DataCenter Cisco FWSM / ACE Service Module Design & Deploy Guide Version 1.0 2007-07-12 Cisco Systems Korea Solution S.E Team S.E 최 우 형 (whchoi@cisco.com)
Agenda FWSM / ACE Design I – FWSM Routed Mode / ACE Transparent Mode 초간단 ACE Loadbalancing Test 방법 FWSM / ACE Design II - FWSM Transparent Mode / ACE Routed Mode FWSM / ACE Design III - FWSM Multi Pair Bridged Mode / ACE Routed Mode ACE DSR FWSM / ACE Design IV - ACE기반의 FWSM 10G FLB Design Agenda Presentation_ID © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2
FWSM/ACE Design I FWSM Routed Mode & ACE Transparent Mode
FWSM Routed & ACE Bridge 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 172.16.3.254/1 22.22.22.254 V22 V22 Out:22.22.22.1 Trunk V20,21,22,99,198,199 In:21.21.21.1 V21 V21 BVI 21.21.21.21 V20 VIP 21.21.21.21 V20 RSTP F9/1 F9/1 B Server A 21.21.21.101 Server B 21.21.21.102
FWSM Routed & ACE Transparent Design Key Point B V20 V21 V22 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 Server A 21.21.21.11 Server B 21.21.21.12 F9/1 OSPF Area0 RSTP 22.22.22.254 Out:22.22.22.1 In:21.21.21.1 VIP 21.21.21.21 BVI 21.21.21.21 Trunk V20,21,22,99,198,199 172.16.3.254/1 Routed TP 1 Server VIP의 보안성 강화 FWSM Static NAT IP vs ACE VIP와 Mapping을 통한 보안 강화 2 Design의 유연성 강화 FWSM의 Same Security interface 기능을 통해, 다양한 서브넷 구성 가능 -ACE의 경우 기본 5개의 Virtual Context가 제공되므로, FWSM의 Virtual context가 부족할 경우, Same Security 기능을 통해 대체 효과 3 Firewall을 기존에 사용할 경우 유리 - 기 사용중인 Firewall에 Routed 모드로 사용중이거나, NAT를 사용 중일 경우 Migration 에 유리
FWSM Routed & ACE Transparent Config Sup720 Supervisor 기본 Config Sup720 구성 ACE 구성 svclc multiple-vlan-interfaces svclc module 6 vlan-group 3,4 svclc vlan-group 3 20-22 ACE,FWSM에서 사용되고 있는 Inside,Outside,Client,Server Vlan 설정 svclc vlan-group 4 99,198,199 ACE Failover Tracking Vlan을 위한 Vlan 99, FWSM Failover,Stateful FO를 위한 Vlan 198,199 설정 FWSM 구성 firewall multiple-vlan-interfaces firewall module 7 vlan-group 3,4
FWSM Routed & ACE Transparent Config Sup720 Cat6500-A STP 구성 spanning-tree mode rapid-pvst spanning-tree vlan 20 root primary Spanning-tree vlan 21 root primary Vlan 20 에 대해 강제로 Primary 지정 Cat6500-B STP 구성 spanning-tree vlan 20 root secondary Spanning-tree vlan 21 root secondary Vlan 20 에 대해 강제로 Secondary 지정 B V20 V21 V22 F9/1 RSTP 22.22.22.254 Out:22.22.22.1 In:21.21.21.1 VIP 21.21.21.21 BVI 21.21.21.21 Trunk V20,21,22,99, 198,199 Tip !!! Service Module을 Transparent Mode로 동작 시킬 경우에는 빠른 우회경로 확보가 필수이다. 따라서 Service Module이 BVI로 동작하는 Layer 2 구간에는 가장 빠른 Take Over를 위해 RSTP를 연동하여, 빠른 우회경로를 확보하는 것이 좋다. 또한 STP의 잦은 변경을 방지하기 위해 Active Cat 6500 은 항상 Root가 되도록 지정하는 것이 좋다.
FWSM Routed & ACE Bridge Config Sup720 HSRP 구성 Cat 6500-A interface Vlan22 ip address 22.22.22.253 255.255.255.0 standby 3 ip 22.22.22.254 standby 3 priority 200 standby 3 preempt Cat 6500-B 22.22.22.254 V22 Trunk V20,21,22,99, 198,199 V22 Out:22.22.22.1 In:21.21.21.1 V21 V21 BVI 21.21.21.21 V20 VIP 21.21.21.21 V20 RSTP F9/1 F9/1 B Tip !!! MSFC와 FWSM 사이의 Internal HSRP 구성이므로, 물리적인 이슈로 인한 HSRP가 흔들릴 경우는 없다. 따라서 FWSM 모듈, Supervisor Engine 자체가 장애가 있지 않는 한 HSRP Interface Primary는 정해져 있다. 이 경우에는 되도록 Preempt를 지정해 두도록 한다.
FWSM Routed & ACE Transparent Config FWSM Virtual Context 구성 interface Vlan11 description =TP Mode - Inside= ! interface Vlan12 description =TP Mode - Outside= interface Vlan21 description =Routed Mode - Inside= interface Vlan22 description =Routed Mode - Outside= interface Vlan101 description =Admin - Inside= interface Vlan102 description =Admin - Outside= interface Vlan198 description LAN Failover Interface interface Vlan199 description STATE Failover Interface admin-context admin context admin allocate-interface Vlan101 allocate-interface Vlan102 config-url disk:/admin.cfg ! Admin VF(Virtual Firewall)을 위한 Interface 할당 Admin VF를 위한 Config 파일 저장 위치 지정 context A-Group allocate-interface Vlan11 allocate-interface Vlan12 config-url disk:/A-group.cfg A-Group VF를 위한 Interface 할당 A-Group VF를 위한 Config 파일 저장 위치 지정 context B-Group allocate-interface Vlan21 allocate-interface Vlan22 config-url disk:/B-group B-Group VF를 위한 Interface 할당 B-Group VF를 위한 Config 파일 저장 위치 지정
FWSM Routed & ACE Transparent Config FWSM F/O 구성 failover failover lan unit primary FWSM Unit의 Primary or Secondary를 선언 failover lan interface faillink Vlan198 Failover Interface Vlan 198 선언 failover polltime unit msec 500 holdtime 3 Polling Time, Hold Time 선언 failover replication http FO 발생시 HTTP 복제 선언 failover link statelink Vlan199 Stateful Failover Interface 선언 failover interface ip faillink 192.168.98.1 255.255.255.0 standby 192.168.98.2 FO Interface IP address 선언 failover interface ip statelink 192.168.99.1 255.255.255.0 standby 192.168.99.2 Stateful FO Interface IP Address 선언
FWSM Routed & ACE Transparent Config FWSM Basic Config interface Vlan21 nameif inside security-level 100 ip address 21.21.21.1 255.255.255.0 ! Inside Interface 구성 interface Vlan22 nameif outside security-level 0 ip address 22.22.22.1 255.255.255.0 Outside Interface 구성 access-list permit extended permit ip any any ACL Rule 설정 access-group permit in interface inside access-group permit in interface outside Interface별 ACL 할당 route outside 0.0.0.0 0.0.0.0 22.22.22.254 1 Outside routing 설정 icmp permit any inside icmp permit any outside V20 V21 V22 F9/1 22.22.22.254 Out:22.22.22.1 In:21.21.21.1 BVI 21.21.21.21
FWSM Routed & ACE Transparent Config ACE Virtual Partition 구성 context A_Group allocate-interface vlan 10-11 ! A_Group Context 선언 및 Interface Vlan 10,11 할당 context B_Group allocate-interface vlan 20-21 A_Group Context 선언 및 Interface Vlan 10,11 할당 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ACE Failover Interface 지정 ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 ft Peer 간 heartbeat Interval과 counte 선언
FWSM Routed & ACE Transparent Config ACE FT - Failover Group 구성 ft group 1 peer 1 no preempt priority 200 associate-context Admin inservice Ft group 별 priority 지정과 Context 선언 ft group 2 associate-context A_Group ft group 3 associate-context B_Group ft group #1 ft group #2 ft group #3 Tip !!! ft group별로 해당 Priority를 차등화 하여 구성할 경우 ACE Module 을 Loadsharing 하는 효과를 누릴 수 있으며, 디자인에 따라 Active/Active, Active/Standby 형태로 구성이 가능하다. 단, FWSM의 Active/Active 형태와는 다른 방식으로 동일 Context간 Session을 공유하여 Traffic이 동시에 흐르는 형태는 아니다.
FWSM Routed & ACE Transparent Config ACE FT - Failover Group 구성 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 heartbeat interval Millisecond 단위 Heartbeat count 10 Hearbeat count 숫자 위의 예제에서는 Heartbeat interval * Heartbeat count = 1Sec 가 된다. Ft interface Vlan 99 ft group #1 ft group #2 ft group #3
FWSM Routed & ACE Transparent Config ACE Basic Config – RealServer 구성 rserver host Server11 ip address 21.21.21.11 inservice rserver host Server12 ip address 21.21.21.12
FWSM Routed & ACE Transparent Config ACE Basic Config – ServerFarm 구성 RealServer RealServer ServerFarm serverfarm host Web-Server rserver Server11 inservice rserver Server12
FWSM Routed & ACE Transparent Config ACE Basic Config – SLB Policy Map 구성 RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server
FWSM Routed & ACE Transparent Config ACE Basic Config – Server VIP 구성 Class-map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server class-map match-all Web-Server-VIP 2 match virtual-address 21.21.21.21 tcp eq www
FWSM Routed & ACE Transparent Config ACE Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server class-map match-all Web-Server-VIP match virtual-address 21.21.21.21 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB
Interface ACL & Service Policy 적용 FWSM Routed & ACE Transparent Config ACE Basic Config – L3/L4 Policy Map 구성 ACE Class-map L3/L4 Policy map LB Policy map RealServer Interface ACL & Service Policy 적용 RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server class-map match-all Web-Server-VIP 2 match virtual-address 21.21.21.21 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB access-list anyone extended permit ip any any interface vlan 21 access-group input anyone service-policy input match-www
FWSM Routed & ACE Transparent Config ACE Basic Config – L7 RealServer 구성 rserver host Server11 ip address 21.21.21.11 inservice rserver host Server12 ip address 21.21.21.12 rserver host Server13 ip address 21.21.21.13 inservice rserver host Server14 ip address 21.21.21.14
FWSM Routed & ACE Transparent Config ACE Basic Config – L7 ServerFarm 구성 RealServer ACE RealServer serverfarm host Web-Server rserver Server11 inservice rserver Server12 serverfarm host URL-Server rserver Server13 inservice rserver Server14
FWSM Routed & ACE Transparent Config ACE Basic Config – L7 SLB Policy Map 구성 RealServer Class-map L3/L4 Policy map LB Policy map ACE RealServer Class-map policy-map type loadbalance first-match SLB predictor roundrobin class class-default serverfarm Web-Server class-map match-all Web-Server-VIP 2 match virtual-address 21.21.21.21 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB class-map type http loadbalance match-any URL_contents 2 match http url .*\.php
FWSM Routed & ACE Transparent Config ACE Basic Config – L7 SLB Policy Map 구성 RealServer LB Policy map ACE Class-map Class-map L3/L4 Policy map LB Policy map RealServer policy-map type loadbalance first-match SLB predictor roundrobin class class-default serverfarm Web-Server class URL_contenst serverfarm URL-Server class-map match-all Web-Server-VIP 2 match virtual-address 21.21.21.21 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB class-map type http loadbalance match-any URL_contents 2 match http url .*\.php
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #1 RealServer ACE Probe-A Probe-B RealServer probe http html-probe request method get url /index.html expect status 200 200 probe icmp icmp-probe rserver host Server11 ip address 21.21.21.11 probe html-probe inservice rserver host Server12 ip address 21.21.21.12 inservice serverfarm host Web-Server probe icmp-probe rserver Server11 inservice rserver Server12
Serverfarm Web-Server FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #2 Serverfarm Web-Server Icmp probe rserver host Server11 ip address 21.21.21.11 probe html-probe inservice rserver host Server12 ip address 21.21.21.12 inservice serverfarm host Web-Server probe icmp-probe rserver Server11 rserver Server12 rserver S11 rserver S12 HTTP probe Tip !!! 구성 예제와 같이 real server S11 에 별도의 HTTP Probe를 지정하고, real server S11 이 속하게 되는 Serverfam Web-Server에 ICMP-Probe를 지정하게 되는 경우에는, rserver S11 은 icmp-probe, http-probe 어느 하나라도 Fail이 발생할 경우에 Server의 Service에서 제거 된다. 따라서 매우 중요한 Real Service는 두개 이상의 Probe를 지정해 두는 것도 하나의 Tip 이 될 수 있다.
