负载均衡设备的基本原理.ppt

Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,F5 Networks,负载均衡设备综合简介,熊 柯,(jeff),负载均衡基础,中文站负载均衡设备使用情况,转换（,3,种工作模式,/SNAT,）,连接分配与保持技术（源地址，,COOKIE,）,健,F5,工作原理,F5,性能指标,(,安全防护,),Agenda,负载均衡基础,3,中文站负载均衡设备使用情况,兴议,CSR,兴议核心交换机,接入交换机,L2 1G,L3,L3,L3 10G,L3 10G,F5 BIG8400,F5 BIG8400,A10 AX3200,A10 AX3200,NS 10010,NS 9950,NS 10010,NS 9950,F5 8400,：,中文站市场,/,收费,/,社区,/P4P/SA,应用,/,附属应用,A10 AX3200,：,中文站图片,CACHE,NS,：,10010,：搜索,/TPDNS/,图片,VIP,9950,：图片,CACHE,5,内部,VIP,提供生产网络机房内部调用，比如：搜索的,isearch,内部,VIP,，外部不可访问,外部,VIP,提求，比如中文站主站，以及,CRM,的应用，能够通过安全设备提供对源地址的访问限制,6,负载均衡的,VIP,功能地址转换,模式,A,（,SNAT/DNAT,：万能模式）,源地址目标地址都转换，服务器无法看到真实客户源地址,模式,B,（,DNAT,：,PBR,模式）,只转换目标地址，需要网络结构,/,负载均衡都支持,模式,C,（,NOTHING,：,DR/DSR,模式）,不做地址转换，需要服务器创建一个,LOOPBACK,地址。推荐的使用模式。,7,一个例子,:,Internet,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Virtual Server,216.34.94.17:80,Pool Members,Maps to,Virtual Server-Address Translation,BIG-IP performs network address translation to real server addresses such that all machines are viewed as one Virtual Server,Real Server Address,Network Address Translation,Virtual Server Address,Internet,216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Network Flow-Packet#1,resolves,to BIG-IP Virtual Server Address,216.34.94.17:80,Internet,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,DNS Server,216.34.94.17:80,Network Flow-Packet#1,BIG-IP translates Dest Address to Node based on Load Balancing,Internet,Packet#1,Src-207.17.117.20:4003,Dest 216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Packet#1,Src 207.17.117.20:4003,Dest 172.16.20.1:80,207.17.117.20,216.34.94.17:80,Network Flow Packet#1 Return,BIG-IP translates Src Address back to Virtual Server Address,Internet,Packet#1-return,Dest-207.17.117.20:4003,Src 216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Packet#1-return,Dest 207.17.117.20:4003,Src 172.16.20.1:80,207.17.117.20,216.34.94.17:80,Network Flow-Packet#2,Internet,Packet#2,Src-207.17.117.21:4003,Dest 216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Packet#2,Src 207.17.117.21:4003,Dest 172.16.20.2:4002,207.17.117.21,216.34.94.17:80,Network Flow Packet#2 Return,Internet,Packet#2-return,Dest-207.17.117.21:4003,Src 216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Packet#2-return,Dest 207.17.117.21:4003,Src 172.16.20.2:4002,207.17.117.21,216.34.94.17:80,Network Flow-Packet#3,Internet,Packet#3,Src-207.17.117.25:4003,Dest 216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Packet#3,Src 207.17.117.25:4003,Dest 172.16.20.4:8080,207.17.117.25,216.34.94.17:80,Network Flow Packet#3 Return,Internet,Packet#3-return,Dest-207.17.117.25:4003,Src 216.34.94.17:80,172.16.20.4:8080,172.16.20.1:80,172.16.20.2:4002,172.16.20.3:80,Packet#3-return,Dest 207.17.117.25:4003,Src 172.16.20.4:8080,207.17.117.25,216.34.94.17负载均衡的,SNAT(Secure NAT),功能地址转换,当服务器只有私有地址的时候，但是又想访问外网的时候，需要网络设备提供地址转换。,是不是回忆起啥？对！就是家里的宽带路由器的共享上网功能,如果服务器要访问工商银行的,FTP,服务器，对方会向你索要你的公网地址，加入到白名单。你就可以通过它的防火墙了。