B2-負(fù)載均衡基本原理

負(fù)載均衡基本原理王文angwnb@單臺服務(wù)器到多臺服務(wù)器的轉(zhuǎn)變InternetBIG-IPLTMsClientsServersClientsInternetServers什么是服務(wù)器負(fù)載均衡12345678ClientsClientsInternet虛擬服務(wù)器與網(wǎng)絡(luò)地址轉(zhuǎn)換

VirtualServer&NAT真實服務(wù)器RealServer網(wǎng)絡(luò)地址轉(zhuǎn)換VirtualServerAddress7:80Internet:8080:8080:8080:8080RealServerAddress7:80Internet虛擬服務(wù)器數(shù)據(jù)流-Packet#1Internet:8080:8080:808:8080域名IP地址7VirtualServerAddress7:80數(shù)據(jù)流-Packet#1LTM根據(jù)負(fù)載均衡把數(shù)據(jù)包的目的地址轉(zhuǎn)換成Node的地址InternetPacket#1Src-0:4003Dest–7:80:8080:8080:8080:8080Packet#1Src–0:4003Dest–:808007:80數(shù)據(jù)流–Packet#1響應(yīng)包

LTM把數(shù)據(jù)包的源地址轉(zhuǎn)換成VirtualServer地址InternetPacket#1-returnDest-0:4003Src–7:80:8080Packet#1-returnDest–0:4003Src–:808007:80:8080:8080:8080數(shù)據(jù)流-Packet#2InternetPacket#2Src-1:4003Dest–7:80:8080Packet#2Src–1:4003Dest–:808017:80:8080:8080:8080數(shù)據(jù)流–Packet#2回包

InternetPacket#2-returnDest-1:4003Src–7:80:8080Packet#2-returnDest–1:4003Src–:808017:80:8080:8080:8080數(shù)據(jù)流-Packet#3InternetPacket#3Src-5:4003Dest–7:80:8080Packet#3Src–5:4003Dest–:808057:80:8080:8080:8080數(shù)據(jù)流–Packet#3回包

InternetPacket#3-returnDest-5:4003Src–7:80:8080Packet#3-returnDest–5:4003Src–:808057:8080:8080:8080ConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressVirtualServer0:40037:801:40037:80……0:40057:801:40087:805:40037:80客戶端Netstat-na負(fù)載均衡器BconnConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressRealServer0:4003:80801:4003:8080……0:4005:80801:4008:80805:4003:8080服務(wù)器端Netstat-na負(fù)載均衡器BconnF5負(fù)載均衡的基本構(gòu)件

Pool、PoolMembers與NodesInternet:8080:80:4002:80PoolMembersNodes是指PoolMembers的IPAddressPools,PoolMembersandNodesNode=IPaddress:80:80:80PoolMember

=Node+PortPool

=GroupofpoolmembersPoolMembers的端口與地址問題Internet:8080:80:4002VirtualServer7:80PoolMembers注意：1、PoolMember的端口可以不一樣2、PoolMember不一定需要與BIG-IP相連或在同一網(wǎng)段3、一個Pool中PoolMember的數(shù)量不受限，現(xiàn)網(wǎng)有達(dá)上百個的實例:80/24/24路由器虛擬服務(wù)器VirtualServerInternet:8080:4002:80VirtualServerIPAddress+Service(Port)區(qū)分端口可以為Any(0)準(zhǔn)備了負(fù)載均衡器是否需要對流過的網(wǎng)絡(luò)流量作處理一般與Pool相關(guān)聯(lián)一臺負(fù)載均衡器支持的Virtualserver的數(shù)量不受限，現(xiàn)網(wǎng)有達(dá)上千個的實例7:80如何選擇服務(wù)器--負(fù)載均衡算法RoundRobinRatioLeastConnectionsFastestObservedPredictiveDynamicRatioPriorityGroupActivationFallbackHostStaticDynamicFailureMechanisms輪詢--RoundRobinClientsRouterBIG-IPLTMControllerServersClientrequestsaredistributedevenly12345678Internet比率--RatioClientsRouterBIG-IPLTMControllerServersAdministratorsetsratiofordistributingClientrequests3:2:1:11234891011Internet571214613最小連接數(shù)--LeastConnectionsClientsRouterBIG-IPLTMControllerServers12InternetNextrequestsgoestoNodewithfewestopenconnections459460461470CurrentConnections3456最小連接數(shù)--LeastConnectionsClientsRouterBIG-IPLTMControllerServersInternetSometimelater,numberofconnectionschange6163280290111112CurrentConnections62最快回應(yīng)--FastestClientsRouterBIG-IPLTMControllerServersNextrequestsgotoNodewithfastestresponsetime25Internet10ms10ms10ms17msCurrentResponseTimes1436最快回應(yīng)--FastestClientsRouterBIG-IPLTMControllerServersSometimelater,responsetimeschange102104Internet10ms10ms7ms7msCurrentResponseTimes101103服務(wù)器健康檢查HealthMonitors

