IOS Server Load Balancing

Transcription

1 IOS Server Load Balancing This feature module describes the Cisco IOS Server Load Balancing (SLB) feature. It includes the following sections: Feature Overview, page 1 Supported Platforms, page 5 Supported Standards, MIBs, and RFCs, page 5 Configuration Tasks, page 6 Monitoring and Maintaining IOS SLB, page 11 Configuration Examples, page 12 Reference, page 14 Debug s, page 50 Glossary, page 53 Feature Overview The IOS SLB feature is an IOS-based solution that provides IP server load balancing. Using the IOS SLB feature, the network administrator defines a virtual server that represents a group of real servers in a cluster of network servers known as a server farm. In this environment the clients are configured to connect to the IP address of the virtual server. The virtual server IP address is configured as a loopback address, or secondary IP address, on each of the real servers. When a client initiates a connection to the virtual server, the IOS SLB function chooses a real server for the connection based on a configured load balancing algorithm. Figure 1 illustrates IOS SLB. 1

2 Feature Overview IOS Server Load Balancing Figure 1 Logical View of IOS SLB Virtual server Real server Real server Real server Catalyst 4840G with IOS SLB Client Client Client Client IOS SLB Features This section describes the features supported in IOS SLB. It includes information on the following features: Load Balancing Algorithms, page 2 Port-Bound Servers, page 3 Client-Assigned Load Balancing, page 3 Sticky Connections, page 3 Maximum Connections, page 4 Delayed Removal of TCP Connection Context, page 4 TCP Session Reassignment, page 4 Automatic Server Failure Detection, page 4 Auto Unfail, page 4 Slow Start, page 4 SynGuard, page 5 IOS SLB Dynamic Feedback Protocol, page 5 Load Balancing Algorithms IOS SLB provides two load balancing algorithms: weighted round robin and weighted least connections. You may specify either algorithm as the basis for choosing a real server for each new connection request that arrives at the virtual server. 2

3 IOS Server Load Balancing Feature Overview Weighted Round Robin Weighted Least Connections Port-Bound Servers The weighted round robin algorithm specifies that the real server used for a new connection to the virtual server is chosen from the server farm in a circular fashion. Each real server is assigned a weight, n, that represents its capacity to handle connections, as compared to the other real servers associated with the virtual server. That is, new connections are assigned to a given real server n times before the next real server in the server farm is chosen. For example, assume a server farm comprised of real server ServerA with n = 3, ServerB with n = 1, and ServerC with n = 2. The first three connections to the virtual server are assigned to ServerA, the fourth connection to ServerB, and the fifth and sixth connections to ServerC. The weighted least connections algorithm specifies that the next real server chosen from a server farm for a new connection to the virtual server is the server with the fewest active connections. Each real server is assigned a weight for this algorithm, also. When weights are assigned, the server with the fewest connections is based on the number of active connections on each server, and on the relative capacity of each server. The capacity of a given real server is calculated as the assigned weight of that server divided by the sum of the assigned weights of all of the real servers associated with that virtual server, or n 1 /(n 1 +n 2 +n 3...). For example, assume a server farm comprised of real server ServerA with n = 3, ServerB with n = 1, and ServerC with n = 2. ServerA would have a calculated capacity of 3/(3+1+2), or half of all active connections on the virtual server, ServerB one-sixth of all active connections, and ServerC one-third of all active connections. At any point in time, the next connection to the virtual server would be assigned to the real server whose number of active connections is farthest below its calculated capacity. You must specify which Transmission Control Protocol/User Datagram Protocol (TCP/UDP) port a virtual server handles. The port-bound servers feature allows one virtual server IP address to represent one set of real servers for one service, such as Hypertext Transfer Protocol (HTTP), and a different set of real servers for another service, such as Telnet. Packets destined to a virtual server address for a port that is not specified in a virtual server definition are not redirected. Client-Assigned Load Balancing The client-assigned load balancing feature allows you to limit the subnets that use a virtual server. Sticky Connections The sticky connections feature allows new connections from a client IP address to be assigned to the same real server as previous connections from the same client address. This behavior is controlled by a configurable timer. If the timer is configured on a virtual server, new connections from a client are sent to the same real server that handled the previous client connection, provided that: An existing connection for the same client exists, or The amount of time between the end of a previous connection from the client and the start of the new connection is within the timer duration. 3