,17,请看,SNAT,的示意图,18,连接分配方法：,Round Robin,Ratio,Least Connections,Fastest,Observed,Predictive,Dynamic Ratio,Priority Group Activation,Fallback HostStatic,Dynamic,Failure Mechanisms,Round Robin,Clients,Router,BIG-IP Controller,Servers,Client requests are distributed evenly,1,2,3,4,5,6,7,8,Internet,Ratio,Clients,Router,BIG-IP Controller,Servers,Administrator sets ratio for distributing Client requests 3:2:1:1,1,2,3,4,8,9,10,11,Internet,5,7,12,14,6,13,Fastest,Clients,Router,BIG-IP Controller,Servers,Next requests go to Node with fastest response time,2,5,Internet,10ms,10ms,10ms,17ms,Current Response Times,1,4,3,6,Fastest,Clients,Router,BIG-IP Controller,Servers,Some time later,response times change,102,104,Internet,10ms,10ms,7ms,7ms,Current Response Times,101,103,Least Connections,Clients,Router,BIG-IP Controller,Servers,1,2,Internet,Next requests goes to Node with fewest open connections,459,460,461,470,Current Connections,3,4,5,6,Least Connections,Clients,Router,BIG-IP Controller,Servers,Internet,Some time later,number of connections change,61,63,280,290,111,112,Current Connections,62,Priority Group Activation,Clients,Router,BIG-IP Controller,Servers,1,3,5,2,4,6,Internet,Priority 1,Priority 2,If you set Priority Group Activation to 2,and 3 of the highest priority members are available,then lower priority members will not be used.,Priority Group Activation,Clients,Router,BIG-IP Controller,Servers,1,5,Internet,Priority 1,Priority 2,3,2,4,6,7,8,If number of members falls below Priority Group Activation(2),then the next highest priority members are used also.,重要的健康检查,Monitor,7,层检查,:GET/REPONSE 200ok,4,层检查：,SYN-SHAKE;FIN-SHAKE,ICMP:ping,检查,模拟环境示例：,在模拟环境上创建,3,种类型的,MONTIOR,，在服务器上观察数据包,28,Ping,检查,Steps,Packets sent to IP Addresses,If no response,then no traffic sent to members using that node address Example-ICMP,Internet,172.16.20.1,172.16.20.2,172.16.20.3,ICMP,端口检查,Steps,Opens TCP connection(IP Address:service),Connection closed,If TCP connection fails,then no traffic sent to associated Members,Example TCP,Internet,172.16.20.1:80,172.16.20.2:80,172.16.20.3:80,TCP Connection,7,层,/,内容检查,Internet,172.16.20.1:80,172.16.20.2:80,172.16.20.3:80,Steps,Opens TCP connection(IP Address:service),Sends a request,Response returns data,Connection closed,If Receive Rule not found in data,then no traffic sent to associated Members,Example http,http GET/,连接保持技术,源地址保持技术,示意图,Cookie,保持技术,示意图,源地址保持,Based on Client Source IP Address,Netmask -Address Range,1,2,3,1,2,3,205.229.151.10,205.229.152.11,If Netmask is 255.255.255.0,205.229.151.107,Cookie,保持,Insert mode,BIG-IP Inserts a cookie into the stream,Rewrite mode,Web server creates cookie and BIG-IP Controller changes it,Passive mode,Web server creates cookie and BIG-IP Controller Reads it,Hash mode,Maps a cookie value to a specific node,Web server must generate a cookie,Client,Server,HTTP request(no special cookie),TCP handshake,TCP handshake,HTTP request(no special cookie),HTTP reply(no special cookie),HTTP reply(with inserted cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(no special cookie),HTTP reply(updated cookie),cookiespecifiesserver,First Hit,Second Hit,Cookie Insert Mode,Client,Server,HTTP