ACE-1/routed #show sticky database static. ACE-1/routed #show service-policy client-vips. ACE-1/routed #show service-policy client-vips detail

Transcription

1 W M A C E E x a m Using C o o k ie L e a r ning f o r S e ssio n P e r sist e nc e o n t h e C isc o A p p l ic a t io n C o nt r o l E ngine Goal Configure b a sic l oa d b a l a nc ing w it h c ook ie l ea rning w h ere c l ient t ra ffic ent ers on one net w ork a nd is d irec t ed t o serv ers resid ing on a sec ond net w ork. O nc e t h e c l ient h a s ent ered t h e sit e t h ey w il l rem a in st uc k t o a giv en serv er b a sed on a H TTP Cook ie l ea rned b y ACE from t h e serv er. D e s i g n Cl ient s w il l send a p p l ic a t ion req uest s t h rough t h e m ul t il a y er sw it c h fea t ure c a rd ( M S F C), w h ic h rout es t h em t o a v irt ua l I P a d d ress ( V I P) w it h in t h e Cisc o Ap p l ic a t ion Cont rol E ngine ( ACE ). Th e V I P used in t h is ex a m p l e resid es in a n ACE c ont ex t, w h ic h is c onfigured w it h a c l ient V L AN a nd a serv er V L AN ( F igure 1 ). Cl ient req uest s w il l a rriv e a t t h e V I P, a nd t h e ACE w il l c h ec k t h e req uest t o see if it c ont a ins a c ook ie. I f it d oes, t h e st ic k y t a b l e w il l b e c h ec k ed t o see w h ic h serv er sh oul d rec eiv e t h e req uest. I f t h e c ook ie ent ry h a s ex p ired, or if t h e c l ient d oes not h a v e a c ook ie t h e ACE w il l p ic k t h e a p p rop ria t e serv er t o rec eiv e t h e req uest b a sed on t h e req uest ed U R L. W h en t h e serv er resp ond s ACE w il l l ea rn t h e c ook ie v a l ue found w it h in t h e H TTP R esp onse so t h a t up on fut ure req uest s c l ient p ersist enc e t o t h e serv er w il l b e m a int a ined. Figure 1. E x a m p l e o f a N e t w o r k T o p o l o g y U s i n g a C i s c o A p p l i c a t i o n C o n t r o l E n g i n e S erv ers Int: V IP : l ien t Inte r ne t S FC V L A N 20 C E V L A N PIC H T T P R eq u est 1 (no cook ie) H T T P R eq u est 2 (w / cook ie= sv r2) C on f i g u r at i on H T T P R esponse 1 (cook ie learned b y ACE ) H T T P R esponse 2 (cook ie entry ref reshed ) PIC H T T P R esponse 1 (S et-cook ie= sv r2) H T T P R esponse 2 (S et-cook ie= sv r2) it h in t h e Cisc o ACE st ic k y resourc es a re finit e a nd a re c ont rol l ed v ia resourc e a l l oc a t ion. B efore a c ont ex t c a n a p p l y session p ersist enc e using st ic k y group s, t h e c ont ex t m ust first b e giv en a st ic k y a l l oc a t ion. O nc e t h is is d one, a st ic k y group is c rea t ed t o d efine p a ra m et ers a nd t h e serv erfa rm w h ere c l ient req uest s w il l b e sent. R ec a l l, t h e l oa d b a l a nc ing a c t ion t el l s ACE h ow t o h a nd l e t ra ffic w h ic h h a s h it a V I P. Th us t h e st ic k y group on ACE is a p p l ied w it h in t h e l oa d b a l a nc e p ol ic y -m a p. To ena b l e serv er l oa d -b a l a nc ing w it h session p ersist enc e b a sed on c ook ies ACE l ea rns y ou need All contents are Copyright Cisco S ystem s, I nc. All rights reserv ed. T his d ocu m ent is Cisco P u b lic I nf orm ation. P age 1 of 6