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #3 CE/B_Group# sh probe probe : html-probe type : HTTP, state : ACTIVE ---------------------------------------------- port : 80 address : 0.0.0.0 addr type : - interval : 120 pass intvl : 300 pass count : 3 fail count: 3 recv timeout: 10 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- rserver : Server11 21.21.21.11 22 3 19 SUCCESS probe : icmp-probe type : ICMP, state : ACTIVE port : 0 address : 0.0.0.0 addr type : - serverfarm : Web-Server real : Server11[0] 21.21.21.11 302 199 103 SUCCESS real : Server12[0] 21.21.21.12 302 0 302 SUCCESS
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #4 1 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe <probe-type> <probe-name> dns, echo, finger, ftp, http, https,icmp ,imap, pop, radius, probe, scripted, smtp ,tcp, telnet, udp 다양한 Protocol 별 Probe 기능과 Script 기반의 Probe 기능을 지원하고 있음. 2 port <port-number> TCP/UDP 의 특정 서비스 포트에 대해 Probe를 지정할 수 있음
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #5 3 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp icmp-probe description ICMP-Probe interval 2 faildetect 10 passdetect interval 2 passdetect count 5 receive 1 Interval Interval은 Probe를 주기적으로 Check하는 시간을 의미한다. 예제의 경우에는 2초에 한번씩 Check. faildetect faildetect Count는 Probe Check 시 특정 Count에 Fail이 Count 되면 Server, real Server를 Fail 로 간주하게 된다. 예제의 경우에는 10번의 Fail이 Count되면, Fail로 처리하겠다는 의미 Receive ACE가 Probe 를 해당 Server에 보내고 기다리는 시간을 의미한다. 예제에서는 1초간 기다리겠다는 의미이다. Tip !!! 구성 예제의 결과를 보면 결국 Fail 되는 총시간은 interval * faildetect * receive 가 된다. 따라서 위의 세개의 값을 세밀하게 계산하여, Fail Server를 선택하는 것이 매우 중요하다.
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #6 4 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp icmp-probe description ICMP-Probe interval 2 faildetect 10 passdetect interval 2 passdetect count 5 receive 1 passdetect interval Server 가 Fail 된 후 복구 되기 위해, 주기적으로 다시 Probe를 보내는 주기를 의미한다. 예제에서는 2초에 한번씩 Probe를 보내게 된다. Passdetect count Server 가 Fail 된 후 복구되기 위한 성공적인 Probe Count를 의미한다. 예제에서는 5개의 성공 Probe 결과를 받았을 때 서비스를 재개 하겠다는 의미 Tip !!! 구성 예제의 결과를 보면 결국 Server가 Fail된 후 정상 복구 된다고 하더라도, intervla * count가 되므로, 정상 복구 후 10Sec 이후에 실제 정상 서비스가 된다는 의미 이다.
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #7 ACE/B_Group# sh probe icmp-probe probe : icmp-probe type : ICMP, state : ACTIVE ---------------------------------------------- port : 0 address : 0.0.0.0 addr type : - interval : 2 pass intvl : 2 pass count : 5 fail count: 10 recv timeout: 1 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- rserver : Server11 21.21.21.11 269 199 70 SUCCESS rserver : Server12 21.21.21.12 269 0 269 SUCCESS serverfarm : Web-Server real : Server11[0] real : Server12[0]
FWSM Routed & ACE Transparent Config ACE Basic Config – Health Monitoring(Probe) #8 ACE/B_Group# sh probe icmp-probe detail probe : icmp-probe type : ICMP, state : ACTIVE description : ICMP-Probe ---------------------------------------------- port : 0 address : 0.0.0.0 addr type : - interval : 2 pass intvl : 2 pass count : 5 fail count: 10 recv timeout: 1 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- rserver : Server11 21.21.21.11 259 199 60 SUCCESS Socket state : CLOSED No. Passed states : 1 No. Failed states : 1 No. Probes skipped : 0 Last status code : 0 No. Out of Sockets : 0 No. Internal error: 0 Last disconnect err : - Last probe time : Fri Jul 6 14:28:08 2007 Last fail time : Fri Jul 6 14:19:43 2007 Last active time : Fri Jul 6 14:26:24 2007 이하 생략….
FWSM Routed & ACE Transparent Config ACE Basic Config – Transparent 구성 RealServer Bridge BVI V21 V20 RealServer ServerFarm access-list bpdu ethertype permit bpdu STP Loop 방지를 위해 BPDU를 통과 시키도록 구성 interface vlan 21 bridge-group 1 access-group input bpdu access-group input anyone service-policy input p-mgmt service-policy input match-www no shutdown interface vlan 20 bridge-group 1 access-group input bpdu access-group input anyone no shutdown interface bvi 1 ip address 21.21.21.254 255.255.255.0 peer ip address 21.21.21.253 255.255.255.0
FWSM Routed & ACE Transparent Config ACE Basic Config – Management Policy 구성 Class-map L3/L4 Policy map RealServer RealServer ServerFarm class-map type management match-any c-mgmt 2 match protocol icmp any 3 match protocol telnet any 4 match protocol ssh any policy-map type management first-match p-mgmt class c-mgmt permit interface vlan 21 description B_Group_Client_Vlan service-policy input p-mgmt
FWSM Routed & ACE Transparent Config ACE Monitoring – Basic ACE Basic Review DC_BB-A#sh asic-version slot 6 Module in slot 6 has 2 type(s) of ASICs ASIC Name Count Version HYPERION 1 (5.0) SSA 1 (8.0) FWSM DC_BB-A#sh asic-version slot 7 Module in slot 7 has 2 type(s) of ASICs ASIC Name Count Version PINNACLE 2 (4.2) MEDUSA 1 (2.0) ACE는 기존 FWSM,CSM과 같이 Multi Gigabit Etherchannel을 쓰는 방식이 아니라, single 10G Interface가 접속되어 있는 형태이다. DC_BB-A#sh interfaces tenGigabitEthernet 6/1 status Port Name Status Vlan Duplex Speed Type Te6/1 connected trunk full 10G MultiService Module DC_BB-A#sh interfaces tenGigabitEthernet 6/1 counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Te6/1 3900088 35250 18058 450 Port OutOctets OutUcastPkts OutMcastPkts OutBcastPkts Te6/1 5555729 79198 2240 1640
FWSM Routed & ACE Transparent Config ACE Monitoring – svclc DC_BB-A#show svclc vlan-group Display vlan-groups created by both ACE module and FWSM commands Group Created by vlans ----- ---------- ----- 1 ACE 100-102 2 ACE 10-12 3 ACE 20-22 4 ACE 99,198-199 DC_BB-A#show svclc module Module Vlan-groups ------ ----------- 06 1,2,3,4 DC_BB-A#show interfaces tenGigabitEthernet 6/1 trunk Port Mode Encapsulation Status Native vlan Te6/1 on 802.1q trunking 1 Port Vlans allowed on trunk Te6/1 10-12,20-22,99-102,198-199 Port Vlans allowed and active in management domain Port Vlans in spanning tree forwarding state and not pruned
FWSM Routed & ACE Transparent Config ACE Monitoring – ARP Table ACE/B_Group# sh arp Context B_Group ================================================================================ IP ADDRESS MAC-ADDRESS Interface Type Encap NextArp(s) Status 21.21.21.11 00.10.c6.c0.01.55 vlan20 RSERVER 6 132 sec up 21.21.21.12 00.0d.60.60.b1.20 vlan20 RSERVER 5 132 sec up 21.21.21.253 00.19.06.28.10.61 vlan21 LEARNED 10 12681 sec up 21.21.21.1 00.0f.23.be.fe.00 vlan21 GATEWAY 7 132 sec up 21.21.21.21 00.0b.fc.fe.1b.03 vlan21 VSERVER LOCAL _ up 21.21.21.254 00.19.06.27.d9.01 bvi1 INTERFACE LOCAL _ up 21.21.21.13 00.00.00.00.00.00 bvi1 RSERVER - dn 21.21.21.14 00.00.00.00.00.00 bvi1 RSERVER - dn
FWSM Routed & ACE Transparent Config ACE Monitoring – Routing Table ACE/B_Group# sh ip route Routing Table for Context B_Group (RouteId 2) Codes: H - host, I - interface S - static, N - nat A - need arp resolve, E - ecmp Destination Gateway Interface Flags ------------------------------------------------------------------------ 0.0.0.0 21.21.21.1 vlan21 S 21.21.21.0/24 0.0.0.0 bvi1 IA Total route entries = 2
FWSM Routed & ACE Transparent Config ACE Monitoring – Real Server Monitoring ACE/B_Group# sh rserver Server11 rserver : Server11, type: HOST state : OPERATIONAL --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: Web-Server 21.21.21.11:0 8 OPERATIONAL 1 8 == Real Server 접속 불가 == ACE/B_Group# sh rserver Server13 rserver : Server13, type: HOST state : ARP_FAILED --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: URL-Server 21.21.21.13:0 8 ARP_FAILED 0
FWSM Routed & ACE Transparent Config ACE Monitoring – Service Policy Monitoring ACE/B_Group# sh service-policy match-www detail Status : ACTIVE Description: - ----------------------------------------- Interface: vlan 21 service-policy: match-www class: Web-Server-VIP VIP Address: Port: 21.21.21.21 eq 80 loadbalance: L7 loadbalance policy: SLB VIP Route Metric : 77 VIP Route Advertise : DISABLED VIP ICMP Reply : DISABLED VIP State: INSERVICE curr conns : 1 , hit count : 27 dropped conns : 0 client pkt count : 26 , client byte count: 1040 server pkt count : 0 , server byte count: 0 L7 Loadbalance policy : SLB class/match : URL_contents LB action : serverfarm: URL-Server hit count : 0 dropped conns : 0 class/match : class-default serverfarm: Web-Server
FWSM Routed & ACE Transparent Failover Scenario 1 Server Switch Primary Link 단절 Session State 유지 Ping Losss 1개 이내. RSTP에 의해 msec 단위 Take Over 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 Fast OSPF Area0 4 172.16.3.254/1 2 ACE Primary 장애 Session State 유지 Ping Losss 1개 이내. ACE FT 기법을 통한 msec 단위 Take Over 구성 가능 22.22.22.254 V22 V22 Out:22.22.22.1 Trunk V20,21,22,99,198,199 3 In:21.21.21.1 V21 V21 BVI 21.21.21.21 2 V20 VIP 21.21.21.21 V20 3 RSTP FWSM 장애 Session State 유지 Ping Losss 1개 이내. FWSM Stateful F/O 기법을 통한 msec 단위 Take Over 구성 가능 F9/1 F9/1 1 B Server A 21.21.21.101 Server B 21.21.21.102
