[文章作者:张宴 本文版本:v1.0 最后修改:2008.05.22 转载请注明出自:http://blog.zyan.cc/f5_big_ip]

  前言:最近一直在对比测试F5 BIG-IP和Citrix NetScaler负载均衡器的各项性能,于是写下此篇文章,记录F5 BIG-IP的常见应用配置方法。

  目前,许多厂商推出了专用于平衡服务器负载的负载均衡器,如F5 Network公司的BIG-IP,Citrix公司的NetScaler。F5 BIG-IP LTM 的官方名称叫做本地流量管理器,可以做4-7层负载均衡,具有负载均衡、应用交换、会话交换、状态监控、智能网络地址转换、通用持续性、响应错误处理、IPv6网关、高级路由、智能端口镜像、SSL加速、智能HTTP压缩、TCP优化、第7层速率整形、内容缓冲、内容转换、连接加速、高速缓存、Cookie加密、选择性内容加密、应用攻击过滤、拒绝服务(DoS)攻击和SYN Flood保护、防火墙—包过滤、包消毒等功能。

  以下是F5 BIG-IP用作HTTP负载均衡器的主要功能:
  ①、F5 BIG-IP提供12种灵活的算法将所有流量均衡的分配到各个服务器,而面对用户,只是一台虚拟服务器。
  ②、F5 BIG-IP可以确认应用程序能否对请求返回对应的数据。假如F5 BIG-IP后面的某一台服务器发生服务停止、死机等故障,F5会检查出来并将该服务器标识为宕机,从而不将用户的访问请求传送到该台发生故障的服务器上。这样,只要其它的服务器正常,用户的访问就不会受到影响。宕机一旦修复,F5 BIG-IP就会自动查证应用已能对客户请求作出正确响应并恢复向该服务器传送。
  ③、F5 BIG-IP具有动态Session的会话保持功能。
  ④、F5 BIG-IP的iRules功能可以做HTTP内容过滤,根据不同的域名、URL,将访问请求传送到不同的服务器。



  下面,结合实例,配置F5 BIG-IP LTM v9.x:

  点击在新窗口中浏览此图片

  ①、如图,假设域名blog.zyan.cc被解析到F5的外网/公网虚拟IP:61.1.1.3(vs_squid),该虚拟IP下有一个服务器池(pool_squid),该服务器池下包含两台真实的Squid服务器(192.168.1.11和192.168.1.12)。
  ②、如果Squid缓存未命中,则会请求F5的内网虚拟IP:192.168.1.3(vs_apache),该虚拟IP下有一个默认服务器池(pool_apache_default),该服务器池下包含两台真实的Apache服务器(192.168.1.21和192.168.1.22),当该虚拟IP匹配iRules规则时,则会访问另外一个服务器池(pool_apache_irules),该服务器池下同样包含两台真实的Apache服务器(192.168.1.23和192.168.1.24)。
  ③、另外,所有真实服务器的默认网关指向F5的自身内网IP,即192.168.1.2。
  ④、所有的真实服务器通过SNAT IP地址61.1.1.4访问互联网。



  详细配置步骤:

  一、登录到F5 BIG-IP管理界面:
  1、初次使用:
  ①、打开F5 BIG-IP电源,用一根网线(直连线和交叉线均可)连接F5 BIG-IP的3.1管理网口和笔记本电脑的网口,将笔记本电脑的IP地址配置为“192.168.1.*”,子网掩码配置为“255.255.255.0”。
  ②、用浏览器访问F5 BIG-IP的出厂默认管理IP地址https://192.168.1.245https://192.168.245.245
  ③、输入出厂默认用户名:admin,密码:admin
  ④、点击Activate进入F5 BIG-IP License申请与激活页面,激活License。
  ⑤、修改默认管理密码。

  2、以后登录:
  通过F5 BIG-IP的自身外网IP登录。
  ①、假设设置的F5自身外网IP为61.1.1.2,就可以通过https://61.1.1.2/登录。
  ②、还可以通过SSH登录,用户名为root,密码跟Web管理的密码相同。



  二、创建两个VLAN:internal和external,分别表示内网和外网。
  ★创建VLAN演示页面:http://blog.zyan.cc/book/f5/vlan_create.htm
  ★VLAN列表演示页面:http://blog.zyan.cc/book/f5/vlan_list.htm