2 O A C E E x a m t o d o t h e fol l ow ing: Allocate sticky resources to the context E na b l e ACL s t o a l l ow d a t a t ra ffic t h rough t h e ACE d ev ic e, a s it is d enied b y d efa ul t. Configure t h e I Ps of t h e serv ers ( d efine rserv ers) G roup t h e rea l serv ers ( c rea t e a serv erfa rm ) C reate a sticky g roup D efine t h e v irt ua l I P a d d ress ( V I P) D efine h ow t ra ffic is t o b e h a nd l ed a s it is rec eiv ed ( c rea t e a p ol ic y m Ap p ly the sticky g roup to the load b alancing p olicy a p for l oa d b a l a nc ing) t a V I t a h a l a c t ( c t a m t a t c h p y m a p [ a p y ] t c l a c c p l y t h V I a p t c l c t t t h c ( a p p l y a c c a p y t c N F b y y t h b d a c t h d t h M d m a t b a U R L l d b a l a a t h b a c t Assoc ia e P o nd ing ion rea e ul im ol ic serv ic e ol ic ) Crea e ient - nd serv er-fa ing int erfa es Ap e P nd ACL erm it ing ient onnec ions o e int erfa e ess group nd serv ic e ol ic o int erfa e) ote: or rev it onl e ol st ep s re ov ered in is oc um ent. Pl ea se rev iew e URL Load Balancing using Routed ode oc um ent for ore inform ion on sic oa nc ing nd e se onfigura ion. To b egin t h e c onfigura t ion, a l l oc a t e st ic k y resourc es t o t h e c ont ex t y ou w il l b e using. I n t h is ex a m p l e a c ont ex t rout ed h a s a l rea d y b een d efined. Crea t e a resourc e c l a ss, a l l oc a t e t h e d esired a m ount of st ic k y ent ries, a nd a p p l y t h em t o t h e rout ed c ont ex t. ACE-1/ Ad m i n# show run begin routed c o nt ex t ro u t ed a l l o c a t e-i nt erf a c e v l a n 10 a l l o c a t e-i nt erf a c e v l a n 2 0 a l l o c a t e-i nt erf a c e v l a n 4 0 ACE-1/ Ad m i n( c o nf i g ) # resourc e-c l a ss stic k y ACE-1/ Ad m i n( c o nf i g -res o u rc e) # l im it-resourc e a l l m inim um m a x im um unl im ited ACE-1/ Ad m i n( c o nf i g -res o u rc e) # l im it-resourc e stic k y m inim um m a x im um eq ua l -to-m in ACE-1/ Ad m i n( c o nf i g ) # c ontex t routed ACE-1/ Ad m i n( c o nf i g -c o nt ex t ) # m em ber stic k y N ote: At t h is t im e st ic k y resourc es a re a fix ed resourc e out sid e t h e ot h er resourc es. Th us y ou m ust use m a x im um eq ua l -t o-m in a nd y ou m ust d efine st ic k y resourc es ev en is a l l is p rev iousl y used. Th is a l so a p p l ies t o t h e Ad m in c ont ex t. nc e t h e resourc es h a v e b een a l l oc a t ed a st ic k y group c a n b e d efined. Th e Cisc o ACE c a n b e c onfigured in v a rious w a y s t o a p p l y session p ersist enc e using c ook ies. F or t h is ex a m p l e c ook ie l ea rning w il l b e used. Th e c ook ie na m e ACE w il l a t t em p t t o l ea rn is sup p l ied w h en t h e st ic k y group is c rea t ed. B y d efa ul t ACE l ea rns c ook ies a nd t h ese ent ries h a v e a id l e t im t h e c onfigura t ion b el ow ACE w il l l ea rn t h e v a l ue of a c ook ie w it h t h e na m eout of 2 4 h ours. U sing e J S essioni D. Th e session w il l t im eout a ft er 5 m inut es of no new c onnec t ions/ req uest s c ont a ining t h is c ook ie v a l ue. Th e ACE w il l use a p re-ex ist ing serv erfa rm na m ed w eb fa rm. ACE-1/ ro u t ed ( c o nf i g ) # stic k y http -c ook ie J S essioni D web-stic k y ACE-1/ ro u t ed ( c o nf i g -s t i c k y -c o o k i e) # tim eout 5 ACE-1/ ro u t ed ( c o nf i g -s t i c k y -c o o k i e) # serv erf a rm webf a rm All contents are Copyright Cisco S ystem s, I nc. All rights reserv ed. T his d ocu m ent is Cisco P u b lic I nf orm ation. P age 2 of 6

