IOS Server Load Balancing

Size: px
Start display at page:

Download "IOS Server Load Balancing"

Transcription

1 IOS Server Load Balancing This feature module describes the Cisco IOS Server Load Balancing (SLB) feature. It includes the following sections: Feature Overview, page 1 Supported Platforms, page 5 Supported Standards, MIBs, and RFCs, page 5 Configuration Tasks, page 6 Monitoring and Maintaining IOS SLB, page 11 Configuration Examples, page 12 Reference, page 14 Debug s, page 50 Glossary, page 53 Feature Overview The IOS SLB feature is an IOS-based solution that provides IP server load balancing. Using the IOS SLB feature, the network administrator defines a virtual server that represents a group of real servers in a cluster of network servers known as a server farm. In this environment the clients are configured to connect to the IP address of the virtual server. The virtual server IP address is configured as a loopback address, or secondary IP address, on each of the real servers. When a client initiates a connection to the virtual server, the IOS SLB function chooses a real server for the connection based on a configured load balancing algorithm. Figure 1 illustrates IOS SLB. 1

2 Feature Overview IOS Server Load Balancing Figure 1 Logical View of IOS SLB Virtual server Real server Real server Real server Cisco Device with IOS SLB Client Client Client Client IOS SLB Features This section describes the features supported in IOS SLB. It includes information on the following features: Load Balancing Algorithms, page 2 Port-Bound Servers, page 3 Client-Assigned Load Balancing, page 3 Sticky Connections, page 3 Maximum Connections, page 4 Delayed Removal of TCP Connection Context, page 4 TCP Session Reassignment, page 4 Automatic Server Failure Detection, page 4 Auto Unfail, page 4 Slow Start, page 4 SynGuard, page 5 IOS SLB Dynamic Feedback Protocol, page 5 Load Balancing Algorithms IOS SLB provides two load balancing algorithms: weighted round robin and weighted least connections. You may specify either algorithm as the basis for choosing a real server for each new connection request that arrives at the virtual server. 2

3 IOS Server Load Balancing Feature Overview Weighted Round Robin Weighted Least Connections Port-Bound Servers The weighted round robin algorithm specifies that the real server used for a new connection to the virtual server is chosen from the server farm in a circular fashion. Each real server is assigned a weight, n, that represents its capacity to handle connections, as compared to the other real servers associated with the virtual server. That is, new connections are assigned to a given real server n times before the next real server in the server farm is chosen. For example, assume a server farm comprised of real server ServerA with n = 3, ServerB with n = 1, and ServerC with n = 2. The first three connections to the virtual server are assigned to ServerA, the fourth connection to ServerB, and the fifth and sixth connections to ServerC. The weighted least connections algorithm specifies that the next real server chosen from a server farm for a new connection to the virtual server is the server with the fewest active connections. Each real server is assigned a weight for this algorithm, also. When weights are assigned, the server with the fewest connections is based on the number of active connections on each server, and on the relative capacity of each server. The capacity of a given real server is calculated as the assigned weight of that server divided by the sum of the assigned weights of all of the real servers associated with that virtual server, or n 1 /(n 1 +n 2 +n 3...). For example, assume a server farm comprised of real server ServerA with n = 3, ServerB with n = 1, and ServerC with n = 2. ServerA would have a calculated capacity of 3/(3+1+2), or half of all active connections on the virtual server, ServerB one-sixth of all active connections, and ServerC one-third of all active connections. At any point in time, the next connection to the virtual server would be assigned to the real server whose number of active connections is farthest below its calculated capacity. You must specify which Transmission Control Protocol/User Datagram Protocol (TCP/UDP) port a virtual server handles. The port-bound servers feature allows one virtual server IP address to represent one set of real servers for one service, such as Hypertext Transfer Protocol (HTTP), and a different set of real servers for another service, such as Telnet. Packets destined to a virtual server address for a port that is not specified in a virtual server definition are not redirected. Client-Assigned Load Balancing The client-assigned load balancing feature allows you to limit the subnets that use a virtual server. Sticky Connections The sticky connections feature allows new connections from a client IP address to be assigned to the same real server as previous connections from the same client address. This behavior is controlled by a configurable timer. If the timer is configured on a virtual server, new connections from a client are sent to the same real server that handled the previous client connection, provided that: An existing connection for the same client exists, or The amount of time between the end of a previous connection from the client and the start of the new connection is within the timer duration. 3