  1、创建VLAN:internal(内网)
  在“Network→VLANs”页面点击“create”按钮:
  ①、Name栏填写:internal(填一个英文名称)
  ②、Tag栏填写:4093(填一个数字)
  ③、Interfaces栏:将Available列的“1.1”拉到Untagged列。1.1表示F5 BIG-IP的第一块网卡。

  2、创建VLAN:external(外网)
  在“Network→VLANs”页面点击“create”按钮创建VLAN:
  ①、Name栏填写:internal(填一个英文名称)
  ②、Tag栏填写:4094(填一个数字)
  ③、Interfaces栏:将Available列的“1.2”拉到Untagged列。1.2表示F5 BIG-IP的第二块网卡。



  三、创建F5 BIG-IP的自身IP:分别对应internal(内网)和external(外网)。
  ★创建自身IP演示页面:http://blog.zyan.cc/book/f5/selfip_create.htm

  1、创建自身内网IP:192.168.1.2
  在“Network→Self IPs”页面点击“create”按钮:
  ①、IP Address栏填写:192.168.1.2(填内网IP地址)
  ②、Netmask栏填写:255.255.255.0(填内网子网掩码)
  ③、VLAN栏选择:internal
  ④、Port Lockdown栏选择:Allow Default(默认值)

  2、创建自身外网IP:61.1.1.2
  在“Network→Self IPs”页面点击“create”按钮:
  ①、IP Address栏填写:61.1.1.2(填外网IP地址)
  ②、Netmask栏填写:255.255.255.0(填外网子网掩码)
  ③、VLAN栏选择:external
  ④、Port Lockdown栏选择:Allow Default(默认值)



  四、创建默认网关路由
  ★创建默认网关路由演示页面:http://blog.zyan.cc/book/f5/routes_create.htm

  1、创建默认网关路由
  在“Network→Routes”页面点击“create”按钮:
  ①、Type栏选择:Default Gateway(默认值)
  ②、Resource栏选择:Use Gateeay...,在其后的输入框填写网关IP地址:61.1.1.1(这里假设此IP为外网网关地址)



  五、创建服务器自定义健康检查
  ★创建服务器自定义健康检查演示页面:http://blog.zyan.cc/book/f5/monitors_create.htm

  1、创建自定义HTTP健康检查:monitor_http
  在“Local Traffic→Monitors”页面点击“create”按钮:
  ①、Name栏填写:monitor_http(填一个英文名称)
  ②、Type栏选择:HTTP
  ③、Import Settings栏选择:HTTP
  ④、Interval栏填写:5(表示每5秒钟进行一次健康检查)
  ⑤、Timeout栏填写:16(表示健康检查的连接超时时间为16秒)
  ⑥、Send String栏填写:GET /(也可以根据自己的需求发送其他方法的请求,例如HEAD /或者GET /index.htm)
  ⑦、Receive String栏填写:(填写对应的返回字符串,默认不填写)



  六、创建服务器池(pool)
  ★创建服务器池演示页面:http://blog.zyan.cc/book/f5/pools_create.htm

  1、创建Squid服务器池:pool_squid
  在“Local Traffic→Pools”页面点击“create”按钮:
  ①、Name栏填写:pool_squid(填一个英文名称)
  ②、Health Monitors栏:将第四步创建的自定义HTTP健康检查“monitor_http”由Available列拉到Active列
  ③、Load Balancing Method栏选择:Round Robin(这里选择的负载均衡方式是轮询,也可以选择其他方式)
  ④、New Members栏:先选择New Address,再添加两台Squid服务器的IP地址192.168.1.11、192.168.1.12以及它们的端口80

  2、创建第一组Apache服务器池:pool_apache_default
  在“Local Traffic→Pools”页面点击“create”按钮:
  ①、Name栏填写:pool_apache_default(填一个英文名称)
  ②、Health Monitors栏:将第四步创建的自定义HTTP健康检查“monitor_http”由Available列拉到Active列
  ③、Load Balancing Method栏选择:Round Robin(这里选择的负载均衡方式是轮询,也可以选择其他方式)
  ④、New Members栏:先选择New Address,再添加第一组两台Apache服务器的IP地址192.168.1.21、192.168.1.22以及它们的端口80