FWSM Routed & ACE Transparent Failover Scenario 4 Primary 6500 장애 또는 Router Uplink 단절 Session State 유지 또는 빠른 우회 경로 확보 Ping Losss 1개 이내. Fast OSPF 구현을 통한 빠른 우회경로 확보 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 Fast OSPF Area0 4 172.16.3.254/1 22.22.22.254 V22 V22 Out:22.22.22.1 Trunk V20,21,22,99,198,199 3 In:21.21.21.1 OSPF Tuning ip ospf dead-interval minimal hello-multiplier 20 router os 1 timers throttle spf 300 10000 30000 timers throttle lsa all 200 2000 10000 V21 V21 BVI 21.21.21.21 2 V20 VIP 21.21.21.21 V20 RSTP F9/1 F9/1 1 B Server A 21.21.21.101 Server B 21.21.21.102
초간단~~ Load balancing Test 방법
How to Test Scenario Test Topology & Freeware Tool kit ServerFarm ACE FWSM RealServer Bridge BVI V21 V20 WAS 172.16.11.11 RealServer VIP21.21 유용한 Web Stress Tool Kit MS Web Application Stress Download URL http://www.microsoft.com/technet/archive/itsolutions/intranet/downloads/webstres.mspx?mfr=true RealServer Test용 아파치 서버 http://www.apmsetup.com/download.php?ct=9
How to Test Scenario Freeware Tool kit - WAS Web Server IP Address or Domain Name Verb , Path 지정
How to Test Scenario Freeware Tool kit - WAS Stress 에 대한 환경 설정 구성
How to Test Scenario Freeware Tool kit – 간단한 Web Server 구동 Apache 서버 및 통계를 보기 위한 MySQL 실행 Apache 서버 및 통계를 보기 위한 MySQL 실행
How to Test Scenario 간단한 Web Server 구동 간단한 ACE Web 페이지 구동 접속통계페이지 연결
How to Test Scenario Realserver Stress 및 LB 확인
How to Test Scenario Realserver Stress 및 LB 확인 ACE/B_Group# sh conn total current connections : 296 conn-id np dir proto vlan source destination state ----------+--+---+-----+----+---------------------+---------------------+------+ 6 1 in TCP 21 172.16.11.11:2589 21.21.21.21:80 ESTAB 21 1 out TCP 20 21.21.21.11:80 172.16.11.11:2589 ESTAB 7 1 in TCP 21 172.16.11.11:2559 21.21.21.21:80 ESTAB 99 1 out TCP 20 21.21.21.12:80 172.16.11.11:2559 ESTAB 95 1 in TCP 21 172.16.11.11:2555 21.21.21.21:80 ESTAB 8 1 out TCP 20 21.21.21.11:80 172.16.11.11:2555 ESTAB 11 1 in TCP 21 172.16.11.11:2692 21.21.21.21:80 ESTAB 55 1 out TCP 20 21.21.21.11:80 172.16.11.11:2692 ESTAB 63 1 in TCP 21 172.16.11.11:2534 21.21.21.21:80 ESTAB 12 1 out TCP 20 21.21.21.12:80 172.16.11.11:2534 ESTAB 41 1 in TCP 21 172.16.11.11:2601 21.21.21.21:80 ESTAB 13 1 out TCP 20 21.21.21.11:80 172.16.11.11:2601 ESTAB 14 1 in TCP 21 172.16.11.11:2683 21.21.21.21:80 ESTAB 109 1 out TCP 20 21.21.21.11:80 172.16.11.11:2683 ESTAB 15 1 in TCP 21 172.16.11.11:2699 21.21.21.21:80 ESTAB 141 1 out TCP 20 21.21.21.12:80 172.16.11.11:2699 ESTAB 16 1 in TCP 21 172.16.11.11:2740 21.21.21.21:80 ESTAB 177 1 out TCP 20 21.21.21.11:80 172.16.11.11:2740 ESTAB 17 1 in TCP 21 172.16.11.11:2681 21.21.21.21:80 ESTAB 이하 생략…
How to Test Scenario Realserver Stress 및 LB 확인 ACE/B_Group# sh serverfarm Web-Server serverfarm : Web-Server, type: HOST total rservers : 2 --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- rserver: Server11 21.21.21.11:0 8 OPERATIONAL 82 396 rserver: Server12 21.21.21.12:0 8 OPERATIONAL 88 392 ACE/B_Group# sh rserver Server12 rserver : Server12, type: HOST state : OPERATIONAL serverfarm: Web-Server 21.21.21.12:0 8 OPERATIONAL 1 404
FWSM/ACE Design II FWSM Transparent Mode & ACE Routed Mode
FWSM Transparent & ACE Routed B V10 V11 V12 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 Server A 10.10.10.11 Server B 10.10.10.12 F9/1 OSPF Area0 RSTP 11.11.11.254 Clent: 11.11.11.1 Server 10.10.10.1 VIP 11.11.11.11 BVI 11.11.11.12 Trunk V20,21,22,99,198,199 172.16.3.254/1
FWSM Transparent & ACE Routed Design Key Point B V10 V11 V12 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 Server A 10.10.10.11 Server B 10.10.10.12 F9/1 OSPF Area0 RSTP 11.11.11.254 Clent: 11.11.11.1 Server 10.10.10.1 VIP 11.11.11.11 BVI 11.11.11.12 Trunk V20,21,22,99,198,199 172.16.3.254/1 TP Routed 1 Easy Migration FWSM 은 TP모드로 사용 중이므로, IP or 물리적인 Design 변경이 적음. 2 Design의 유연성 강화 FWSM의 Multipair Bridge 기능을 통해, 다양한 서브넷 구성 가능 -ACE의 경우 기본 5개의 Virtual Context가 제공되므로, FWSM의 Virtual context가 부족할 경우, Multi Pair Bridge Mode 통해 대체 효과 3 L4 Switch를 기존에 사용 중일 경우 유리 - 대부분 L4 Switch를 사용 중일 경우 Routed Mode로 운용 중이므로, 기존의 IP Address 체계를 그대로 유지하여 Migration 할 경우 매우 유리
FWSM Transparent & ACE Routed Sup720 svclc multiple-vlan-interfaces svclc module 6 vlan-group 2,4 svclc vlan-group 2 10-12 ACE,FWSM에서 사용되고 있는 Inside,Outside,Client,Server Vlan 설정 svclc vlan-group 4 99,198,199 ACE Failover Tracking Vlan을 위한 Vlan 99, FWSM Failover,Stateful FO를 위한 Vlan 198,199 설정 FWSM 구성 firewall multiple-vlan-interfaces firewall module 7 vlan-group 2,4
FWSM Transparent & ACE Routed Sup720 HSRP 구성 Cat 6500-A interface Vlan12 ip address 11.11.11.253 255.255.255.0 standby 2 ip 11.11.11.254 standby 2 priority 200 standby 2 preempt Cat 6500-B ip address 11.11.11.252 255.255.255.0 B V10 V11 V12 F9/1 RSTP VIP 11.11.11.11 Trunk V20,21,22,99, 198,199 11.11.11.254 Clent: 11.11.11.1 Server 10.10.10.1 BVI 11.11.11.12 MSFC와 FWSM/ACE 사이의 Internal HSRP 구성이므로, 물리적인 이슈로 인한 HSRP가 흔들릴 경우는 없다. 따라서 FWSM 모듈, Supervisor Engine 자체가 장애가 있지 않는 한 HSRP Interface Primary는 정해져 있다. 이 경우에는 되도록 Preempt를 지정해 두도록 한다.
FWSM Transparent & ACE Routed FWSM Virtual Context 구성 interface Vlan11 description =TP Mode - Inside= ! interface Vlan12 description =TP Mode - Outside= interface Vlan21 description =Routed Mode - Inside= interface Vlan22 description =Routed Mode - Outside= interface Vlan101 description =Admin - Inside= interface Vlan102 description =Admin - Outside= interface Vlan198 description LAN Failover Interface interface Vlan199 description STATE Failover Interface admin-context admin context admin allocate-interface Vlan101 allocate-interface Vlan102 config-url disk:/admin.cfg ! Admin VF(Virtual Firewall)을 위한 Interface 할당 Admin VF를 위한 Config 파일 저장 위치 지정 context A-Group allocate-interface Vlan11 allocate-interface Vlan12 config-url disk:/A-group.cfg A-Group VF를 위한 Interface 할당 A-Group VF를 위한 Config 파일 저장 위치 지정 context B-Group allocate-interface Vlan21 allocate-interface Vlan22 config-url disk:/B-group B-Group VF를 위한 Interface 할당 B-Group VF를 위한 Config 파일 저장 위치 지정
FWSM Transparent & ACE Routed FWSM F/O 구성 failover failover lan unit primary FWSM Unit의 Primary or Secondary를 선언 failover lan interface faillink Vlan198 Failover Interface Vlan 198 선언 failover polltime unit msec 500 holdtime 3 Polling Time, Hold Time 선언 failover replication http FO 발생시 HTTP 복제 선언 failover link statelink Vlan199 Stateful Failover Interface 선언 failover interface ip faillink 192.168.98.1 255.255.255.0 standby 192.168.98.2 FO Interface IP address 선언 failover interface ip statelink 192.168.99.1 255.255.255.0 standby 192.168.99.2 Stateful FO Interface IP Address 선언
FWSM Transparent & ACE Routed FWSM Basic Config interface Vlan11 nameif inside security-level 100 bridge-group 1 ! Inside Interface 구성 interface Vlan12 nameif outside security-level 0 bridge-group 1 ! Outside Interface 구성 access-list permit extended permit ip any any access-list bpdu ethertype permit bpdu ACL Rule 설정 / Bridge Mode 이므로 BPDU를 허가 access-group bpdu in interface inside access-group permit in interface inside access-group bpdu in interface outside access-group permit in interface outside ! Interface별 ACL 할당 route outside 0.0.0.0 0.0.0.0 11.11.11.254 1 이하 생략… 11.11.11.254 V12 BVI 11.11.11.12 Clent: 11.11.11.1 V11 Server 10.10.10.1 V10 F9/1
FWSM Transparent & ACE Routed ACE Virtual Partition 구성 context A_Group allocate-interface vlan 10-11 ! A_Group Context 선언 및 Interface Vlan 10,11 할당 context B_Group allocate-interface vlan 20-21 A_Group Context 선언 및 Interface Vlan 10,11 할당 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ACE Failover Interface 지정 ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 ft Peer 간 heartbeat Interval과 counte 선언
FWSM Transparent & ACE Routed ACE FT - Failover Group 구성 ft group 1 peer 1 no preempt priority 200 associate-context Admin inservice Ft group 별 priority 지정과 Context 선언 ft group 2 associate-context A_Group ft group 3 associate-context B_Group ft group #1 ft group #2 ft group #3 Tip !!! ft group별로 해당 Priority를 차등화 하여 구성할 경우 ACE Module 을 Loadsharing 하는 효과를 누릴 수 있으며, 디자인에 따라 Active/Active, Active/Standby 형태로 구성이 가능하다. 단, FWSM의 Active/Active 형태와는 다른 방식으로 동일 Context간 Session을 공유하여 Traffic이 동시에 흐르는 형태는 아니다.