4 Feature Overview IOS Server Load Balancing The sticky connection feature also permits the coupling of services that are handled by more than one virtual server. This feature allows connection requests for related services to use the same real server. For example, Web server (HTTP) typically uses TCP port 80, and HTTP over Secure Socket Layer (HTTPS) uses port 443. If HTTP virtual servers and HTTPS virtual servers are coupled, connections for ports 80 and 443 from the same client IP address are assigned to the same real server. Maximum Connections The maximum connections feature allows you to configure a limit on the number of active connections that a real server can handle. Delayed Removal of TCP Connection Context Because of IP packet ordering anomalies, IOS SLB might see the termination of a TCP connection (a finish [FIN] or reset [RST]) followed by other packets for the connection. This problem occurs when there are multiple paths that the TCP connection packets can follow. To correctly redirect the packets that arrive after the connection is terminated, IOS SLB retains the TCP connection information, or context, for a specified length of time. The length of time the context is retained after the connection is terminated is controlled by a configurable delay timer. TCP Session Reassignment IOS SLB tracks each TCP synchronous idle character (SYN) sent to a real server by a client attempting to open a new connection. If several consecutive SYNs are not answered, or if a SYN is replied to with a RST, the TCP session is reassigned to a new real server. The number of SYN attempts is controlled by a configurable reassign threshold. Automatic Server Failure Detection IOS SLB automatically detects each failed connection attempt to a real server, and increments a failure counter for that server. (The failure counter is not incremented if a failed connection from the same client has already been counted.) If a server s failure counter exceeds a configurable failure threshold, the server is considered out of service and is removed from the list of active real servers. Auto Unfail When a real server fails and is removed from the list of active servers, it is assigned no new connections for an amount of time specified by a configurable retry timer. After that timer expires, the server is again eligible for new virtual server connections and IOS SLB sends the server the next connection for which it qualifies. If the connection is successful, the failed server is placed back on the list of active real servers. If the connection is unsuccessful, the server remains out of service and the retry timer is reset. Slow Start In an environment that uses weighted least connections load balancing, a real server that is placed in service initially has no connections, and could therefore be assigned so many new connections that it becomes overloaded. To prevent such an overload, the slow start feature controls the number of new connections that are directed to a real server that has just been placed in service. 4

5 IOS Server Load Balancing Supported Platforms SynGuard The SynGuard feature limits the rate of TCP SYNs handled by a virtual server to prevent a type of network problem known as a SYN flood denial of service attack. A user might send a large number of SYNs to a server, which would overwhelm or crash the server, denying service to other users. The SynGuard feature prevents a SYN flood denial of service attack from bringing down IOS SLB or a real server. SynGuard monitors the number of SYNs to a virtual server over a specific time interval and does not allow the number to exceed a configured SYN threshold. Once the threshold is reached, any new SYNs are dropped. IOS SLB Dynamic Feedback Protocol The IOS SLB Dynamic Feedback Protocol (DFP) is a mechanism that allows host agents in load balanced environments to dynamically report the change in status of the host systems providing a virtual service. The status reported is a relative weight that specifies a host server s capacity to perform work. Benefits IOS SLB facilitates scalability and availability. The addition of new servers and the removal or failure of existing servers can occur at any time without affecting the availability of the virtual server. Restrictions IOS SLB has the following restrictions: Operates in a standalone mode and currently does not operate as a MultiNode Load Balancing (MNLB) Services Manager. The presence of IOS SLB does not preclude the use of the existing MNLB Forwarding Agent with an external Services Manager in an MNLB environment. Operates in dispatch mode only. Real servers must be Layer-2 adjacent, or tag switching must be implemented. Does not support coordinating server load balancing statistics among different IOS SLB instances for backup capability. Supported Platforms Catalyst 6000 Series Cisco 7200 Series Supported Standards, MIBs, and RFCs Standards No new or modified standards are supported by this feature. MIBs No new or modified MIBs are supported by this feature. 5