4 Feature Overview IOS Server Load Balancing The sticky connection feature also permits the coupling of services that are handled by more than one virtual server. This feature allows connection requests for related services to use the same real server. For example, Web server (HTTP) typically uses TCP port 80, and HTTP over Secure Socket Layer (HTTPS) uses port 443. If HTTP virtual servers and HTTPS virtual servers are coupled, connections for ports 80 and 443 from the same client IP address are assigned to the same real server. Maximum Connections The maximum connections feature allows you to configure a limit on the number of active connections that a real server can handle. Delayed Removal of TCP Connection Context Because of IP packet ordering anomalies, IOS SLB might see the termination of a TCP connection (a finish [FIN] or reset [RST]) followed by other packets for the connection. This problem occurs when there are multiple paths that the TCP connection packets can follow. To correctly redirect the packets that arrive after the connection is terminated, IOS SLB retains the TCP connection information, or context, for a specified length of time. The length of time the context is retained after the connection is terminated is controlled by a configurable delay timer. TCP Session Reassignment IOS SLB tracks each TCP synchronous idle character (SYN) sent to a real server by a client attempting to open a new connection. If several consecutive SYNs are not answered, or if a SYN is replied to with a RST, the TCP session is reassigned to a new real server. The number of SYN attempts is controlled by a configurable reassign threshold. Automatic Server Failure Detection IOS SLB automatically detects each failed connection attempt to a real server, and increments a failure counter for that server. (The failure counter is not incremented if a failed connection from the same client has already been counted.) If a server s failure counter exceeds a configurable failure threshold, the server is considered out of service and is removed from the list of active real servers. Auto Unfail When a real server fails and is removed from the list of active servers, it is assigned no new connections for an amount of time specified by a configurable retry timer. After that timer expires, the server is again eligible for new virtual server connections and IOS SLB sends the server the next connection for which it qualifies. If the connection is successful, the failed server is placed back on the list of active real servers. If the connection is unsuccessful, the server remains out of service and the retry timer is reset. Slow Start In an environment that uses weighted least connections load balancing, a real server that is placed in service initially has no connections, and could therefore be assigned so many new connections that it becomes overloaded. To prevent such an overload, the slow start feature controls the number of new connections that are directed to a real server that has just been placed in service. 4

5 IOS Server Load Balancing Supported Platforms SynGuard The SynGuard feature limits the rate of TCP SYNs handled by a virtual server to prevent a type of network problem known as a SYN flood denial of service attack. A user might send a large number of SYNs to a server, which would overwhelm or crash the server, denying service to other users. The SynGuard feature prevents a SYN flood denial of service attack from bringing down IOS SLB or a real server. SynGuard monitors the number of SYNs to a virtual server over a specific time interval and does not allow the number to exceed a configured SYN threshold. Once the threshold is reached, any new SYNs are dropped. IOS SLB Dynamic Feedback Protocol The IOS SLB Dynamic Feedback Protocol (DFP) is a mechanism that allows host agents in load balanced environments to dynamically report the change in status of the host systems providing a virtual service. The status reported is a relative weight that specifies a host server s capacity to perform work. Benefits IOS SLB facilitates scalability and availability. The addition of new servers and the removal or failure of existing servers can occur at any time without affecting the availability of the virtual server. Restrictions IOS SLB has the following restrictions: Operates in a standalone mode and currently does not operate as a MultiNode Load Balancing (MNLB) Services Manager. The presence of IOS SLB does not preclude the use of the existing MNLB Forwarding Agent with an external Services Manager in an MNLB environment. Operates in dispatch mode only. Real servers must be Layer-2 adjacent, or tag switching must be implemented. Does not support coordinating server load balancing statistics among different IOS SLB instances for backup capability. Supported Platforms Catalyst 6000 Series Cisco 7200 Series Supported Standards, MIBs, and RFCs Standards No new or modified standards are supported by this feature. MIBs No new or modified MIBs are supported by this feature. 5

6 Configuration Tasks IOS Server Load Balancing RFCs No new or modified RFCs are supported by this feature. Configuration Tasks Configuring IOS SLB involves identifying server farms, configuring groups of real servers in server farms, and configuring the virtual servers that represent the real servers. See the following sections for configuration tasks for the IOS SLB feature. Perform these tasks in the order given. Some of the tasks are required; others are optional. Specifying a Server Farm (Required), page 6 Specifying a Load Balancing Algorithm (Optional), page 7 Specifying a Bind ID (Optional), page 7 Specifying a Real Server (Required), page 7 Configuring Real Server Attributes (Optional), page 8 Enabling the Real Server for Service (Required), page 8 Specifying a Virtual Server (Required), page 8 Associating a Virtual Server with a Server Farm (Required), page 9 Configuring Virtual Server Attributes (Required), page 9 Adjusting Virtual Server Values (Optional), page 9 Preventing Advertisement of Virtual Server Address (Optional), page 10 Enabling the Virtual Server for Service (Required), page 10 Configuring IOS SLB Dynamic Feedback Protocol (Optional), page 10 Verifying IOS SLB, page 11 Specifying a Server Farm (Required) Grouping real servers into server farms is an essential part of IOS SLB. Using server farms enables IOS SLB to assign new connections to the real servers based on their weighted capacities, and on the load balancing algorithms used. To configure a server farm, use the following command in global configuration mode: Router# ip slb serverfarm serverfarm-name Purpose Adds a server farm definition to the IOS SLB configuration and initiates server farm configuration mode. See the ip slb serverfarm command for more details. 6