FWSM Transparent & ACE Routed ACE FT - Failover Group 구성 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 heartbeat interval Millisecond 단위 Heartbeat count 10 Hearbeat count 숫자 위의 예제에서는 Heartbeat interval * Heartbeat count = 1Sec 가 된다. Ft interface Vlan 99 ft group #1 ft group #2 ft group #3
FWSM Transparent & ACE Routed ACE Basic Config – RealServer 구성 rserver host Server11 ip address 10.10.10.11 inservice rserver host Server12 ip address 10.10.10.12
FWSM Transparent & ACE Routed ACE Basic Config – ServerFarm 구성 RealServer RealServer ServerFarm serverfarm host Web-Server rserver Server11 inservice rserver Server12
FWSM Transparent & ACE Routed ACE Basic Config – SLB Policy Map 구성 RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB predictor roundrobin class class-default serverfarm Web-Server
FWSM Transparent & ACE Routed ACE Basic Config – Server VIP 구성 Class-map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match p-slb class class-default serverfarm HTTP-Server class-map match-all Web-Server-VIP 2 match virtual-address 11.11.11.11 tcp eq www
FWSM Transparent & ACE Routed ACE Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match slb class class-default serverfarm HTTP-Server class-map match-all Web-Server-VIP 2 match virtual-address 11.11.11.11 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB
FWSM Transparent & ACE Routed ACE Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer Interface ACL & Service Policy 적용 RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm HTTP-Server class-map match-all Web-Server-VIP 2 match virtual-address 11.11.11.11 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB access-list anyone extended permit ip any any interface vlan 11 access-group input anyone service-policy input match-www
FWSM Transparent & ACE Routed ACE Basic Config – L7 RealServer 구성 rserver host Server11 ip address 11.11.11.11 inservice rserver host Server12 ip address 11.11.11.12 rserver host Server13 ip address 11.11.11.13 inservice rserver host Server14 ip address 11.11.11.14
FWSM Transparent & ACE Routed ACE Basic Config – L7 ServerFarm 구성 RealServer ACE RealServer serverfarm host Web-Server predictor roundrobin rserver Server11 inservice rserver Server12 serverfarm host URL-Server rserver Server13 inservice rserver Server14
FWSM Transparent & ACE Routed ACE Basic Config – L7 SLB Policy Map 구성 RealServer Class-map L3/L4 Policy map LB Policy map ACE RealServer Class-map policy-map type loadbalance first-match SLB class class-default serverfarm HTTP-Server class-map match-all Web-Server-VIP 2 match virtual-address 11.11.11.11 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB class-map type http loadbalance match-any URL_contents 2 match http url .*\.php
FWSM Transparent & ACE Routed ACE Basic Config – L7 SLB Policy Map 구성 RealServer LB Policy map ACE Class-map Class-map L3/L4 Policy map LB Policy map RealServer policy-map type loadbalance first-match SLB class class-default serverfarm HTTP-Server class URL_contenst serverfarm URL-Server class-map match-all Web-Server-VIP 2 match virtual-address 11.11.11.11 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB class-map type http loadbalance match-any URL_contents 2 match http url .*\.php
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #1 RealServer ACE Probe-A Probe-B RealServer probe http http-probe request method get url /index.html expect status 200 200 probe icmp icmp-probe rserver host Server11 ip address 10.10.10.11 probe http-probe inservice rserver host Server12 ip address 10.10.10.12 inservice serverfarm host Web-Server probe icmp-probe rserver Server11 inservice rserver Server12
Serverfarm Web-Server FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #2 Serverfarm Web-Server Icmp probe rserver host Server11 ip address 10.10.10.11 probe html-probe inservice rserver host Server12 ip address 10.10.10.12 inservice serverfarm host Web-Server probe icmp-probe rserver Server11 rserver Server12 rserver S11 rserver S12 HTTP probe Tip !!! 구성 예제와 같이 real server S11 에 별도의 HTTP Probe를 지정하고, real server S11 이 속하게 되는 Serverfam Web-Server에 ICMP-Probe를 지정하게 되는 경우에는, rserver S11 은 icmp-probe, http-probe 어느 하나라도 Fail이 발생할 경우에 Server의 Service에서 제거 된다. 따라서 매우 중요한 Real Service는 두개 이상의 Probe를 지정해 두는 것도 하나의 Tip 이 될 수 있다.
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #3 ACE/A_Group# sh probe probe : http-probe type : HTTP, state : ACTIVE ---------------------------------------------- port : 80 address : 0.0.0.0 addr type : - interval : 2 pass intvl : 2 pass count : 5 fail count: 10 recv timeout: 1 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- rserver : S11 10.10.10.11 4 0 4 SUCCESS probe : icmp-probe type : ICMP, state : ACTIVE port : 0 address : 0.0.0.0 addr type : - serverfarm : Web-Server real : S11[0] 10.10.10.11 63 0 63 SUCCESS real : S12[0] 10.10.10.12 99 0 99 SUCCESS
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #4 1 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe <probe-type> <probe-name> dns, echo, finger, ftp, http, https,icmp ,imap, pop, radius, probe, scripted, smtp ,tcp, telnet, udp 다양한 Protocol 별 Probe 기능과 Script 기반의 Probe 기능을 지원하고 있음. 2 port <port-number> TCP/UDP 의 특정 서비스 포트에 대해 Probe를 지정할 수 있음
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #5 3 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp icmp-probe description ICMP-Probe interval 2 faildetect 10 passdetect interval 2 passdetect count 5 receive 1 Interval Interval은 Probe를 주기적으로 Check하는 시간을 의미한다. 예제의 경우에는 2초에 한번씩 Check. faildetect faildetect Count는 Probe Check 시 특정 Count에 Fail이 Count 되면 Server, real Server를 Fail 로 간주하게 된다. 예제의 경우에는 10번의 Fail이 Count되면, Fail로 처리하겠다는 의미 Receive ACE가 Probe 를 해당 Server에 보내고 기다리는 시간을 의미한다. 예제에서는 1초간 기다리겠다는 의미이다. Tip !!! 구성 예제의 결과를 보면 결국 Fail 되는 총시간은 interval * faildetect * receive 가 된다. 따라서 위의 세개의 값을 세밀하게 계산하여, Fail Server를 선택하는 것이 매우 중요하다.
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #6 4 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp icmp-probe description ICMP-Probe interval 2 faildetect 10 passdetect interval 2 passdetect count 5 receive 1 passdetect interval Server 가 Fail 된 후 복구 되기 위해, 주기적으로 다시 Probe를 보내는 주기를 의미한다. 예제에서는 2초에 한번씩 Probe를 보내게 된다. Passdetect count Server 가 Fail 된 후 복구되기 위한 성공적인 Probe Count를 의미한다. 예제에서는 5개의 성공 Probe 결과를 받았을 때 서비스를 재개 하겠다는 의미 Tip !!! 구성 예제의 결과를 보면 결국 Server가 Fail된 후 정상 복구 된다고 하더라도, intervla * count가 되므로, 정상 복구 후 10Sec 이후에 실제 정상 서비스가 된다는 의미 이다.
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #7 ACE/A_Group# sh probe icmp-probe probe : icmp-probe type : ICMP, state : ACTIVE ---------------------------------------------- port : 0 address : 0.0.0.0 addr type : - interval : 2 pass intvl : 2 pass count : 5 fail count: 10 recv timeout: 1 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- serverfarm : Web-Server real : S11[0] 10.10.10.11 102 0 102 SUCCESS real : S12[0] 10.10.10.12 139 0 139 SUCCESS
FWSM Transparent & ACE Routed ACE Basic Config – Health Monitoring(Probe) #8 ACE/A_Group# sh probe icmp-probe detail probe : icmp-probe type : ICMP, state : ACTIVE description : ICMP-Probe ---------------------------------------------- port : 0 address : 0.0.0.0 addr type : - interval : 2 pass intvl : 2 pass count : 5 fail count: 10 recv timeout: 1 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- serverfarm : Web-Server real : S11[0] 10.10.10.11 115 0 115 SUCCESS Socket state : CLOSED No. Passed states : 1 No. Failed states : 0 No. Probes skipped : 0 Last status code : 0 No. Out of Sockets : 0 No. Internal error: 0 Last disconnect err : - Last probe time : Sat Jul 7 09:11:33 2007 Last fail time : Never Last active time : Sat Jul 7 09:07:45 2007 이하 생략….
FWSM Transparent & ACE Routed ACE Basic Config – ACE Routed 구성/FWSM Bridge 구성 Bridge BVI RealServer V12 V11 V10 RealServer ServerFarm interface vlan 10 description "Server Vlan" ip address 10.10.10.2 255.255.255.0 alias 10.10.10.1 255.255.255.0 peer ip address 10.10.10.3 255.255.255.0 service-policy input mgmt no shutdown interface vlan 11 ip address 11.11.11.2 255.255.255.0 alias 11.11.11.1 255.255.255.0 peer ip address 11.11.11.3 255.255.255.0 access-group input anyone service-policy input match-www service-policy input mgmt no shutdown Tip !!! Alias 명령을 통해 , ACE는 마치 HSRP 구성처럼 Virtual G.W IP address를 소유하게 된다. 즉, Realserver의 G.W는 Primary,Secondary가 공통으로 가지고 있는 Alias IP 가 된다.
FWSM Transparent & ACE Routed ACE Basic Config – ACE Routed 구성/FWSM Bridge 구성 Bridge BVI RealServer V12 V11 V10 RealServer ServerFarm interface Vlan11 nameif inside bridge-group 1 security-level 100 interface Vlan12 nameif outside bridge-group 1 security-level 0 ! interface BVI1 ip address 11.11.11.12 255.255.255.0 Tip !!! Bridge Mode 구성은 FWSM/ACE와 동일한 구조를 가지고 있다. 다만 Bridge Mode 구성시에는 STP Issue에 대한 Design을 사전에 반드시 점검하여야 한다.
FWSM Transparent & ACE Routed ACE Basic Config – Management Policy 구성 Class-map L3/L4 Policy map RealServer RealServer ServerFarm class-map type management match-any mgmt 2 match protocol icmp any 3 match protocol telnet any 4 match protocol ssh any policy-map type management first-match mgmt class c-mgmt permit interface vlan 11 service-policy input p-mgmt interface vlan 10 RealServer가 G.W로 icmp를 허용하기 위해서, 허용한다.
