunkClient1ClBIG-IP旁掛方式的一些變化Page107TrunkVLAN:VLAN10,11,12交換機(jī)Vlan101Vlan102Vlan103PortChannel:Port2.1,2.2,光纖接口Trunkvlan:Vlan10,11,12,101~103PortChannel:Port2.1,2.2,光纖接口Trunkvlan:Vlan10,11,12,101~103BIGIP3400BIGIP3400Vlan10Vlan10LinkAggregation（PortChannel)+TaggedVLANF5TaggedVLAN與華為交換機(jī)IEEE802.1qTrunk兼容用于多業(yè)務(wù)公用F5且F5端口數(shù)目有限BIG-IP旁掛方式的一些變化TrunkVLAN:交換機(jī)V地址:廣州市體育西路1-3號(hào)19樓

郵編:510620

電話:(020)85239088

傳真:(020)85239899

熱線:(020)85239199

網(wǎng)址:F5BIG-IPLTM負(fù)載均衡器培訓(xùn)地址:廣州市體育西路1-3號(hào)19樓

郵編:510620

電話內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)內(nèi)容BIG-IPLTM產(chǎn)品介紹F5BIG-IP產(chǎn)品分類BIG-IPLC鏈路接入優(yōu)化BIG-IPLTM應(yīng)用流量管理BIG-IPGTM廣域網(wǎng)流量?jī)?yōu)化F5BIG-IP產(chǎn)品分類BIG-IPLC鏈路接入優(yōu)化LTM—LocalTrafficManager局域網(wǎng)流量管理器Page1116800640034001500SimplifiedManagement:LightsOutManagementMulti-BootSupportLCDforSimplifiedManagementHot-SwappablePartsRedundantPower/FansPortFlexibilityPCISlotsIndependentSecureManagementAccessPowerful:PacketVelocityASIC2HighPerformanceSSL&CompressionHighPerformanceSwitchingFabricDualProcessor*AllModelsInclude100TPSSSLAcceleration8400LTM—LocalTrafficManager局域網(wǎng)流F5

BIG-IP1500介紹2個(gè)千兆光纖端口，4個(gè)千兆電口內(nèi)置獨(dú)立管理機(jī)-生產(chǎn)系統(tǒng)與管理系統(tǒng)分離，進(jìn)一步提高系統(tǒng)可靠性768MB內(nèi)存，單CPUBIGIP1500LTM全面支持多應(yīng)用負(fù)載均衡：12種負(fù)載均衡算法可編程控制架構(gòu)：50多個(gè)事件，200多個(gè)函數(shù)處理內(nèi)置100TPSSSL加速功能，獨(dú)立NP處理SSL對(duì)稱算法和非對(duì)稱算法多種可擴(kuò)展模塊：SSL加速、帶寬控制、內(nèi)存Cache、HTTP壓縮F5BIG-IP1500介紹2個(gè)千兆光纖端口，4個(gè)千兆電BIG-IP3400介紹Page1132個(gè)千兆光纖端口，8個(gè)千兆電口內(nèi)置獨(dú)立管理機(jī)-生產(chǎn)系統(tǒng)與管理系統(tǒng)分離，進(jìn)一步提高系統(tǒng)可靠性PacketVelocityASIC2提供高性能四-七層處理1GB內(nèi)存，超線程2.8GhzCPUBIGIP3400LTM全面支持多應(yīng)用負(fù)載均衡：12種負(fù)載均衡算法可編程控制架構(gòu)：50多個(gè)事件，200多個(gè)函數(shù)處理內(nèi)置100TPSSSL加速功能，獨(dú)立NP處理SSL對(duì)稱算法和非對(duì)稱算法多種可擴(kuò)展模塊：SSL加速、帶寬控制、內(nèi)存Cache、HTTP壓縮BIG-IP3400介紹2個(gè)千兆光纖端口，8個(gè)千兆電口BIG-IPLTM6400/68004個(gè)千兆光纖端口，16個(gè)千兆電口內(nèi)置獨(dú)立管理機(jī)-生產(chǎn)系統(tǒng)與管理系統(tǒng)分離，進(jìn)一步提高系統(tǒng)可靠性PacketVelocityASIC2提供高性能四-七層處理2GB內(nèi)存，雙64位高速CPUBIGIP6400LTM全面支持多應(yīng)用負(fù)載均衡：12種負(fù)載均衡算法可編程控制架構(gòu)：50多個(gè)事件，200多個(gè)函數(shù)處理內(nèi)置100TPSSSL加速功能，獨(dú)立NP處理SSL對(duì)稱算法和非對(duì)稱算法多種可擴(kuò)展模塊：SSL加速、帶寬控制、內(nèi)存Cache、HTTP壓縮、ApplicationSecurityBIG-IPLTM6400/68004個(gè)千兆光纖端口，1BIG-IP3400ApplicationSwitch內(nèi)部構(gòu)造ProcessorboardPage115SwitchboardProcessorSSLcardBASCCPASIC2SwitchchipsDEFCF&HDCBIG-IP3400ApplicationSwitchBIG-IP邏輯示意圖Page116BIG-IP邏輯示意圖PlatformSizingGuidePage117BIG-IP1500BIG-IP3400BIG-IP6400BIG-IP6800BIG-IP8400Layer4Connections/sec30,000