  3、创建第二组Apache服务器池:pool_apache_irules
  在“Local Traffic→Pools”页面点击“create”按钮:
  ①、Name栏填写:pool_apache_irules(填一个英文名称)
  ②、Health Monitors栏:将第四步创建的自定义HTTP健康检查“monitor_http”由Available列拉到Active列
  ③、Load Balancing Method栏选择:Round Robin(这里选择的负载均衡方式是轮询,也可以选择其他方式)
  ④、New Members栏:先选择New Address,再添加第二组两台Apache服务器的IP地址192.168.1.23、192.168.1.24以及它们的端口80



  七、创建供七层负载均衡使用的Profiles配置
  ★创建Profiles演示页面:http://blog.zyan.cc/book/f5/profiles_create.htm

  1、创建Profiles配置:profile_http
  在“Local Traffic→Profiles”页面点击“create”按钮:
  ①、Name栏填写:profile_http(填一个英文名称)
  ②、Parent Profile栏选择:HTTP
  ③、Insert XForwarded For栏:如果需要,可以选中方框,选择Enable(在Header头中插入x-forwarded-for标记,以便做七层负载均衡时能够获取用户真实IP,本文中Squid服务器开启了follow_x_forwarded_for allow all,因此F5无需设置此项)

  注:在此设置页面中,还有压缩等优化功能,可以根据需要进行设置。



  八、创建iRules规则
  ★创建iRules规则演示页面:http://blog.zyan.cc/book/f5/irules_create.htm

  1、创建iRules规则:irules_apache
  在“Local Traffic→Profiles”页面点击“create”按钮:
  ①、Name栏填写:irules_apache(填一个英文名称)
  ②、Definition栏填写以下脚本,将访问的域名为“blog.zyan.cc”,访问的网址以“.htm”结尾,或者以“/read.php”开头的请求全部转到服务器池“pool_apache_irules”:


  九、创建虚拟服务器(Virtual Servers)
  ★创建虚拟服务器演示页面:http://blog.zyan.cc/book/f5/vs_create.htm

  1、以“四层”负载均衡模式创建Squid虚拟服务器:vs_squid
  在“Local Traffic→Virtual Servers”页面点击“create”按钮:
  ⑴、General Properties大类下:
  ①、Name栏填写:vs_squid(填一个英文名称)
  ②、Destination栏:选择Host,填写Squid服务器的外网虚拟IP(Virtual IP,简称VIP):61.1.1.3
  ③、Service Port栏填写:80

  ⑵、Configuration大类下:
  ①、Configuration栏选择: Advanced(选择高级模式,这一步很重要)
  ②、Type栏选择:Performance (Layer 4)
  ③、SNAT Pool栏选择:None(注意:这一步很重要,四层模式下,请确保此项选择为None)

  ⑶、Resources大类下:
  ①、Default Pool栏选择:pool_squid

  注意:F5的四层负载均衡由硬件芯片处理,不消耗CPU资源,能够处理更大的访问量。在四层负载均衡模式下,真实服务器的默认网关必须指向F5的自身内网IP,即192.168.1.2

  2、以“七层”负载均衡模式创建Apache虚拟服务器:vs_apache
  在“Local Traffic→Virtual Servers”页面点击“create”按钮:
  ⑴、General Properties大类下:
  ①、Name栏填写:vs_apache(填一个英文名称)
  ②、Destination栏:选择Host,填写Apache服务器的内网虚拟IP(Virtual IP,简称VIP):192.168.1.3
  ③、Service Port栏填写:80

  ⑵、Configuration大类下:
  Configuration栏选择: Advanced(选择高级模式,这一步很重要)
  ①、Type栏选择:Standard(标准模式,即七层负载均衡模式)
  ②、HTTP Profile栏选择:profile_http(注意:此项为None时,不能使用iRules规则,因此必须选一个。在此选择第六步创建的profile_http)
  ③、SNAT Pool栏选择:Auto Map(注意:在本文的架构中必须选择,原因如下)
  说明:当其中的一台Squid服务器“192.168.1.11”缓存未命中时,会去访问虚拟IP“192.168.1.3”。如果SNAT Pool选择默认值None,虚拟IP“192.168.1.3”后端的Apache服务器,看到的将是Squid服务器的真实IP“192.168.1.11”。由于Squid和Apache服务器的IP地址属于在同一网段,Apache服务器将无需经过F5网关“192.168.1.2”,直接通过交换机回包给Squid服务器“192.168.1.11”,这样虚拟IP“192.168.1.3”就会收不到回包信息,HTTP请求无法完成。因此,需要选择Auto Map,进行地址转换,让后端Apache服务器看到的是F5的自身内网IP,回包给F5。