FWSM Transparent & ACE Routed ACE Monitoring – Basic ACE Basic Review DC_BB-A#sh asic-version slot 6 Module in slot 6 has 2 type(s) of ASICs ASIC Name Count Version HYPERION 1 (5.0) SSA 1 (8.0) FWSM DC_BB-A#sh asic-version slot 7 Module in slot 7 has 2 type(s) of ASICs ASIC Name Count Version PINNACLE 2 (4.2) MEDUSA 1 (2.0) ACE는 기존 FWSM,CSM과 같이 Multi Gigabit Etherchannel을 쓰는 방식이 아니라, single 10G Interface가 접속되어 있는 형태이다. DC_BB-A#sh interfaces tenGigabitEthernet 6/1 status Port Name Status Vlan Duplex Speed Type Te6/1 connected trunk full 10G MultiService Module DC_BB-A#sh interfaces tenGigabitEthernet 6/1 counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Te6/1 3900088 35250 18058 450 Port OutOctets OutUcastPkts OutMcastPkts OutBcastPkts Te6/1 5555729 79198 2240 1640
FWSM Transparent & ACE Routed ACE Monitoring – svclc DC_BB-A#show svclc vlan-group Display vlan-groups created by both ACE module and FWSM commands Group Created by vlans ----- ---------- ----- 1 ACE 100-102 2 ACE 10-12 3 ACE 20-22 4 ACE 99,198-199 DC_BB-A#show svclc module Module Vlan-groups ------ ----------- 06 1,2,3,4 DC_BB-A#show interfaces tenGigabitEthernet 6/1 trunk Port Mode Encapsulation Status Native vlan Te6/1 on 802.1q trunking 1 Port Vlans allowed on trunk Te6/1 10-12,20-22,99-102,198-199 Port Vlans allowed and active in management domain Port Vlans in spanning tree forwarding state and not pruned
FWSM Transparent & ACE Routed ACE Monitoring – ARP Table ACE/A_Group# sh arp Context A_Group ================================================================================ IP ADDRESS MAC-ADDRESS Interface Type Encap NextArp(s) Status 10.10.10.1 00.0b.fc.fe.1b.02 vlan10 ALIAS LOCAL _ up 10.10.10.2 00.19.06.27.d9.01 vlan10 INTERFACE LOCAL _ up 10.10.10.11 00.10.c6.c0.01.55 vlan10 RSERVER 15 39 sec up 10.10.10.12 00.0d.60.60.b1.20 vlan10 RSERVER 16 39 sec up 10.10.10.13 00.00.00.00.00.00 vlan10 RSERVER - dn 10.10.10.14 00.00.00.00.00.00 vlan10 RSERVER - dn 11.11.11.252 00.d0.00.b8.08.00 vlan11 LEARNED 13 11305 sec up 11.11.11.253 00.0e.d6.e4.8c.00 vlan11 LEARNED 14 11307 sec up 11.11.11.254 00.00.0c.07.ac.02 vlan11 GATEWAY 12 58 sec up 11.11.11.1 00.0b.fc.fe.1b.02 vlan11 ALIAS LOCAL _ up 11.11.11.2 00.19.06.27.d9.01 vlan11 INTERFACE LOCAL _ up 11.11.11.11 00.0b.fc.fe.1b.02 vlan11 VSERVER LOCAL _ up Total arp entries 12
FWSM Transparent & ACE Routed ACE Monitoring – Routing Table Routing Table for Context A_Group (RouteId 1) Codes: H - host, I - interface S - static, N - nat A - need arp resolve, E - ecmp Destination Gateway Interface Flags ------------------------------------------------------------------------ 0.0.0.0 11.11.11.254 vlan11 S 11.11.11.0/24 0.0.0.0 vlan11 IA 10.10.10.0/24 0.0.0.0 vlan10 IA Total route entries = 3
FWSM Transparent & ACE Routed ACE Monitoring – Real Server Monitoring ACE/A_Group# sh rserver S11 rserver : S11, type: HOST state : OPERATIONAL --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: Web-Server 10.10.10.11:0 8 OPERATIONAL 0 0 == Real Server 접속 불가 == ACE/A_Group# sh rserver S12 rserver : S12, type: HOST state : OPERATIONAL --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: Web-Server 10.10.10.12:0 8 PROBE-FAILED 0 0
FWSM Transparent & ACE Routed ACE Monitoring – Service Policy Monitoring ACE/A_Group# sh service-policy match-www detail Status : ACTIVE Description: - ----------------------------------------- Interface: vlan 11 service-policy: match-www class: Web-Server-VIP VIP Address: Port: 11.11.11.11 eq 80 loadbalance: L7 loadbalance policy: SLB VIP Route Metric : 77 VIP Route Advertise : DISABLED VIP ICMP Reply : ENABLED VIP State: INSERVICE curr conns : 0 , hit count : 4 dropped conns : 0 client pkt count : 170 , client byte count: 34199 server pkt count : 171 , server byte count:26224 L7 Loadbalance policy : SLB class/match : URL_Contents LB action : serverfarm: URL-Server hit count : 0 dropped conns : 0 class/match : class-default serverfarm: Web-Server hit count : 4
FWSM Transparent & ACE Routed Failover Scenario 1 Server Switch Primary Link 단절 Session State 유지 Ping Losss 1개 이내. RSTP에 의해 msec 단위 Take Over 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 4 172.16.3.254/1 11.11.11.254 2 ACE Primary 장애 Session State 유지 Ping Losss 1개 이내. ACE FT 기법을 통한 msec 단위 Take Over 구성 가능 V12 V12 BVI 11.11.11.12 Trunk V20,21,22,99,198,199 3 Clent: 11.11.11.1 V11 V11 2 Server 10.10.10.1 V10 VIP 11.11.11.11 V10 RSTP 3 FWSM 장애 Session State 유지 Ping Losss 1개 이내. FWSM Stateful F/O 기법을 통한 msec 단위 Take Over 구성 가능 F9/1 1 F9/1 Server A 10.10.10.11 Server B 10.10.10.12
FWSM Transparent & ACE Routed Failover Scenario 4 Primary 6500 장애 또는 Router Uplink 단절 Session State 유지 또는 빠른 우회 경로 확보 Ping Losss 1개 이내. Fast OSPF 구현을 통한 빠른 우회경로 확보 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 4 172.16.3.254/1 11.11.11.254 V12 V12 BVI 11.11.11.12 Trunk V20,21,22,99,198,199 3 OSPF Tuning ip ospf dead-interval minimal hello-multiplier 20 router os 1 timers throttle spf 300 10000 30000 timers throttle lsa all 200 2000 10000 Clent: 11.11.11.1 V11 V11 2 Server 10.10.10.1 V10 VIP 11.11.11.11 V10 RSTP F9/1 1 F9/1 Server A 10.10.10.11 Server B 10.10.10.12
FWSM/ACE Design III FWSM Multi pair Bridge & ACE Routed Mode
FWSM MultiPair Bridge & ACE Routed Mode Design Key Point 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 V21 V22 Server A 10.10.10.11 Server B 10.10.10.12 F9/1 OSPF Area0 RSTP 21.21.21.254 Clent: 21.21.21.1 Server 40.40.40.1 VIP 21.21.21.21 VIP 41.41.41.41 BVI 1 21.21.21.12 Trunk V20,21,22,40,41,42,,99,198,199 172.16.3.254/1 V20 V41 V42 V40 F9/2 41.41.41.254 BVI 2 41.41.41.12 Clent: 41.41.41.1
FWSM MultiPair Bridge & ACE Routed Mode Design Key Point 1 Easy Migration FWSM 은 TP모드로 사용 중이므로, IP or 물리적인 Design 변경이 적음. B 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 V21 V22 Server A 10.10.10.11 Server B 10.10.10.12 F9/1 OSPF Area0 RSTP 21.21.21.254 Clent: 21.21.21.1 Server 40.40.40.1 VIP 21.21.21.21 VIP 41.41.41.41 BVI 1 21.21.21.12 Trunk V20,21,22,40,41,42,,99,198,199 172.16.3.254/1 V20 V41 V42 V40 F9/2 41.41.41.254 BVI 2 41.41.41.12 Clent: 41.41.41.1 2 Design의 유연성 강화 FWSM의 Multipair Bridge 기능을 통해, 다양한 서브넷 구성 가능 -ACE의 경우 기본 5개의 Virtual Context가 제공되므로, FWSM의 Virtual context가 부족할 경우, Multi Pair Bridge Mode 통해 대체 효과 3 ACE 5개의 기본 Virtual Context를 최대한 사용 가능 - ACE의 Virtual Context 5개와 연동되는 Firewall의 Virtual Context 3개에 대한 부족분을 Multipair Bridge를 사용하여 확장 가능
FWSM MultiPair Bridge & ACE Routed Mode Design Key Point Outside 1 ~8 Outside 1 ~8 Outside 1 ~8 FWSM Admin Context A Context B Inside 1 ~8 Inside 1 ~8 Inside 1 ~8 FWSM MultiPair Bridge Mode는 최대 8개의 Inside / Ouside 를 구성할 수 있는 유연성 높은 구성 방법이다. ACE와 연동 할 경우, ACE가 가지고 있는 최대 Virtual Context를 연동하여, FWSM의 부족한 Virtual Context를 채울 수 있다. 실제 Admin Context와 두개의 추가 기본 Context를 모두 MultiPair Bridge Mode로 구성할 경우, 32개의 In/Outside Interface를 구성할 수 있다.
FWSM MultiPair Bridge & ACE Routed Mode Sup720 svclc multiple-vlan-interfaces svclc module 6 vlan-group 2,4,40 svclc vlan-group 2 10-12 svclc vlan-group 40 40-43 ACE,FWSM에서 사용되고 있는 Inside,Outside,Client,Server Vlan 설정 svclc vlan-group 4 99,198,199 ACE Failover Tracking Vlan을 위한 Vlan 99, FWSM Failover,Stateful FO를 위한 Vlan 198,199 설정 FWSM 구성 firewall multiple-vlan-interfaces firewall module 7 vlan-group 2,4,40
FWSM MultiPair Bridge & ACE Routed Mode Sup720 HSRP 구성 Cat 6500-A interface Vlan42 ip address 41.41.41.253 255.255.255.0 standby 41 ip 41.41.41.254 standby 41 priority 200 standby 41 preempt interface Vlan22 ip address 21.21.21.253 255.255.255.0 standby 3 ip 21.21.21.254 standby 3 priority 200 standby 3 preempt 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 172.16.3.254/1 21.21.21.254 V22 V42 V22 41.41.41.254 V42 BVI 1 21.21.21.12 BVI 2 41.41.41.12 V21 V41 V21 V41 Clent: 21.21.21.1 Trunk V20,21,22,40,41,42,,99,198,199 Clent: 41.41.41.1 Server 40.40.40.1 Server 40.40.40.1 V20 V40 V20 V40 FWSM 이 MultiPair 구성으로 동작하므로, FWSM에서는 다중 Bridge Group 이 생성 된다. 따라서 MSFC는 FWSM에서 구성된 BVI와 연결되는 Interface Vlan을 다중으로 구성하고, HSRP Interface 속성 지정을 한다. 마찬가지로 Preempt 지정을 통해 내부 Link가 흔들리는 일이 없도록 한다.