110,000220,000220,000>300,000Layer7Connections/sec22,000

50,00075,000110,000120,000Max.throughput500Mbps

1Gbps

2Gbps

4Gbps10GbpsMax.conc.conn.4Million

4Million8Million8Million8MillionMax.SSLTPS2,0005,00015,00020,00022,000Max.SSLBulk500Mbps

1Gbps2Gbps2Gbps2.2GbpsMax.SSLconc.conn.100,000

200,000500,000500,000500,000Mpression100Mbps500Mbps2Gbps2Gbps3GbpsSwitchbackplane14Gbps

22Gbps44Gbps48Gbps80GbpsPlatformSizingGuideBIG-IP15內(nèi)容BIG-IPLTM產(chǎn)品介紹負(fù)載均衡基本原理BIG-IP初始化安裝與VLAN設(shè)置配置BIG-IP實(shí)現(xiàn)服務(wù)器負(fù)載均衡雙機(jī)配置BIG-IP命令行典型組網(wǎng)Page118內(nèi)容BIG-IPLTM產(chǎn)品介紹應(yīng)用交換機(jī)的基本工作截獲和檢查流量,保證只有合適的數(shù)據(jù)包才能通過服務(wù)器監(jiān)控和健康檢查,隨時(shí)了解服務(wù)器群的可用性狀態(tài)負(fù)載均衡和應(yīng)用交換功能,通過各種策略導(dǎo)向到合適的服務(wù)器會(huì)話的保持以實(shí)現(xiàn)與應(yīng)用系統(tǒng)完美結(jié)合截取監(jiān)控保持負(fù)載均衡應(yīng)用交換機(jī)的基本工作截獲和檢查流量,保證只有合適的數(shù)據(jù)包才能BIG-IP-LTM的工作模式virtualserver

:80pool(name=cgi_boxes)member(server=:80)member(server=:80)member(server=:80)pool(name=asp_boxes)member(server=:80)member(server=:80)member(server=:80)virtualaddr

virtualserver

:443pool(name=ssl_boxes)member(server=:443)member(server=:443)member(server=:443)virtualaddr

負(fù)載均衡智能流量控制

（通過檢查URL，Header，Cookie，TCP/UDP內(nèi)容）基于端口的流量導(dǎo)向基于地址的流量導(dǎo)向用戶請(qǐng)求iRulesBIG-IP-LTM的工作模式virtualserver