6 Configuration Tasks IOS Server Load Balancing RFCs No new or modified RFCs are supported by this feature. Configuration Tasks Configuring IOS SLB involves identifying server farms, configuring groups of real servers in server farms, and configuring the virtual servers that represent the real servers. See the following sections for configuration tasks for the IOS SLB feature. Perform these tasks in the order given. Some of the tasks are required; others are optional. Specifying a Server Farm (Required), page 6 Specifying a Load Balancing Algorithm (Optional), page 7 Specifying a Bind ID (Optional), page 7 Specifying a Real Server (Required), page 7 Configuring Real Server Attributes (Optional), page 8 Enabling the Real Server for Service (Required), page 8 Specifying a Virtual Server (Required), page 8 Associating a Virtual Server with a Server Farm (Required), page 9 Configuring Virtual Server Attributes (Required), page 9 Adjusting Virtual Server Values (Optional), page 9 Preventing Advertisement of Virtual Server Address (Optional), page 10 Enabling the Virtual Server for Service (Required), page 10 Configuring IOS SLB Dynamic Feedback Protocol (Optional), page 10 Verifying IOS SLB, page 11 Specifying a Server Farm (Required) Grouping real servers into server farms is an essential part of IOS SLB. Using server farms enables IOS SLB to assign new connections to the real servers based on their weighted capacities, and on the load balancing algorithms used. To configure a server farm, use the following command in global configuration mode: Router(config)# ip slb serverfarm serverfarm-name Purpose Adds a server farm definition to the IOS SLB configuration and initiates server farm configuration mode. See the ip slb serverfarm command for more details. 6

7 IOS Server Load Balancing Configuration Tasks Specifying a Load Balancing Algorithm (Optional) To determine which real server to use for each new connection request, the IOS SLB feature uses one of two load balancing algorithms: weighted round robin (the default) or weighted least connections. (See the Weighted Round Robin section on page 3 or the Weighted Least Connections section on page 3 for detailed descriptions of these algorithms.) To specify the load balancing algorithm, use the following command in server farm configuration mode: Router(config-slb-sfarm)# predictor [roundrobin leastconns] Purpose Specifies whether the weighted round robin algorithm or the weighted least connections algorithm is to be used to determine how a real server is selected. See the predictor command for more details. Specifying a Bind ID (Optional) To configure a bind ID on the server farm for use by DFP, use the following command in server farm configuration mode: Router(config-slb-sfarm)# bindid [bind_id] Purpose Specifies a bind ID on the server farm for use by DFP. See the bindid command for more details. Specifying a Real Server (Required) A server farm comprises a number of real servers. The real servers are the physical devices that provide the services that are load balanced. To identify a real server in your network, use the following command in server farm configuration mode: Router(config-slb-sfarm)# real ip-address Purpose Identifies a real server to the IOS SLB function and initiates real server configuration mode. See the real command for more details. 7

8 Configuration Tasks IOS Server Load Balancing Configuring Real Server Attributes (Optional) You can configure any of the following real server attributes, by using the following commands in real server configuration mode: Router(config-slb-real)# faildetect numconns number-conns [numclients number-clients] Router(config-slb-real)# maxconns number-conns Router(config-slb-real)# reassign threshold Router(config-slb-real)# retry retry-value Router(config-slb-real)# weight weighting-value Purpose Specifies the number of consecutive connection failures and, optionally, the number of unique client connection failures, that constitute failure of the real server. See the faildetect command for more details. Specifies the maximum number of active connections allowed on the real server at one time. See the maxconns command for more details. Specifies the number of consecutive unanswered SYNs that initiates reassignment of the connection to another real server. See the reassign command for more details. Specifies the interval, in seconds, that must elapse between the detection of a server failure and the next attempt to connect to the failed server. See the retry command for more details. Specifies the real server s workload capacity relative to other servers in the server farm. See the weight command for more details. Enabling the Real Server for Service (Required) To place the real server into service, use the following command in real server configuration mode: Router(config-slb-real)# inservice Purpose Enables the real server for use by IOS SLB. See the inservice (real server) command for more details. Specifying a Virtual Server (Required) To specify a virtual server, use the following command in global configuration mode: Router(config)# ip slb vserver virtserver-name Purpose Identifies a virtual server and initiates virtual server configuration mode. See the ip slb vserver command for more details. 8