FWSM MultiPair Bridge & ACE Routed Mode FWSM Virtual Context 구성 interface Vlan21 ! interface Vlan22 interface Vlan41 interface Vlan42 interface Vlan198 description LAN Failover Interface interface Vlan199 description STATE Failover Interface admin-context admin context admin allocate-interface Vlan101 allocate-interface Vlan102 config-url disk:/admin.cfg ! Admin VF(Virtual Firewall)을 위한 Interface 할당 Admin VF를 위한 Config 파일 저장 위치 지정 context B-G allocate-interface Vlan21 allocate-interface Vlan22 allocate-interface Vlan41 allocate-interface Vlan42 config-url disk:/B-G.cfg! A-Group VF를 위한 Interface 할당 A-Group VF를 위한 Config 파일 저장 위치 지정 Multi pair Vlan 에 속하게 되는 Vlan들이 하나의 Context에 모두 속하게 된다.
FWSM MultiPair Bridge & ACE Routed Mode FWSM F/O 구성 failover failover lan unit primary FWSM Unit의 Primary or Secondary를 선언 failover lan interface faillink Vlan198 Failover Interface Vlan 198 선언 failover polltime unit msec 500 holdtime 3 Polling Time, Hold Time 선언 failover replication http FO 발생시 HTTP 복제 선언 failover link statelink Vlan199 Stateful Failover Interface 선언 failover interface ip faillink 192.168.98.1 255.255.255.0 standby 192.168.98.2 FO Interface IP address 선언 failover interface ip statelink 192.168.99.1 255.255.255.0 standby 192.168.99.2 Stateful FO Interface IP Address 선언
FWSM MultiPair Bridge & ACE Routed Mode FWSM Basic Config interface Vlan21 nameif inside1 bridge-group 1 security-level 100 ! interface Vlan22 nameif outside1 security-level 0 interface Vlan41 nameif inside2 bridge-group 2 interface Vlan42 nameif outside2 172.16.2.1 F1/48, V2 V21 V22 21.21.21.254 Clent: 21.21.21.1 Server 40.40.40.1 BVI 1 21.21.21.12 V20 V41 V42 V40
FWSM MultiPair Bridge & ACE Routed Mode FWSM Basic Config interface BVI1 ip address 21.21.21.12 255.255.255.0 standby 21.21.21.13 ! interface BVI2 ip address 41.41.41.12 255.255.255.0 standby 41.41.41.13 icmp permit any inside1 icmp permit any outside1 icmp permit any inside2 icmp permit any outside2 access-group bpdu in interface inside1 access-group permit in interface inside1 access-group bpdu in interface outside1 access-group permit in interface outside1 access-group bpdu in interface inside2 access-group permit in interface inside2 access-group bpdu in interface outside2 access-group permit in interface outside2 172.16.2.1 F1/48, V2 V21 V22 21.21.21.254 Clent: 21.21.21.1 Server 40.40.40.1 BVI 1 21.21.21.12 V20 V41 V42 V40
FWSM MultiPair Bridge & ACE Routed Mode ACE Virtual Partition 구성 context B-Group allocate-interface vlan 20-21 ! B_Group Context 선언 및 Interface Vlan 20,21 할당 context C-Group allocate-interface vlan 40-41! C_Group Context 선언 및 Interface Vlan 40,41 할당 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ACE Failover Interface 지정 ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 ft Peer 간 heartbeat Interval과 counte 선언
FWSM MultiPair Bridge & ACE Routed Mode ACE FT - Failover Group 구성 ft group 3 peer 1 no preempt priority 200 associate-context B-Group inservice Ft group 별 priority 지정과 Context 선언 ft group 4 associate-context C-Group inservice ft group #1 ft group #2 ft group #3 Tip !!! ft group별로 해당 Priority를 차등화 하여 구성할 경우 ACE Module 을 Loadsharing 하는 효과를 누릴 수 있으며, 디자인에 따라 Active/Active, Active/Standby 형태로 구성이 가능하다. 단, FWSM의 Active/Active 형태와는 다른 방식으로 동일 Context간 Session을 공유하여 Traffic이 동시에 흐르는 형태는 아니다.
FWSM Transparent & ACE Routed ACE FT - Failover Group 구성 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 heartbeat interval Millisecond 단위 Heartbeat count 10 Hearbeat count 숫자 위의 예제에서는 Heartbeat interval * Heartbeat count = 1Sec 가 된다. Ft interface Vlan 99 ft group #1 ft group #2 ft group #3
FWSM Transparent & ACE Routed ACE Basic Config – RealServer 구성 rserver host Server11 ip address 20.20.20.11 inservice rserver host Server12 ip address 20.20.20.12
FWSM Transparent & ACE Routed ACE Basic Config – ServerFarm 구성 RealServer RealServer ServerFarm serverfarm host Web-Server probe ICMP-PROBE rserver Server11 inservice rserver Server12
FWSM Transparent & ACE Routed ACE Basic Config – SLB Policy Map 구성 RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server
FWSM Transparent & ACE Routed ACE Basic Config – Server VIP 구성 Class-map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server class-map match-all Web-VIP-21 2 match virtual-address 21.21.21.21 tcp eq www
FWSM Transparent & ACE Routed ACE Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server class-map match-all Web-VIP-21 2 match virtual-address 21.21.21.21 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB
FWSM Transparent & ACE Routed ACE Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer Interface ACL & Service Policy 적용 RealServer ServerFarm policy-map type loadbalance first-match SLB class class-default serverfarm Web-Server class-map match-all Web-VIP-21 2 match virtual-address 21.21.21.21 tcp eq www policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB access-list anyone extended permit ip any any interface vlan 11 access-group input anyone service-policy input match-www
FWSM Transparent & ACE Routed ACE Basic Config – L7 RealServer 구성 rserver host Server11 ip address 11.11.11.11 inservice rserver host Server12 ip address 11.11.11.12 rserver host Server13 ip address 11.11.11.13 inservice rserver host Server14 ip address 11.11.11.14
FWSM Transparent & ACE Routed ACE Basic Config – L7 ServerFarm 구성 RealServer ACE RealServer serverfarm host Web-Server predictor roundrobin rserver Server11 inservice rserver Server12 serverfarm host URL-Server rserver Server13 inservice rserver Server14
FWSM Transparent & ACE Routed ACE Basic Config – Management Policy 구성 Class-map L3/L4 Policy map RealServer RealServer ServerFarm class-map type management match-any mgmt 2 match protocol icmp any 3 match protocol telnet any 4 match protocol ssh any policy-map type management first-match mgmt class c-mgmt permit interface vlan 21 service-policy input p-mgmt interface vlan 20 RealServer가 G.W로 icmp를 허용하기 위해서, 허용한다.
FWSM Transparent & ACE Routed Failover Scenario B 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 V21 V22 Server A 10.10.10.11 Server B 10.10.10.12 F9/1 OSPF Area0 RSTP 21.21.21.254 Clent: 21.21.21.1 Server 40.40.40.1 VIP 21.21.21.21 VIP 41.41.41.41 BVI 1 21.21.21.12 Trunk V20,21,22,40,41,42,,99,198,199 172.16.3.254/1 V20 V41 V42 V40 F9/2 41.41.41.254 BVI 2 41.41.41.12 Clent: 41.41.41.1 1 Server Switch Primary Link 단절 Session State 유지 Ping Losss 1개 이내. RSTP에 의해 msec 단위 Take Over 4 2 ACE Primary 장애 Session State 유지 Ping Losss 1개 이내. ACE FT 기법을 통한 msec 단위 Take Over 구성 가능 3 2 3 1 FWSM 장애 Session State 유지 Ping Losss 1개 이내. FWSM Stateful F/O 기법을 통한 msec 단위 Take Over 구성 가능
FWSM Transparent & ACE Routed Failover Scenario B 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 V21 V22 Server A 10.10.10.11 Server B 10.10.10.12 F9/1 OSPF Area0 RSTP 21.21.21.254 Clent: 21.21.21.1 Server 40.40.40.1 VIP 21.21.21.21 VIP 41.41.41.41 BVI 1 21.21.21.12 Trunk V20,21,22,40,41,42,,99,198,199 172.16.3.254/1 V20 V41 V42 V40 F9/2 41.41.41.254 BVI 2 41.41.41.12 Clent: 41.41.41.1 4 Primary 6500 장애 또는 Router Uplink 단절 Session State 유지 또는 빠른 우회 경로 확보 Ping Losss 1개 이내. Fast OSPF 구현을 통한 빠른 우회경로 확보 4 3 OSPF Tuning ip ospf dead-interval minimal hello-multiplier 20 router os 1 timers throttle spf 300 10000 30000 timers throttle lsa all 200 2000 10000 2 1
ACE DSR Mode
ACE DSR Mode 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 172.16.3.254/1 50.50.50.254 Trunk V20,21,22,99,198,199 V50 V50 Server 50.50.50.1 VIP 55.55.55.55 RSTP F9/1 F9/1 B Server A eht1 : 50.50.50.11 Eth1:1 55.55.55.55 Server B 50.50.50.12 Eth1:1 55.55.55.55
ACE DSR Mode 동작원리 1 2 3 Supervisor 에서 Static Routing 172.16.1.1 F1/48, V1 1.254 V10 Server A Eth1 : 50.50.50.11 Eth1:1 55.55.55.55 50.50.50.254 Server 50.50.50.1 VIP 55.55.55.55 Defualt G.W 변경 1 Supervisor 에서 Static Routing VIP의 목적지를 Server Vlan G.W 로 Static Routing 강제 설정 2 ACE에서는 별도의 Client Side가 존재하지 않음 Virtual IP만 설정 Real Server에서는 Virtual Interface를 설정하고, Default G.W는 MSFC가 되도록 한다. 3 성능 향상 & 보안 취약 모든 Connection을 관리하지 않아도 되는 장점 보안에 대한 장점은 전혀 없음 상단에 FWSM과 연계할 경우에도 TCP Flow에 대한 문제점 발생 가능성이 높음 FWSM 3.2에서 Flow별 TCP State Bypass 기능올 통해 통과 할 수 있음
ACE DSR Mode Sup720 Sup720 구성 ACE 구성 svclc multiple-vlan-interfaces svclc module 6 vlan-group 4,6 svclc vlan-group 6 50 ACE 에서 사용될 Server Vlan 설정 svclc vlan-group 4 99 ACE Failover Tracking Vlan을 위한 Vlan 99 ip route 55.55.55.55 255.255.255.255 50.50.50.1 DSR VIP로 직접 Static Routing 처리
ACE DSR Mode DSR Basic Config 172.16.1.1 F1/48, V1 1.254 V10 Server A Eth1 : 50.50.50.11 Eth1:1 55.55.55.55 50.50.50.254 Server 50.50.50.1 VIP 55.55.55.55 Defualt G.W 변경 rserver host S11 ip address 50.50.50.11 probe http-probe inservice rserver host S12 ip address 50.50.50.12 serverfarm host Web-Server transparent Transparent 기능을 통해 DSR을 구현 , NAT 사용하지 않음 rserver S11 rserver S12 class-map match-all Web-Server-VIP 3 match virtual-address 55.55.55.55 any VIP 가 Real Server의 Virtual Interface가 된다.