單臺(tái)服務(wù)器到多臺(tái)服務(wù)器的轉(zhuǎn)變InternetBIG-IPLTMsClientsServersClientsInternet單臺(tái)服務(wù)器到多臺(tái)服務(wù)器的轉(zhuǎn)變InternetBIG-IPL什么叫服務(wù)器負(fù)載均衡Page12212345678ClientsClientsInternet什么叫服務(wù)器負(fù)載均衡12345678ClientsClienBIG-IP-LTM基本功能-服務(wù)器負(fù)載均衡123123

最多的負(fù)載均衡模式(12種)其中觀察模式,預(yù)測(cè)模式是F5的專利會(huì)話保持技術(shù)最多(8種)其中Cookie會(huì)話保持技術(shù)向所有的競(jìng)爭(zhēng)對(duì)手收取專利費(fèi)服務(wù)器健康檢查最徹底專有的EAV、ECV健康檢查模式性能最好,速度最快:270,000S/SLay4;110,000S/SLay7;10Gbps;會(huì)話保持?jǐn)?shù)量第一達(dá)到:800萬支持最多的VIP:4萬個(gè)唯一交換機(jī)廠商有開放的APIBIG-IP

applicationswitchcomboLinkController外部應(yīng)用驗(yàn)證EAV(ExtendedApplicationVerification)EAV是一種狀態(tài)檢查，可通過遠(yuǎn)程運(yùn)行應(yīng)用對(duì)節(jié)點(diǎn)上的應(yīng)用進(jìn)行驗(yàn)證。EAV狀態(tài)檢查只是LTM系統(tǒng)上可用的三種狀態(tài)檢查類型之一。請(qǐng)參閱“狀態(tài)檢查，狀態(tài)Monitor”和“外部Monitor”。擴(kuò)展內(nèi)容驗(yàn)證ECV(ExtendedContentVerification)ECV是一種狀態(tài)檢查，它使您能夠根據(jù)節(jié)點(diǎn)是否返回特定內(nèi)容來確定節(jié)點(diǎn)是Up還是Down。ECV狀態(tài)檢查只是LTM系統(tǒng)上可用的三種狀態(tài)檢查類型之一。請(qǐng)參閱“狀態(tài)檢查”。BIG-IP-LTM基本功能-服務(wù)器負(fù)載均衡123123 最I(lǐng)nternetVirtualServer&NAT

虛擬服務(wù)器與網(wǎng)絡(luò)地址轉(zhuǎn)換Page124真實(shí)服務(wù)器RealServer網(wǎng)絡(luò)地址轉(zhuǎn)換VirtualServerAddress7:80RealServerAddress7:80Internet虛擬服務(wù)器:8080:8080:8080:8080InternetVirtualServer&NAT

虛擬NetworkFlow-Packet#1Page125Internet域名IP地址7VirtualServerAddress7:80:8080:8080:808:8080NetworkFlow-Packet#1InternNetworkFlow-Packet#1Page126LTMtranslatesDestAddresstoNodebasedonLoadBalancingInternetPacket#1Src-0:4003Dest–7:80Packet#1Src–0:4003Dest–:808007:80:8080:8080:8080:8080NetworkFlow-Packet#1LTMtrNetworkFlow–Packet#1ReturnPage127LTMtranslatesSrcAddressbacktoVirtualServerAddressInternetPacket#1-returnDest-0:4003Src–7:80Packet#1-returnDest–0:4003Src–:808007:80:8080:8080:8080:8080NetworkFlow–Packet#1ReturNetworkFlow-Packet#2Page128InternetPacket#2Src-1:4003Dest–7:80Packet#2Src–1:4003Dest–:808017:80:8080:8080:8080:8080NetworkFlow-Packet#2InternNetworkFlow–Packet#2ReturnPage129InternetPacket#2-returnDest-1:4003Src–7:80:8080Packet#2-returnDest–1:4003Src–:808017:80:8080:8080:8080NetworkFlow–Packet#2ReturNetworkFlow-Packet#3Page130InternetPacket#3Src-5:4003Dest–7:80Packet#3Src–5:4003Dest–:808057:80:8080:8080:8080:8080NetworkFlow-Packet#3InternNetworkFlow–Packet#3ReturnPage131InternetPacket#3-returnDest-5:4003Src–7:80:8080Packet#3-returnDest–5:4003Src–:808057:8080:8080:8080NetworkFlow–Packet#3ReturConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressVirtualServer0:40037:801:40037:80……0:40057:801:40087:805:40037:80Page132客戶端負(fù)載均衡器ConnectionTable連接表SrcIPAddConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressRealServer0:4003:80801:4003:8080……0:4005:80801:4008:80805:4003:8080Page133服務(wù)器端負(fù)載均衡器ConnectionTable連接表SrcIPAddF5負(fù)載均衡的基本構(gòu)件