9 IOS Server Load Balancing Configuration Tasks Associating a Virtual Server with a Server Farm (Required) To associate the virtual server with a server farm, use the following command in virtual server configuration mode: Router(config-slb-vserver)# serverfarm serverfarm-name Purpose Associates a real server farm with a virtual server. See the serverfarm command for more details. Configuring Virtual Server Attributes (Required) To configure virtual server attributes, use the following command in virtual server configuration mode: Router(config-slb-vserver)# virtual ip-address {tcp udp} port-number [service service-name] Purpose Specifies the virtual server IP address, type of connection, port number, and optional service coupling. See the virtual command for more details. Adjusting Virtual Server Values (Optional) To change the default settings of the virtual server values, use the related command in virtual server configuration mode: Router(config-slb-vserver)# client ip-address network-mask Router(config-slb-vserver)# delay duration Router(config-slb-vserver)# idle duration Purpose Specifies which clients are allowed to use the virtual server. See the client command for more details. Specifies the amount of time IOS SLB maintains TCP connection context after a connection has terminated. The default value is 10 seconds. See the delay command for more details. Specifies the minimum amount of time IOS SLB maintains connection context in the absence of packet activity for a connection. The default value is 3600 seconds (60 hours). See the idle command for more details. 9

10 Configuration Tasks IOS Server Load Balancing Router(config-slb-vserver)# sticky duration [group group-id] Router(config-slb-vserver)# synguard syn-count interval Purpose Specifies that connections from the same client use the same real server, providing that the interval between client connections does not exceed the specified duration. See the sticky command for more details. Specifies the rate of TCP SYNs handled by a virtual server in order to prevent a SYN flood denial of service attack. See the synguard command for more details. Preventing Advertisement of Virtual Server Address (Optional) By default, virtual server addresses are advertised. That is, static routes to the Null0 interface are installed for the virtual server addresses. To advertise these static routes using the routing protocol, you must configure redistribution of static routes for the routing protocol. To prevent the installation of a static route, use the no form of the advertise command, in virtual server configuration mode: Router(config-slb-vserver)# no advertise Purpose Omits the virtual server IP address from the routing protocol updates. See the advertise command for more details. Enabling the Virtual Server for Service (Required) To place the virtual server into service, use the following command in virtual server configuration mode: Router(config-slb-vserver)# inservice Purpose Enables the virtual server for use by IOS SLB. See the inservice (virtual server) command for more details. Configuring IOS SLB Dynamic Feedback Protocol (Optional) To configure IOS SLB DFP, enter the following commands in order, beginning in global configuration mode: Step 1 Step 2 Router(config)# ip slb dfp [password password [timeout]] Router(config-slb-dfp)# agent ip_address port [timeout [retry_count [retry_interval]]] Purpose Configures DFP and, optionally, sets a password and initiates DFP configuration mode. See the ip slb dfp command for more details. Configures a DFP agent. See the agent command for more details. 10

11 IOS Server Load Balancing Monitoring and Maintaining IOS SLB Verifying IOS SLB To verify that the IOS SLB feature has been installed and is operating correctly, ping the real servers from IOS SLB, then ping the virtual servers from the clients. Monitoring and Maintaining IOS SLB To obtain and display runtime information about IOS SLB, use the following commands in EXEC mode: Router# show ip slb conns [vserver virtserver-name] [client ip-address] [detail] Router# show ip slb dfp [agent ip_addr port] [detail] [weights] Router# show ip slb reals [vserver virtserver-name] [detail] Router# show ip slb serverfarms [name serverfarm-name] [detail] Router# show ip slb stats Router# show ip slb sticky [client ip-address] Router# show ip slb vservers [name virtserver-name] [detail] Purpose Displays all connections handled by IOS SLB, or, optionally, only those connections associated with a particular virtual server or client. See the show ip slb conns command for more details. Displays information about DFP and DFP agents, and about the weights assigned to real servers. See the show ip slb dfp command for more details. Displays information about the real servers defined to IOS SLB. See the show ip slb reals command for more details. Displays information about the server farms defined to IOS SLB. See the show ip slb serverfarms command for more details. Displays IOS SLB statistics. See the show ip slb stats command for more details. Displays information about the sticky connections defined to IOS SLB. See the show ip slb sticky command for more details. Displays information about the virtual servers defined to IOS SLB. See the show ip slb vservers command for more details. 11