如何識別不可用的服務(wù)器

Internet:80服務(wù)健康檢查MonitorConcepts網(wǎng)絡(luò)連通性檢查AddressCheckNode–IPAddress端口ServiceCheckIP:port內(nèi)容檢查ContentCheckIP:portpluscheckdatareturned交互式檢查InteractiveCheck網(wǎng)絡(luò)連通性檢查--AddressCheckStepsPacketssenttoIPAddressesIfnoresponse,thennotrafficsenttomembersusingthatnodeaddressExample-ICMPInternetICMP服務(wù)端口檢查--ServiceCheckStepsOpensTCPconnection(IPAddress:service)ConnectionclosedIfTCPconnectionfails,thennotrafficsenttoassociatedMembersExample–TCPInternet:80:80:80TCPConnection內(nèi)容檢查--ContentCheckInternet:80:80:80StepsOpensTCPconnection(IPAddress:service)SendsarequestResponsereturnsdataConnectionclosedIfReceiveRulenotfoundindata,thennotrafficsenttoassociatedMembersExample–httphttpGET/交互式檢查--InteractiveCheckInternet:80:80:80StepsOpensTCPconnection(IPAddress:service)Interactiveconversationtosimulatereal-worldConnectionclosedIfexpectedresultsdonotoccur,thennotrafficsenttoassociatedMembersExample–SQLrequestconversation會話保持Persistence123123ConnectionTable連接表SrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:80801:40087:80:80805:40037:80:8080SrcIPAddressRealServer0:4003:80801:4003:8080……0:4005:80801:4008:80805:4003:8080服務(wù)器端Netstat-na負(fù)載均衡器BconnSourceAddressPersistenceTableSrcIPAddressVirtualServerRealServer0:40037:80:80801:40037:80:8080………0:40057:80:8080???1:40087:80:8080???5:40037:80:8080SrcIPAddressRealServer01……5PersistenceTable負(fù)載均衡器源地址會話保持--SourceAddressPersistence根據(jù)client的源P地址Netmask->AddressRange12312301IfNetmaskis07CookiePersistenceInsertmodeBIG-IPLTMInsertsacookieintothestreamRewritemodeWebservercreatescookieandBIG-IPLTMchangesitPassivemodeWebservercreatescookieandBIG-IPLTMreadsitClientServerHTTPrequest(nospecialcookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecialcookie)HTTPreply(nospecialcookie)HTTPreply(withinsertedcookie)pick

serverHTTPrequest(withsamecookie)TCPhandshakeTCPhandshakeHTTPrequest(nospecial

cookie)HTTPreply(nospecialcookie)HTTPreply(updatedcookie)cookie

specifies

serverFirstHitSecondHitCookieInsertMode源地址轉(zhuǎn)換SNATs

Internet02多對一的轉(zhuǎn)換Many-to-onemappingTraffictoSNATAddressisrefusedCanshareIPwithVirtualServerSNATs–典型數(shù)據(jù)流

Internet02:400103:8002:3300103:80源地址會轉(zhuǎn)換成SNAT的地址請注意源端口Server03:80SNATs–數(shù)據(jù)流的回包

InternetSNATIPAddress0203:80:400103:80

02:33001數(shù)據(jù)流的回應(yīng)包地址會轉(zhuǎn)換回來Server03:80SNATTable