request(no special cookie),TCP handshake,TCP handshake,HTTP request(no special cookie),HTTP reply(with blank cookie),HTTP reply(with rewritten cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(with blank cookie),HTTP reply(with updated cookie),cookiespecifiesserver,First Hit,Second Hit,Cookie Rewrite Mode,Client,Server,HTTP request(no special cookie),TCP handshake,TCP handshake,HTTP request(no special cookie),HTTP reply(with special cookie),HTTP reply(with special cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(with special cookie),HTTP reply(with special cookie),cookiespecifiesserver,First Hit,Second Hit,Cookie Passive Mode,Client,Server,HTTP request(no special cookie),TCP handshake,TCP handshake,HTTP request(no special cookie),HTTP reply(with cookie),HTTP reply(with cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(with cookie),HTTP reply(with cookie),cookie hash,specifiesserver,First Hit,Second Hit,Third Hit,Server,TCP handshake,HTTP request(with same cookie),HTTP reply(with cookie),cookie hash,specifiesserver,TCP handshake,HTTP request(with same cookie),HTTP reply(with cookie),Cookie Hash Mode,F5,转发,Performance L4,Standard VS,39,Performance L4,TMM,只是负责客户端连接的分配和转发，不改变,TCP,连接中的任何参数,客户端和服务器自行协商,TCP,传输参数,在,34/64/68,平台上,Performance L4,可以有,PVA,加入实现硬件加速,在,15/16/36/69/89/Viprion,平台上都通过,TMM,核心进行处理,Performance L4,VS,上只有,4,层的,iRules,可以使用,默认状态下，新建连接的第一个包必须是,Syn,包，如果是其他的数据包比如,ACK,、,RST,等如果不在连接表中，则全部丢弃。,在,Fast L4 profile,打开,Loose close,和,Loose Initial,的时候对非,Syn,包也可以建立连接表,40,TMM,客户端,客户端,客户端,服务器端,服务器端,服务器端,Performance L4,攻击防护,-Syn Cookie,正常情况下客户端连接和服务器端连接是,1:1,的关系,TMM,在第一次收到客户端,Syn,包时，并不建立连接表,TMM,的,Syn Ack,回应通过算法回应给客户端,Syn,，并期待客户端回应的值,TMM,对客户端,ACK,进行计算，确认是真实客户端，再和后台服务器建立连接,在,84/88,上可以实现硬件的,Syn Cookie,计算，其余的平台都是通过软件实现,SynCookie,计算,Syn Cookie,工作模式下，只有成功建立连接的,TCP,请求才转发到后台,41,TMM,Syn,Syn,Ack(syncookie),Ack(Cookie),Syn,Syn-Ack,Ack,Data,Standard VS,正常情况下客户端连接和服务器端连接是,1:1,的关系,默认工作在全代理模式，客户端和服务器端的,TCP,连接完全独立,客户端和服务器端的,TCP,参数都是由,TMM,和双方分别协商,默认情况下以客户端源,IP,和后台建立连接，在打开,SNAT,的情况下用,SNAT,地址和后台建立连接,Standard VS,的端口永远对外开放，无论后台是否有服务器在工作,42,TMM,Syn,Syn,Ack,Ack,Syn,Syn-Ack,Ack,Data,Data,Standard,模式下的攻击防护,Standard VS,模式具有天然的防攻击功能,在遇到,Syn,攻击的时候会导致系统的连接表过大,通过,System-SYN Check Activation Threshold,的设置，在达到设置值的时候系统自动启动,Syn Cookie,，避免建立过多连接，这个值对全局生效,大部分的网络层攻击都无法通过,Standard,模式的,VS,43,44,F5 BIG IP,平台一览,产品图样,产品型号,BIG-IP 1500,BIG-IP 3400,BIG-IP 6400,BIG-IP 6800,BIG-IP 8400,BIG-IP 8800HW Layer 4,Connections/sec,50000,110,000,220,000,220,000,270,000,270,000,Layer 7,Connections/sec,22,000,55,000,70,000,100,000,156,000,312,000,Request/sec,43,000,104,000,137,000,186,000,340,000,700,000,Max.throughput,500 Mbps,1 Gbps,2 Gbps,4 Gbps,10 Gbps,10 Gbps,8 Gbps L7,Max.conc.conn.,4 Million,4 Million,8 Million,8 Million,8 Million,8 Million,Max.SSL TPS,2,000,5,000,15,000,20,000,37,000,48,000,Max.SSL Bulk,500 Mbps,1 Gbps,2 Gbps,2 Gbps,3 Gbps,6 Gbps,Max.SSL conc.conn.,100,000,200,000,500,000,500,000,500,000,500,000,Mpression,100 Mbps,500 Mbps,2 Gbps,2 Gbps,3 Gbps,6 Gbps,Switch backplane,14 Gbps,22 Gbps,44 Gbps,48 Gbps,80 Gbps,80 Gbps,我是一条虫，完了！,