3 W W A C E E x a m Th e serv erfa rm w it h in t h e l oa d b a l a nc ing p ol ic y m a p m ust b e sw a p p ed w it h t h e st ic k y group t o a p p l y c ook ie l ea rning t o new c l ient req uest s. B a sed on t h is ex a m p ossib l e a c t ions for h a nd l ing new c l ient req uest s. Any req uest s for im p l e c onfigura t ion t h ere a re t w o a ges w il l b e sent t o t h e im a gefa rm serv erfa rm, w h ic h d oes not req uire p ersist enc e. Al l ot h er req uest s w il l b e sent t o t h e w eb serv ers in t h e w eb fa rm w h ere t h e c l ient s w il l use session p ersist enc e. ACE-1/ ro u t ed ( c o nf i g ) # p ol ic y-m a p typ e l oa dba l a nc e http f irst-m a tc h sl b- l ogic ACE-1/ ro u t ed ( c o nf i g -p m a p -l b -c ) # c l a ss c l a ss-def a ul t ACE-1/ ro u t ed ( c o nf i g -p m a p -l b -c ) # no serv erf a rm webf a rm ACE-1/ ro u t ed ( c o nf i g -p m a p -l b -c ) # stic k y-serv erf a rm web-stic k y N ote: Ch a nging from a serv erfa rm t o a st ic k y group is p ot ent ia l l y serv ic e im p a c t ing. h il e c urrent c onnec t ions w il l b e a l l ow ed t o finish, new c onnec t ions w il l not b e a c c ep t ed d t h a l t h a a p p l y t h k y t t h l d b a l a p y h c l a p p l t h a t h h t t p k y d a t a b a uring e rem ov of e serv erfa rm nd ing e st ic group o e oa nc e ol ic. en ook ie ea rning is ied ere re no ent ries in e -c ook ie st ic se. As new c onnec t ions a rriv e, a nd c ook ies a re l ea rned new ent ry ies for ea c h c l ient w il l b e st ored in t h e st ic k y d a t a b a se for h t t p -c ook ies. I n t h is ex a m p l e t h ere a re t w o ent ries c rea t ed. u t ( c o i g m a p b ) # k s t i c k y g u p : w t i c k y t y p : H T T P O K I t i m u t : 5 t i m u t c t i v o : F S l s t i c k y g u p : w t i c k y t y p : H T T P O K I t i m u t : 5 t i m u t c t i v o : F S l 2 : ACE-1/ ro ed nf -p -l -c do show stic y da ta ba se http -c ook ie ro eb -s e -CO E eo eo -a ec nns AL E nx 1: ro eb -s e -CO E eo eo -a ec nns AL E nx N ote: Th e st ic k y -ent ry is a h a sh of t h e c ook ie-v a l ue set b y ACE for t h e rea l serv er. I t w il l not a p p ea r in a sniffer t ra c e or on t h e c l ient b row ser. S ee t h e c om m ent sec t ion b el ow for d et erm ining w h ic h serv er a c l ient is a ssoc ia t ed t o v ia t h e c ook ie v a l ue. W h a c l c t t t h V I t h d d t m l p a t h w t h p t h c l w l a c t h t t a l l w l c t t h m W h t h w a y t h m a c l h a v a c a t h c m c m a w l p d a t h a a h d a t a a t R a l l t h a a t c h a t h k y I t h c a t h y k y a c a t h c a 2 l t h p t h a t k y c m a d l a y 2 d t h b c l t h V I en ient onnec s o e P ey ow nl oa ind ex.h ge from e eb serv ers. At is oint e ient il get ook ie for e sel ec ed serv er o ensure fut ure req uest s il ont inue o use e sa e serv er. il e ere is no o see ow ny ient s e ook ie for giv en serv er e om on sh ow om nd s il rov id e et il s on e inc om ing req uest s nd resp onses nd ot er st s. ec, e Cisc o ACE insert s st ic ent ry for ea serv er in serv er fa rm in e st ic group. n is se ere is onl one st ic group nd it uses ook ie-insert nd e serv erfa rm ont ins rea serv ers. Th us e out ut of e sh ow st s st ic om nd isp s ent ries, esp it e e num er of ient s using e P. All contents are Copyright Cisco S ystem s, I nc. All rights reserv ed. T his d ocu m ent is Cisco P u b lic I nf orm ation. P age 3 of 6

4 A C E E x a m ACE-1/ ro u t ed # show sta ts stic k y S t i c k y s t a t i s t i c s T o t a l s t i c k y ent ri es reu s ed : 0 p ri o r t o ex p i ry T o t a l a c t i v e s t i c k y ent ri es : 3 T o t a l a c t i v e s t i c k y c o nns : 0 T o t a l s t a t i c s t i c k y ent ri es : 0 R e lat e d s h ow c om m an d s ACE-1/routed #show sticky database static ACE-1/routed #show service-policy client-vips ACE-1/routed #show service-policy client-vips detail ACE-1/routed #show serverfarm ACE-1/routed #show rserver ACE-1/routed #show stats C om m e n t s Th e t y p e of c ook ie ACE w il l insert d ep end s on if c ook ie-insert is c onfigured or c ook ie-insert b row ser-ex p ire is c onfigured. Th e sniffer t ra c es b el ow sh ow t h e d ifferenc e b et w een t h e t y p es of c ook ies ACE w il l insert. ACE c onfigured w it h c o o k i e i ns ert H y p ert ex t T ra ns f er P ro t o c o l H T T P / O K \r\n S et -Co o k i e: J sessioni D = ; p a t h = / ; ex p i res = T h u, 16 -O c t : 08: 5 5 G M T \r\n D a t e: F ri, 2 9 Au g : 17 : 3 5 G M T \r\n S erv er: Ap a c h e/ ( R ed H a t ) \r\n Ac c ep t -R a ng es : b y t es \r\n Co nt ent -L eng t h : 1112 \r\n V i rt u a l H o s t : \r\n Co nnec t i o n: c l o s e\r\n Co nt ent -T y p e: t ex t / h t m l ; c h a rs et = U T F -8\r\n \r\n N ot ic e t h e t w o c ook ie v a l ues d o not a p p ea r t o b e rel a t ed t o t h e st ic k y -v a l ue in t h e sh ow st ic k y d a t a b a se st a t ic out p ut, d isp l a y ed b el ow : l < s p > l 2 : nx 1: 0 nev er - ni nx 0 nev er - Th is is b ec a use t h e st ic k y -ent ry is a h a sh of t h e c ook ie v a l ue. I n ord er t o d et erm ine t h e serv er a c l ient is h it t ing one m ust m a rk t h e serv er suc h t h a t it c a n b e d ist inguish ed, p ossib l y using a H TTP H ea d er in t h e serv er resp onse, or b y d et erm ining t h e st ic k y -ent ry ACE uses for ea c h l ea rned All contents are Copyright Cisco S ystem s, I nc. All rights reserv ed. T his d ocu m ent is Cisco P u b lic I nf orm ation. P age 4 of 6