  ⑶、Resources大类下:
  ①、iRules栏:将Available列的“irules_apache”拉到Enabled列。
  ②、Default Pool栏选择:pool_apache_default

  ⑷、Apache虚拟服务器──vs_apache创建完成后,如需进行修改,在以下两个配置页完成:
  ★修改虚拟服务器演示页面1:http://blog.zyan.cc/book/f5/vs_properties.htm
  ★修改虚拟服务器演示页面2:http://blog.zyan.cc/book/f5/vs_resources.htm



  十、创建SNAT安全网络地址转换,让真实服务器能够访问互联网、对外发邮件
  ★创建SNAT演示页面:http://blog.zyan.cc/book/f5/snat_create.htm

  1、创建SNAT:snat_all_server
  在“Local Traffic→SNATs”页面点击“create”按钮:
  ①、Name栏填写:snat_all_server(填一个英文名称)
  ②、Translation栏选择:IP Address,并填写SNAT IP地址:61.1.1.4(此项也可以选择Automap,使用F5的自身外网IP作为SNAT IP)
  ③、Origin栏选择:Address List
  ④、Address List栏:①Type栏选择host,填写要访问互联网、对外发邮件的内网IP地址。②或者Type栏选择Network,填写要访问互联网、对外发邮件的网段和子网掩码。
  ⑤、VLAN Traffic栏选择:Enabled on...
  ⑥、VLAN List栏:将Available列的“internal”拉到Selected列。

  注意:真实服务器的默认网关需要指向F5的自身内网IP,即192.168.1.2,才能通过SNAT访问互联网、对外发邮件。



  附1:
  《F5 BIG-IP LTM 配置手册(中文简化版)

  《F5 BIG-IP LTM 配置手册(英文详细版)


  附2:
  使用F5 BIG-IP作为负载均衡器的部分国内网站:

  点击在新窗口中浏览此图片



Tags: , , , , , ,
技术大类 » 系统架构与硬件 | 评论(66) | 引用(0) | 阅读(245837)
微博 Homepage
2010-12-22 13:52
好文章,谢谢分享!qianming.tingque.com/t/
SZXL
2011-8-26 11:40
负载匀衡,型号:F5 BIG-GTM-1500-RS,我有一台全新的,有需要的联系我。可租,可售。联系方式:QQ:1872295571
真水无香
2011-11-18 13:42
有个问题请教一下!我想要指定某个内网地址走哪条链路在哪里设置;还有就是我想修改F5自身的外网IP地址怎么修改?谢谢指教
Cope Homepage
2012-2-9 14:52
将F5换成nginx, 完全可以     ~~~~~~~~~~~~密封件厂密封件厂家密封件生产厂家
来来来
2012-3-26 17:41
非常好,很感谢!!!!
coach factory outlet Email Homepage
2012-5-17 11:35
Today, following half a century, mentor leather-bases coach factory outlet continues to be the delicate craft of leather-based master is accountable for,Would you like to meet more friends, or go with the times? If yes, coach factory online is opening welcome doors to you.in the market you definitely can find various colorways that are designed in as well as the high quality that applied in. For most of you would like to come. So just come to our coach factory outlet online store to choose one.
louis vuitton sale Email Homepage
2012-5-17 11:35
Louis Vuitton belt at louis vuitton sale is one kind of fashion accessory with high cost performance among the Louis Vuitton accessories.Offering quality LV products with favorable prices, louis vuitton outlet store is at your service. Hurry up, or you can not seize the chance.in fact, louis vuitton is one of the most famous fashion design master.he opened the fist suitcase shop called after his name.
coach outlet online Email Homepage
2012-5-17 11:35
I heard of coach outlet online through the advertisement when I was shopping. And now I often brow the webpage and buy Coach bags online.It is a symbol regarding position not to mention nature.Here I would like to launch a excellent bags pertaining to business men.Which may be coach outlet store.coach outlet has always been simple,durable style features to win consumers.The products are more flexible,with easy bleaching,wear characteristics,and simply use a damp cloth.
coach outlet, Email Homepage
2012-5-17 11:35
Remember the coach outlet provide coach bags which won't be deteriorated into its overall styles by any means. It will maintain its looks, colors, and uniqueness for long time.coach outlet store online has been voted by Hour Detroit magazine readers as the Best of Detroit in their 12th annual readers'poll.Lots of women like which usually amount normally include a coach outlet online ,it provides coziness to many girls that don't even think it is a great bushel of great interest directly to them.
xujie777 Email
2012-5-18 16:44
We aim to make all our customers satisfy with our products. You will find a variety of Men's fashion louis vuitton uk, fashion Women's cheap Louis Vuitton bags in our store at affordable price.Thinking of interesting ways to cost a milestone birthday? louis vuitton online shop had one of the most distinctive distinctive celebrations.bakery along with living room operated by means of about three moment louis vuitton online Most effective Pastry Chef’s of the year Rammy Nominee Chef’s.
xujie777 Email
2012-5-18 16:44
The choices are likely to be basically countless seeing that louis vuitton outlet occurs with the help of completely new and also incredible concepts once in a while.Louis vuitton Wholesale Monogram Canvas HandbagsLouis Vuitton Collection Beach Handbags louis vuitton bags outlet Damier Canvas HandbagsLouis vuitton Mahina HandbagsLouis Vuitton Monogram Mini Lin HandbagsLouis Vuitton Monogram Multicolore HandbagsLouis vuitton Monogram Vernis HandbagsLouis Vuitton Wholesale Epi Leather HandbagsLouis Vuitton For Men HandbagsLouis Vuitton Damier Canvas WalletsLouis Vuitton Epi Leather WalletsLouis Vuitton Monogram Canvas WalletsLouis Vuitton Monogram Vernis WalleLouis Vuitton ShoesLouis Vuitton Men wallets.As the Authentic Louis Vuitton are so high-priced, so came the louis vuitton handbags outlet.
xujie777 Email
2012-5-18 16:44
coach outlet has become a popular shopping experience for consumers around the world, and a desirable distribution channel for manufacturer's and retailers.Getting your hands on coach outlet store online can be a hefty investment of hundreds of dollars.But do not despair,the Coach Outlet store could be the answer to your prayers.coach outlet online is your smart choice when you want to get the discount Coach accessory. You can find the exact Coach Bags and other accessory you want at a low price that's right for you. My dear friends, let the coach outlet online pave your way into the world of high fashion with their ultimate fashion factory.
xujie123
2012-5-21 11:19
Our online store offers you discounted Designer louis vuitton replica wallet at present. You could find them in desirable quality and price. If you don't mind high class louis vuitton uk, have a good time here.louis vuitton Store Online Handbags can also bring great accuracy as well as practical applicability and fashionable.Have you ever dreamed of being as charming as Madonna? Have you ever thought of becoming an envy of all your friends? If so, come to louis vuitton outlet.<br/>
xujie555
2012-5-21 13:43
coach factory outlet uses graceful accessories to match the classical logo of coach, which is the best combination of coach. The handmade coach products?can make you more charming and graceful.coach factory online provides people many coach goods. If you wish to snatch the coach handbag, then this best method is made for that you like for coach discount.coach factory outlet online is a fashion brand to ensure its quality. With designer coach shoulder bags, you will always attract people's attention. The bags will emphasize your personal style and taste.<br/>
xujie333
2012-5-21 15:08
coach outlet online Store guarantee that all the coach handbags offered are own high quality. In addition , all of them are sold at an unexpected low price.If you want to purchase, just visit their website.coach factory outlet is really sizzling kinds of shopping way for you. With the usage of the replica designer coach bags, you can surely be able to change your individual looks in a stunning manner.Coach bags on sale from the coach outlet are cheap or discount prices that you certainly will stand out from the crowd on your next camping trip!<br/>
ccc
2012-8-11 14:01
心桥文章网 Homepage
2012-8-15 22:28
太深奥了点,有点看不明白。www.kanmw.com 听说你来过,值得拥有。
Cheap Snapback Hats Email Homepage
2012-9-25 16:02
First off, what's CFD exactly? Cheap Snapback Hats You cannot discuss CFD propagate gambling unless you know very well what a CFD is correct? Snapback Hats Wholesale Well, CFD appears for Agreements for Distinction which is gdiuhop[=[ljoujo a kind of mixture item that gets traded.
sdsd
2012-11-28 14:12
GAWET
2013-1-29 16:49
买轴承就到:www.jkzhoucheng.cn
分页: 3/4 第一页 上页 1 2 3 4 下页 最后页
发表评论
表情
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
打开HTML
打开UBB
打开表情
隐藏
记住我
昵称   密码   游客无需密码
网址   电邮   [注册]