12 Configuration Examples IOS Server Load Balancing Configuration Examples This section provides a configuration example based on the network layout shown in Figure 2. Figure 2 Network Configuration for IOS SLB Web server Web server Web server Restricted web server Restricted web server x Virtual server x Client Human Resources Client Client As shown in the following sample code, the example topology has three public Web servers and two restricted Web servers for privileged clients in subnet x. The public Web servers are weighted according to their capacity, with server having the lowest capacity and having a connection limit imposed on it. The restricted Web servers are configured as members of the same sticky group, so that HTTP connections and Secure Socket Layer (SSL) connections from the same client use the same real server. 12

13 IOS Server Load Balancing Configuration Examples This configuration is coded as follows:! ip slb serverfarm PUBLIC predictor leastconns real weight 16 inservice real weight 4 maxconns 1000 inservice real weight 24 inservice! ip slb serverfarm RESTRICTED predictor leastconns real in-service real in-service! ip slb vserver PUBLIC_HTTP virtual tcp www serverfarm PUBLIC inservice! ip slb vserver RESTRICTED_HTTP virtual tcp www serverfarm RESTRICTED client sticky 60 group 1 inservice! ip slb vserver RESTRICTED_SSL virtual tcp https serverfarm RESTRICTED client sticky 60 group 1 inservice Unrestricted Web server farm Use weighted least connections algorithm First real server Second real server Restrict maximum number of connections Third real server Restricted Web server farm Use weighted least connections algorithm First real server Second real server Unrestricted Web virtual server Handle HTTP requests Use public Web server farm Restricted HTTP virtual server Handle HTTP requests Use restricted Web server farm Only allow clients from x Couple connections with RESTRICTED_SSL Restricted SSL virtual server Handle SSL requests Use restricted Web server farm Only allow clients from x Couple connections with RESTRICTED_WEB 13

14 Reference IOS Server Load Balancing Reference This section documents new or modified commands. All other commands used with this feature are documented in the Cisco IOS 12.0 and 12.0(5)T command reference publications. advertise agent bindid client delay faildetect idle inservice (real server) inservice (virtual server) ip slb dfp ip slb serverfarm ip slb vserver maxconns predictor real reassign retry serverfarm show ip slb conns show ip slb dfp show ip slb reals show ip slb serverfarms show ip slb stats show ip slb sticky show ip slb vservers sticky synguard virtual weight In Cisco IOS 12.0(1)T or later, you can search and filter the output for show and more commands. This functionality is useful when you need to sort through large amounts of output, or if you want to exclude output that you do not need to see. To use this functionality, enter a show or more command followed by the pipe character ( ), one of the keywords begin, include, or exclude, and an expression that you want to search or filter on: command {begin include exclude} regular-expression 14

15 IOS Server Load Balancing Reference Following is an example of the show atm vc command in which you want the command output to begin with the first line where the expression PeakRate appears: show atm vc begin PeakRate For more information on the search and filter functionality, refer to the Cisco IOS 12.0(1)T feature module titled CLI String Search. 15

16 advertise IOS Server Load Balancing advertise To control the installation of a static route to the Null0 interface for a virtual server address, use the advertise virtual server configuration command. Advertisement of this static route using the routing protocol requires that you configure redistribution of static routes for the routing protocol. To prevent the installation of a static route for the virtual server IP address, use the no form of this command. advertise no advertise This command has no arguments or keywords. Defaults The virtual server IP address is added to the routing table. Modes Virtual server configuration History Examples The following example prevents advertisement of the virtual server s IP address in routing protocol updates: no advertise 16