Pool、PoolMembers與NodesPage134Internet:8080:80:4002:80PoolMembersNodesrefertoPoolMembersIPAddressonlyF5負(fù)載均衡的基本構(gòu)件

Pool、PoolMembersPools,MembersandNodesPage135Node=IPaddress:80:80:80PoolMember

=Node+PortPool

=GroupofpoolmembersPools,MembersandNodes172.16PoolMembers的端口與地址問題Page136注意：1、PoolMember的端口可以不一樣2、PoolMember不一定需要與BIG-IP相連或在同一網(wǎng)段InternetVirtualServer7:80PoolMembers/24/24路由器:8080:80:4002:80PoolMembers的端口與地址問題注意：Interne虛擬服務(wù)器VirtualServerPage137Internet:8080:4002:80VirtualServerIPAddress+Service(Port)Combination端口可以為Any(0)準(zhǔn)備了負(fù)載均衡器是否需要對(duì)流過的網(wǎng)絡(luò)流量作處理一般與Pool相關(guān)聯(lián)7:80虛擬服務(wù)器VirtualServerInternet172如何選擇服務(wù)器--負(fù)載均衡算法RoundRobinRatioLeastConnectionsFastestObservedPredictiveDynamicRatioPriorityGroupActivationFallbackHostPage138StaticDynamicFailureMechanisms主要使用輪詢、最少連接如何選擇服務(wù)器--負(fù)載均衡算法RoundRobinStatBIG-IPLTM負(fù)載均衡模式輪詢（RoundRobin）：順序循環(huán)將請(qǐng)求一次順序循環(huán)地連接每個(gè)服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從順序循環(huán)隊(duì)列中拿出，不參加下一次的輪詢，直到其恢復(fù)正常。比率（Ratio）：給每個(gè)服務(wù)器分配一個(gè)加權(quán)值為比例，根椐這個(gè)比例，把用戶的請(qǐng)求分配到每 個(gè)服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，直到其恢復(fù)正常。優(yōu)先權(quán)（Priority）：給所有服務(wù)器分組，給每個(gè)組定義優(yōu)先權(quán)，BIG/IP用戶的請(qǐng)求，分配給優(yōu)先級(jí)最高的服務(wù)器組（在同一組內(nèi)，采用輪詢或比率算法，分配用戶的請(qǐng)求）；當(dāng)最高優(yōu)先級(jí)中所有服務(wù)器出現(xiàn)故障，BIG/IP才將請(qǐng)求送給次優(yōu)先級(jí)的服務(wù)器組。這種方式，實(shí)際為用戶提供一種熱備份的方式。最小的連接數(shù)（LeastConnection）：傳遞新的連接給那些進(jìn)行最少連接處理的服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，直到其恢復(fù)正常。最快模式（Fastest）：傳遞連接給那些響應(yīng)最快的服務(wù)器。當(dāng)其中某個(gè)服務(wù)器發(fā)生第二到第7層的故障，BIG/IP就把其從服務(wù)器隊(duì)列中拿出，不參加下一次的用戶請(qǐng)求的分配，