ACE DSR Mode DSR Basic Config 172.16.1.1 F1/48, V1 1.254 V10 Server A Eth1 : 50.50.50.11 Eth1:1 55.55.55.55 50.50.50.254 Server 50.50.50.1 VIP 55.55.55.55 Defualt G.W 변경 policy-map multi-match match-www class Web-Server-VIP loadbalance vip inservice loadbalance policy SLB loadbalance vip icmp-reply interface vlan 50 description "Server Vlan" ip address 50.50.50.2 255.255.255.0 alias 50.50.50.1 255.255.255.0 peer ip address 50.50.50.3 255.255.255.0 no normalization access-group input anyone service-policy input mgmt service-policy input match-www no shutdown ip route 0.0.0.0 0.0.0.0 50.50.50.254 Default 가 반드시 MSFC Vlan으로 향해야 한다. VIP 55.55.55.55
ACE DSR Mode DSR Basic Config 172.16.1.1 F1/48, V1 1.254 V10 Server A Eth1 : 50.50.50.11 Eth1:1 55.55.55.55 50.50.50.254 Server 50.50.50.1 VIP 55.55.55.55 Defualt G.W 변경 probe icmp icmp-probe interval 2 passdetect interval 2 passdetect count 10 receive 2 serverfarm host DSR-Server transparent predictor leastconns probe icmp-probe rserver S11 inservice rserver S12 inservice.
ACE DSR Mode How to DSR Test – Linux Virtual Interface 설정 172.16.1.1 F1/48, V1 1.254 V10 Server A Eth1 : 50.50.50.11 Eth1:1 55.55.55.55 50.50.50.254 Server 50.50.50.1 VIP 55.55.55.55 Defualt G.W 변경 1. Linux System에서 Virtual Interface 설정 ifconfig eth1:1 55.55.55.55 netmask 255.255.255.255 broadcast 50.50.50.255 up ip link set eth1:1 arp off 2. 모든 Routing은 ACE의 Alias G.W가 아니라, MSFC Vlan G.W로 향하게 한다. route add 0.0.0.0 gw 50.50.50.254 root@[etc]#netstat -nr Krenel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 50.50.50.254 255.255.255.255 UGH 0 0 0 eth1
ACE를 통한 10G FLB 구성 Standard Mode
ACE 기반의 FWSM FLB Design B 2.254 1.254 172.16.2.1 F1/48, V2 OSPF Area0 V33 / HSRP 33.254 172.16.3.254/1 ACE FLB Outside Client V33 / 33.1 Server V32 / 32.1 Trunk V30-34,99 Outside V32 / 32.253 Outside V32 / 32.254 Inside V31 / 31.253 Inside V31 / 31.254 ACE FLB Inside Client V31 / 31.1 Server V30 / 30.1 V30 / HSRP 30.254 B F9/1 RSTP F9/1 Server A 30.30.30.11 Server B 30.30.30.12
ACE 기반의 FWSM FLB Design Design Key Point 1 최적의 10G FLB 구현 가능 별도의 물리적인 복잡한 회선 구현 없이 Internal Link를 통해 10G 이상의 FLB Service 구현 가능 B 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 2.254 1.254 Server A 30.30.30.11 Server B 30.30.30.12 F9/1 OSPF Area0 RSTP Trunk V30-34,99 172.16.3.254/1 ACE FLB Outside ACE FLB Inside 2 디자인 확장성 높은 FLB 구현 가능 FWSM Virtual context와 ACE의 Virtual Partitioning 기능을 이용하여 여러 개의 FLB 서비스 구현 가능 3 안정성 극대화 다중 L2 Switch 구조를 제거 하고, 최적화된 RSTP,OSPF를 이용하여 빠른 우회 경로 확보 가능 Probe Point를 ACE Virtual Partitioning과 인접한 MSFC HSRP 포인트를 지정하여 더욱 신뢰도를 높임.
ACE 기반의 FWSM FLB Design Sup720 svclc multiple-vlan-interfaces svclc module 6 vlan-group 4,5 svclc vlan-group 4 99 svclc vlan-group 5 30-33 FWSM 구성 firewall multiple-vlan-interfaces firewall module 7 vlan-group 5
ACE 기반의 FWSM FLB Design Sup720 HSRP 구성 Cat 6500-A interface Vlan30 description "ACE-Inside-In" ip vrf forwarding ACE-Inside-Server ip address 30.30.30.253 255.255.255.0 standby 30 ip 30.30.30.254 standby 30 priority 200 standby 30 preempt interface Vlan33 description "ACE-Outside-Out" ip address 33.33.33.253 255.255.255.0 standby 33 ip 33.33.33.254 standby 33 priority 200 standby 33 preempt 172.16.1.1 F1/48, V1 172.16.2.1 F1/48, V2 Trunk V30-34,99 172.16.3.254/1 ACE FLB Outside ACE FLB Inside FLB 구성을 위해서는 하나의 ACE 모듈에서 두개의 Virtual Context가 서로 뒤집혀 있는 형태로 구성되게 된다. 특히 중요한 것은 두개의 Virtual Context간에 연결된 MSFC 연결 구조이다. Direct connected 되어 있으므로, FLB로 인입된 Traffic이 MSFC를 직접 흐르지 않도록 PBR 또는 VRF를 사용하여 , FLB Flow에 대한 주의가 필요하겠다.
ACE 기반의 FWSM FLB Design FWSM Basic Config – FWSM#A interface Vlan31 nameif inside security-level 100 ip address 31.31.31.254 255.255.255.0 ! interface Vlan32 nameif outside security-level 0 ip address 32.32.32.254 255.255.255.0 access-list permit extended permit ip any any ! icmp permit any outside icmp permit any inside access-group permit in interface outside access-group permit in interface inside route outside 0.0.0.0 0.0.0.0 32.32.32.1 1 route inside 30.30.30.0 255.255.255.0 31.31.31.1 1 172.16.1.1 F1/48, V1 FWSM은 FLB를 통해 운용 되므로, 모두 Active 이며 Failover 구조는 필요없다. 따라서 모두 Active로 운영될 FWSM 구성에 대해, IP Address 체계를 주의해서 구성한다.
ACE 기반의 FWSM FLB Design FWSM Basic Config – FWSM#B interface Vlan31 nameif inside security-level 100 ip address 31.31.31.253 255.255.255.0 ! interface Vlan32 nameif outside security-level 0 ip address 32.32.32.253 255.255.255.0 access-list permit extended permit ip any any icmp permit any inside icmp permit any outside access-group permit in interface inside access-group permit in interface outside route inside 30.30.30.0 255.255.255.0 31.31.31.1 1 route outside 0.0.0.0 0.0.0.0 32.32.32.1 1 172.16.2.1 F1/48, V2 ACE FLB Outside ACE FLB Inside FWSM은 FLB를 통해 운용 되므로, 모두 Active 이며 Failover 구조는 필요없다. 따라서 모두 Active로 운영될 FWSM 구성에 대해, IP Address 체계를 주의해서 구성한다.
ACE 기반의 FWSM FLB Design ACE Virtual Partition 구성 context I-FLB allocate-interface vlan 30-31 ! A_Group Context 선언 및 Interface Vlan 10,11 할당 context O-FLB allocate-interface vlan 32-33 ! A_Group Context 선언 및 Interface Vlan 10,11 할당 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ACE Failover Interface 지정 ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 ft Peer 간 heartbeat Interval과 counte 선언
ACE 기반의 FWSM FLB Design ACE FT - Failover Group 구성 ft group 4 peer 1 no preempt priority 200 associate-context O-FLB inservice FLB Outside ACE FT 그룹 선언 ft group 5 associate-context I-FLB inservice FLB Inside ACE FT 그룹 선언 ft group #1 ft group #2 ft group #3
ACE 기반의 FWSM FLB Design ACE FT - Failover Group 구성 ft interface vlan 99 ip address 99.99.99.1 255.255.255.0 peer ip address 99.99.99.2 255.255.255.0 no shutdown ft peer 1 heartbeat interval 100 heartbeat count 10 ft-interface vlan 99 heartbeat interval Millisecond 단위 Heartbeat count 10 Hearbeat count 숫자 위의 예제에서는 Heartbeat interval * Heartbeat count = 1Sec 가 된다. Ft interface Vlan 99 ft group #1 ft group #2 ft group #3
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – RealServer 구성 rserver host FW253 ip address 32.32.32.253 inservice rserver host FW254 ip address 32.32.32.254
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – ServerFarm 구성 RealServer RealServer ServerFarm serverfarm host FLB-Out transparent predictor hash address 255.255.255.255 rserver FW253 inservice rserver FW254 NAT 처리가 필요없으므로… Hash 기반의 FLB 처리
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – SLB Policy Map 구성 RealServer RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-Out
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Server VIP 구성 Class-map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-Out class-map match-any FLB-Out-VIP 2 match virtual-address 30.30.30.0 255.255.255.0 any 3 match virtual-address 31.31.31.0 255.255.255.0 any FLB Outside 측 Subnet 선언
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-Out class-map match-any FLB-Out-VIP 2 match virtual-address 30.30.30.0 255.255.255.0 any 3 match virtual-address 31.31.31.0 255.255.255.0 any policy-map multi-match FLB-MM-Policy class FLB-Out-VIP loadbalance vip inservice loadbalance policy FLB-Policy loadbalance vip icmp-reply
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer Interface ACL & Service Policy 적용 RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-Out class-map match-any FLB-Out-VIP 2 match virtual-address 30.30.30.0 255.255.255.0 any 3 match virtual-address 31.31.31.0 255.255.255.0 any policy-map multi-match FLB-MM-Policy class FLB-Out-VIP loadbalance vip inservice loadbalance policy FLB-Policy loadbalance vip icmp-reply access-list anyone line 8 extended permit ip any any
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer Interface ACL & Service Policy 적용 RealServer ServerFarm interface vlan 33 description =ACE-Out-Client= ip address 33.33.33.2 255.255.255.0 alias 33.33.33.1 255.255.255.0 peer ip address 33.33.33.3 255.255.255.0 access-group input anyone access-group output anyone service-policy input mgmt service-policy input FLB-MM-Policy no shutdown interface vlan 32 description =ACE-Out-Server= ip address 32.32.32.2 255.255.255.0 alias 32.32.32.1 255.255.255.0 peer ip address 32.32.32.3 255.255.255.0 mac-sticky enable access-group input anyone service-policy input mgmt ! ip route 0.0.0.0 0.0.0.0 33.33.33.254
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Health Monitoring(Probe) #1 RealServer ServerFarm ACE ACE Probe MSFC HSRP probe icmp I-FLB-MSFC ip address 30.30.30.254 interval 2 faildetect 2 passdetect interval 2 passdetect count 5 receive 1 serverfarm host FLB-Out transparent predictor hash address 255.255.255.255 probe I-FLB-MSFC rserver FW253 inservice rserver FW254
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Health Monitoring(Probe) #2 1 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp I-FLB-MSFC description ICMP-Probe interval 2 faildetect 2 passdetect interval 2 passdetect count 5 receive 1 Interval Interval은 Probe를 주기적으로 Check하는 시간을 의미한다. 예제의 경우에는 2초에 한번씩 Check. faildetect faildetect Count는 Probe Check 시 특정 Count에 Fail이 Count 되면 Server, real Server를 Fail 로 간주하게 된다. 예제의 경우에는 2번의 Fail이 Count되면, Fail로 처리하겠다는 의미 Receive ACE가 Probe 를 해당 Server에 보내고 기다리는 시간을 의미한다. 예제에서는 1초간 기다리겠다는 의미이다. Tip !!! 구성 예제의 결과를 보면 결국 Fail 되는 총시간은 interval * faildetect * receive 가 된다. 따라서 위의 세개의 값을 세밀하게 계산하여, Fail Server를 선택하는 것이 매우 중요하다.