5 A C E E x a m c ook ie ent ry. Th e st ic k y -ent ry is a h a sh of t h e first b y t es of t h e c ook ie v a l ue. Th e ACE p rov id es a c om m a nd w h ic h t a k es t h e c ook ie v a l ue set b y t h e serv er a nd d isp l a y s t h e c ook ie ent ry. Th is p rov id es t h e a ssoc ia t ion b et w een a c l ient a nd a rea l serv er. ACE-1/ ro u t ed ( c o nf i g -c o nt ex t ) # show stic k y da ta ba se http -c ook ie s t i c k y g u p : w t i c k y t y p : H T T P O K I t i m u t : 5 t i m u t c t i v o : F S l 2 : ro eb -s e -CO E eo eo -a ec nns AL E nx 0 - s h ow r u n n i n g -c on f i g ACE-1/ ro u t ed # s h o w ru n G enera t i ng c o nf i g u ra t i o n.... a c c es s -l i s t ev eryone l i ne 8 ex t end ed p erm i t i p a ny a ny a c c es s -l i s t ev eryone l i ne 16 ex t end ed p erm i t i c m p a ny a ny rs erv er h o s t l nx 1 i p a d d res s rs erv er h o s t l nx 2 i p a d d res s rs erv er h o s t l nx 3 i p a d d res s rs erv er h o s t l nx 4 i p a d d res s s erv erf a rm h o s t im a gef a rm rs erv er l nx 3 rs erv er l nx 4 s erv erf a rm h o s t webf a rm rs erv er l nx 1 rs erv er l nx 2 s t i c k y h t t p -c o o k i e ACE-I ns ert web-stic k y t i m eo u t 5 s erv erf a rm w eb f a rm c l a s s -m a p t y p e h t t p l o a d b a l a nc e m a t c h -a l l im a ges 2 m a t c h h t t p u rl / i m a g es /. * c l a s s -m a p m a t c h -a l l sl b-v ip 2 m a t c h v i rt u a l -a d d res s a ny p o l i c y -m a p t y p e m a na g em ent f i rs t -m a t c h rem o t e-a c c es s c l a s s c l a s s -d ef a u l t p erm i t All contents are Copyright Cisco S ystem s, I nc. All rights reserv ed. T his d ocu m ent is Cisco P u b lic I nf orm ation. P age 5 of 6

6 A C E E x a m p o l i c y -m a p t y p e l o a d b a l a nc e h t t p f i rs t -m a t c h sl b c l a s s i m a g es s erv erf a rm im a gef a rm c l a s s c l a s s -d ef a u l t s t i c k y -s erv erf a rm web-stic k y p o l i c y -m a p m u l t i -m a t c h c l ient-v ip s c l a s s sl b-v ip l o a d b a l a nc e v i p l o a d b a l a nc e p o l i c y sl b i nt erf a c e v l a n 2 0 d es c ri p t i o n " Cl i ent S i d e" i p a d d res s a c c es s -g ro u p i np u t ev eryone s erv i c e-p o l i c y i np u t c l ient-v ip s no s h u t d o w n i nt erf a c e v l a n 4 0 d es c ri p t i o n " D ef a u l t g a t ew a y o f rea l s erv ers " i p a d d res s s erv i c e-p o l i c y i np u t rem ote-a c c ess no s h u t d o w n i p ro u t e P r i nte d i n U S A C /08 All contents are Copyright Cisco S ystem s, I nc. All rights reserv ed. T his d ocu m ent is Cisco P u b lic I nf orm ation. P age 6 of 6