17 IOS Server Load Balancing agent agent To configure a DFP agent, use the agent DFP configuration command. To remove an agent definition from the DFP configuration, use the no form of this command. agent ip-address port [timeout [retry_count [retry_interval]]] no agent ip-address port ip-address port timeout Agent IP address Agent port number (Optional) Time period, in seconds, during which the DFP manager must receive an update from the DFP agent. The default is 0 seconds, which means there is no timeout. retry_count (Optional) Number of times DFP manager attempts to establish the TCP connection to the DFP agent. The default is 0 retries, which means there are infinite retries. retry_interval (Optional) Interval, in seconds, between retries. The default is 180 seconds. Defaults Timeout default: 0 seconds (no timeout) Retry_count default: 0 (infinite retries) Retry_interval default: 180 seconds Modes DFP configuration History Usage Guidelines You can configure up to 1024 agents. A DFP agent collects status information about a server s load capability and reports that information to a load manager. The DFP agent may reside on the server, or it may be a separate device that collects and consolidates the information from several servers before reporting to the load manager. Examples The following example configures a DFP agent: agent

18 agent IOS Server Load Balancing Related s Description ip slb dfp Configures the IOS SLB DFP. 18

19 IOS Server Load Balancing bindid bindid To configure a bind ID, use the bindid server farm configuration command. To remove a bind ID from the server farm configuration, use the no form of this command. bindid [bind_id] no bindid [bind_id] bind_id (Optional) Bind ID number. The default bind ID is 0. Defaults Bind_id default: 0 Modes Server farm configuration History Usage Guidelines You can configure one bind ID on each bindid command. The bind ID allows a single physical server to be bound to multiple virtual servers and report a different weight for each one. Thus, the single real server is represented as multiple instances of itself, each having a different bind ID. DFP uses the bind ID to identify which instance of the real server a given weight is for. Examples The following example configures bind ID 309: bindid 309 Related s ip slb dfp Description Configures the IOS SLB DFP. 19

20 client IOS Server Load Balancing client To define which clients are allowed to use the virtual server, use the client virtual server configuration command. You can use more than one client command to define more than one client. To remove a client definition from the IOS SLB configuration, use the no form of this command. client ip-address network-mask no client ip-address network-mask ip-address network-mask Client IP address. The default is (all clients). Client IP network mask. The default is (all subnetworks). Defaults Ip_address default: (all clients) Network_mask default: (all subnetworks) Taken together, the default is client (allow all clients on all subnetworks to use the virtual server). Modes Virtual server configuration History Usage Guidelines The network-mask value is applied to the source IP address of incoming connections. The result must match the ip-address value for the client to be allowed to use the virtual server. Examples The following example allows only clients from x access to the virtual server: client Related s virtual Description Configures the virtual server attributes. 20

21 IOS Server Load Balancing delay delay To change the amount of time IOS SLB maintains TCP connection context after a connection has terminated, use the delay virtual server configuration command. To restore the default delay timer, use the no form of this command. delay duration no delay duration Delay timer duration in seconds. The valid range is 1 to 600 seconds. The default value is 10 seconds. Defaults Duration default: 10 seconds Modes Virtual server configuration History Examples The following example specifies that IOS SLB maintains TCP connection context for 30 seconds after a connection has terminated: delay 30 Related s virtual Description Configures the virtual server attributes. 21

22 faildetect IOS Server Load Balancing faildetect To specify the conditions that indicate a server failure, use the faildetect real server configuration command. To restore the default values that indicate a server failure, use the no form of this command. faildetect numconns number-conns [numclients number-clients] no faildetect numconns Number of consecutive TCP connection reassignments allowed before a real server is considered to have failed. number-conns Connection reassignment threshold value in the range from 1 to 255. The default is 8 connection failures. numclients number-clients (Optional) Number of unique client connection failures, which, together with the server connection reassignment threshold, constitutes failure of a real server. (Optional) Client connection reassignment threshold value in the range from 1 to 8. The default is whichever value is less, number-conns or 8. Defaults If the faildetect command is not specified, the default value of the connection reassignment threshold is 8. If the numclients keyword is not specified, the default value of the unique client failure threshold is whichever value is less, number-conns or 8. Modes Real server configuration History Examples In the following example the connection reassignment threshold is set to 16 and, because the number-clients keyword is not configured, the threshold for unique client connection failure is set to the default value 8. The real server is considered to have failed when 8 unique clients have had connection failure and there have been 16 connection reassignments. faildetect numconns 16 Related s real Description Identifies a real server. 22