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Health Monitoring(Probe) #3 2 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp I-FLB-MSFC description ICMP-Probe interval 2 faildetect 2 passdetect interval 2 passdetect count 5 receive 1 passdetect interval Server 가 Fail 된 후 복구 되기 위해, 주기적으로 다시 Probe를 보내는 주기를 의미한다. 예제에서는 2초에 한번씩 Probe를 보내게 된다. Passdetect count Server 가 Fail 된 후 복구되기 위한 성공적인 Probe Count를 의미한다. 예제에서는 5개의 성공 Probe 결과를 받았을 때 서비스를 재개 하겠다는 의미 Tip !!! 구성 예제의 결과를 보면 결국 Server가 Fail된 후 정상 복구 된다고 하더라도, intervla * count가 되므로, 정상 복구 후 10Sec 이후에 실제 정상 서비스가 된다는 의미 이다.
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Health Monitoring(Probe) 이해 FLB Probe Point 이해 OutSide ACE Probe Point는 Inside MSFC의 In HSRP VIP를 선언. Inside ACE Probe Point는 Outside MSFC의 Out HSRP VIP 선언. 왜 Probe IP를 HSRP 포인트를 주는가? FWSM 또는 Firewall의 Inside or OutSide만 장애가 발생할 경우 이상 동작이 발생할 수 있다. 따라서, ACE가 FLB 처리하는 Flow가 완벽하게 동작되는 지 확인이 가능한 Probe 첫 포인트가 되는 MSFC HSRP VIP를 Probe Point로 두는 것이 좋다. Out HSRP VIP ACE FLB Outside ACE FLB Inside In HSRP VIP
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Health Monitoring(Probe) 이해 == FireWall의 Inside 또는 Outside만 장애가 발생할 경우 == switch/A-FLB-OUT# sh probe probe : I-FLB-MSFC type : ICMP, state : ACTIVE ---------------------------------------------- port : 0 address : 30.30.30.254 addr type : TRANSPARENT interval : 2 pass intvl : 2 pass count : 5 fail count: 2 recv timeout: 1 --------------------- probe results -------------------- probe association probed-address probes failed passed health ------------------- ---------------+----------+----------+----------+------- serverfarm : FLB-Out real : FW253[0] 30.30.30.254 2520 1973 547 SUCCESS real : FW254[0] 30.30.30.254 2585 2048 537 FAILED Probe Point가 HSRP VIP이므로 해당 경로가 되는 RealServer의 장애를 곧바로 인지하여, 더 이상 장애가 있는 FWSM 또는 방화벽 쪽으로 Packet을 보내지 않는다.
ACE 기반의 FWSM FLB Design ACE Outside Basic Config – Management Policy 구성 Class-map L3/L4 Policy map RealServer RealServer ServerFarm class-map type management match-any mgmt 2 match protocol icmp any 3 match protocol telnet any 4 match protocol ssh any policy-map type management first-match mgmt class c-mgmt permit interface vlan 32 description =ACE-Out-Server= service-policy input mgmt interface vlan 33 description =ACE-Out-Client= access-group input anyone service-policy input FLB-MM-Policy RealServer가 G.W로 icmp를 허용하기 위해서, 허용한다.
ACE 기반의 FWSM FLB Design ACE Outside Monitoring – Real Server Monitoring ACE/O-FLB# sh rserver rserver : FW253, type: HOST state : OPERATIONAL --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: FLB-Out 32.32.32.253:0 8 OPERATIONAL 1 4 rserver : FW254, type: HOST 32.32.32.254:0 8 OPERATIONAL 1 2
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – RealServer 구성 rserver host FW253 ip address 31.31.31.253 inservice rserver host FW254 ip address 31.31.31.254
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – ServerFarm 구성 RealServer RealServer ServerFarm serverfarm host FLB-In transparent predictor hash address 255.255.255.255 rserver FW253 inservice rserver FW254 NAT 처리가 필요없으므로… Hash 기반의 FLB 처리
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – SLB Policy Map 구성 RealServer RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-In
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – Server VIP 구성 LB Policy map Class-map RealServer RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-In class-map match-any FLB-In-VIP 2 match virtual-address 0.0.0.0 0.0.0.0 any FLB Inside 측 Subnet 선언
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – L3/L4 Policy Map 구성 LB Policy map L3/L4 Policy map Class-map RealServer RealServer ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-In class-map match-any FLB-In-VIP 2 match virtual-address 0.0.0.0 0.0.0.0 any policy-map multi-match FLB-MM-Policy class FLB-In-VIP loadbalance vip inservice loadbalance policy FLB-Policy loadbalance vip icmp-reply
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – L3/L4 Policy Map 구성 LB Policy map L3/L4 Policy map Class-map RealServer RealServer Interface ACL & Service Policy 적용 ServerFarm policy-map type loadbalance first-match FLB-Policy class class-default serverfarm FLB-In class-map match-any FLB-In-VIP 2 match virtual-address 0.0.0.0 0.0.0.0 any policy-map multi-match FLB-MM-Policy class FLB-In-VIP loadbalance vip inservice loadbalance policy FLB-Policy loadbalance vip icmp-reply access-list anyone line 8 extended permit ip any any
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – L3/L4 Policy Map 구성 Class-map L3/L4 Policy map LB Policy map RealServer Interface ACL & Service Policy 적용 RealServer ServerFarm interface vlan 30 description =ACE-In-Client= ip address 30.30.30.2 255.255.255.0 alias 30.30.30.1 255.255.255.0 peer ip address 30.30.30.3 255.255.255.0 access-group input anyone access-group output anyone service-policy input FLB-MM-Policy service-policy input mgmt no shutdown interface vlan 31 description =ACE-In-Server= ip address 31.31.31.2 255.255.255.0 alias 31.31.31.1 255.255.255.0 peer ip address 31.31.31.3 255.255.255.0 mac-sticky enable access-group input anyone service-policy input mgmt ! ip route 0.0.0.0 0.0.0.0 30.30.30.254
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – Health Monitoring(Probe) #1 RealServer ServerFarm ACE ACE Probe MSFC HSRP probe icmp O-FLB-MSFC ip address 33.33.33.254 interval 2 faildetect 2 passdetect interval 2 passdetect count 5 receive 1 serverfarm host FLB-In transparent predictor hash address 255.255.255.255 probe O-FLB-MSFC rserver FW253 inservice rserver FW254
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – Health Monitoring(Probe) #2 1 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp I-FLB-MSFC description ICMP-Probe interval 2 faildetect 2 passdetect interval 2 passdetect count 5 receive 1 Interval Interval은 Probe를 주기적으로 Check하는 시간을 의미한다. 예제의 경우에는 2초에 한번씩 Check. faildetect faildetect Count는 Probe Check 시 특정 Count에 Fail이 Count 되면 Server, real Server를 Fail 로 간주하게 된다. 예제의 경우에는 2번의 Fail이 Count되면, Fail로 처리하겠다는 의미 Receive ACE가 Probe 를 해당 Server에 보내고 기다리는 시간을 의미한다. 예제에서는 1초간 기다리겠다는 의미이다. Tip !!! 구성 예제의 결과를 보면 결국 Fail 되는 총시간은 interval * faildetect * receive 가 된다. 따라서 위의 세개의 값을 세밀하게 계산하여, Fail Server를 선택하는 것이 매우 중요하다.
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – Health Monitoring(Probe) #3 2 probe <probe-type> <probe-name> description < description > port <port-number> interval <sec> faildetect <retry-count> passdetect interval <sec> passdetect count <number> receive <receive-timeout> probe icmp I-FLB-MSFC description ICMP-Probe interval 2 faildetect 2 passdetect interval 2 passdetect count 5 receive 1 passdetect interval Server 가 Fail 된 후 복구 되기 위해, 주기적으로 다시 Probe를 보내는 주기를 의미한다. 예제에서는 2초에 한번씩 Probe를 보내게 된다. Passdetect count Server 가 Fail 된 후 복구되기 위한 성공적인 Probe Count를 의미한다. 예제에서는 5개의 성공 Probe 결과를 받았을 때 서비스를 재개 하겠다는 의미 Tip !!! 구성 예제의 결과를 보면 결국 Server가 Fail된 후 정상 복구 된다고 하더라도, intervla * count가 되므로, 정상 복구 후 10Sec 이후에 실제 정상 서비스가 된다는 의미 이다.
ACE 기반의 FWSM FLB Design ACE Inside Basic Config – Management Policy 구성 L3/L4 Policy map Class-map RealServer RealServer ServerFarm class-map type management match-any mgmt 2 match protocol telnet any 3 match protocol icmp any policy-map type management first-match mgmt class mgmt permit interface vlan 30 description =ACE-In-Client= service-policy input mgmt no shutdown interface vlan 31 description =ACE-In-Server= no shutdown RealServer가 G.W로 icmp를 허용하기 위해서, 허용한다.
ACE 기반의 FWSM FLB Design ACE Inside Monitoring – Real Server Monitoring ACE/I-FLB# sh rserver rserver : FW253, type: HOST state : OPERATIONAL --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: FLB-In 31.31.31.253:0 8 OPERATIONAL 3 510 rserver : FW254, type: HOST 31.31.31.254:0 8 OPERATIONAL 2 470
ACE 기반의 FWSM FLB Design Failover Scenario 1 Server Switch Primary Link 단절 Session State 유지 Ping Losss 1개 이내. RSTP에 의해 msec 단위 Take Over 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 4 172.16.3.254/1 ACE FLB Outside 2 2 ACE Primary(Inside or Outside) 장애 Session State 유지 Ping Losss 1개 이내. ACE FT 기법을 통한 msec 단위 Take Over 구성 가능 Trunk V30-34,99 3 ACE FLB Inside 2 3 FWSM 장애 두개이상의 FWSM이 구동하고 있으므로, 가동 중인 FWSM 쪽으로 우회 1 B F9/1 RSTP F9/1 Server A 30.30.30.11 Server B 30.30.30.12
ACE 기반의 FWSM FLB Design Failover Scenario 4 Primary 6500 장애 또는 Router Uplink 단절 Session State 유지 또는 빠른 우회 경로 확보 Ping Losss 1개 이내. Fast OSPF 구현을 통한 빠른 우회경로 확보 2.254 1.254 172.16.2.1 F1/48, V2 172.16.1.1 F1/48, V1 OSPF Area0 4 172.16.3.254/1 11.11.11.254 V12 V12 BVI 11.11.11.12 Trunk V20,21,22,99,198,199 3 OSPF Tuning ip ospf dead-interval minimal hello-multiplier 20 router os 1 timers throttle spf 300 10000 30000 timers throttle lsa all 200 2000 10000 Clent: 11.11.11.1 V11 V11 2 Server 10.10.10.1 V10 VIP 11.11.11.11 V10 RSTP F9/1 1 F9/1 Server A 10.10.10.11 Server B 10.10.10.12