7 IOS Server Load Balancing Configuration Tasks Specifying a Load Balancing Algorithm (Optional) To determine which real server to use for each new connection request, the IOS SLB feature uses one of two load balancing algorithms: weighted round robin (the default) or weighted least connections. (See the Weighted Round Robin section on page 3 or the Weighted Least Connections section on page 3 for detailed descriptions of these algorithms.) To specify the load balancing algorithm, use the following command in server farm configuration mode: Router(config-slb-sfarm)# predictor [roundrobin leastconns] Purpose Specifies whether the weighted round robin algorithm or the weighted least connections algorithm is to be used to determine how a real server is selected. See the predictor command for more details. Specifying a Bind ID (Optional) To configure a bind ID on the server farm for use by DFP, use the following command in server farm configuration mode: Router(config-slb-sfarm)# bindid [bind_id] Purpose Specifies a bind ID on the server farm for use by DFP. See the bindid command for more details. Specifying a Real Server (Required) A server farm comprises a number of real servers. The real servers are the physical devices that provide the services that are load balanced. To identify a real server in your network, use the following command in server farm configuration mode: Router(config-slb-sfarm)# real ip-address Purpose Identifies a real server to the IOS SLB function and initiates real server configuration mode. See the real command for more details. 7

8 Configuration Tasks IOS Server Load Balancing Configuring Real Server Attributes (Optional) You can configure any of the following real server attributes, by using the following commands in real server configuration mode: Router(config-slb-real)# faildetect numconns number-conns [numclients number-clients] Router(config-slb-real)# maxconns number-conns Router(config-slb-real)# reassign threshold Router(config-slb-real)# retry retry-value Router(config-slb-real)# weight weighting-value Purpose Specifies the number of consecutive connection failures and, optionally, the number of unique client connection failures, that constitute failure of the real server. See the faildetect command for more details. Specifies the maximum number of active connections allowed on the real server at one time. See the maxconns command for more details. Specifies the number of consecutive unanswered SYNs that initiates reassignment of the connection to another real server. See the reassign command for more details. Specifies the interval, in seconds, that must elapse between the detection of a server failure and the next attempt to connect to the failed server. See the retry command for more details. Specifies the real server s workload capacity relative to other servers in the server farm. See the weight command for more details. Enabling the Real Server for Service (Required) To place the real server into service, use the following command in real server configuration mode: Router(config-slb-real)# inservice Purpose Enables the real server for use by IOS SLB. See the inservice (real server) command for more details. Specifying a Virtual Server (Required) To specify a virtual server, use the following command in global configuration mode: Router(config)# ip slb vserver virtserver-name Purpose Identifies a virtual server and initiates virtual server configuration mode. See the ip slb vserver command for more details. 8

9 IOS Server Load Balancing Configuration Tasks Associating a Virtual Server with a Server Farm (Required) To associate the virtual server with a server farm, use the following command in virtual server configuration mode: Router(config-slb-vserver)# serverfarm serverfarm-name Purpose Associates a real server farm with a virtual server. See the serverfarm command for more details. Configuring Virtual Server Attributes (Required) To configure virtual server attributes, use the following command in virtual server configuration mode: Router(config-slb-vserver)# virtual ip-address {tcp udp} port-number [service service-name] Purpose Specifies the virtual server IP address, type of connection, port number, and optional service coupling. See the virtual command for more details. Adjusting Virtual Server Values (Optional) To change the default settings of the virtual server values, use the related command in virtual server configuration mode: Router(config-slb-vserver)# client ip-address network-mask Router(config-slb-vserver)# delay duration Router(config-slb-vserver)# idle duration Purpose Specifies which clients are allowed to use the virtual server. See the client command for more details. Specifies the amount of time IOS SLB maintains TCP connection context after a connection has terminated. The default value is 10 seconds. See the delay command for more details. Specifies the minimum amount of time IOS SLB maintains connection context in the absence of packet activity for a connection. The default value is 3600 seconds (60 hours). See the idle command for more details. 9

10 Configuration Tasks IOS Server Load Balancing Router(config-slb-vserver)# sticky duration [group group-id] Router(config-slb-vserver)# synguard syn-count interval Purpose Specifies that connections from the same client use the same real server, providing that the interval between client connections does not exceed the specified duration. See the sticky command for more details. Specifies the rate of TCP SYNs handled by a virtual server in order to prevent a SYN flood denial of service attack. See the synguard command for more details. Preventing Advertisement of Virtual Server Address (Optional) By default, virtual server addresses are advertised. That is, static routes to the Null0 interface are installed for the virtual server addresses. To advertise these static routes using the routing protocol, you must configure redistribution of static routes for the routing protocol. To prevent the installation of a static route, use the no form of the advertise command, in virtual server configuration mode: Router(config-slb-vserver)# no advertise Purpose Omits the virtual server IP address from the routing protocol updates. See the advertise command for more details. Enabling the Virtual Server for Service (Required) To place the virtual server into service, use the following command in virtual server configuration mode: Router(config-slb-vserver)# inservice Purpose Enables the virtual server for use by IOS SLB. See the inservice (virtual server) command for more details. Configuring IOS SLB Dynamic Feedback Protocol (Optional) To configure IOS SLB DFP, enter the following commands in order, beginning in global configuration mode: Step 1 Step 2 Router(config)# ip slb dfp [password password [timeout]] Router(config-slb-dfp)# agent ip_address port [timeout [retry_count [retry_interval]]] Purpose Configures DFP and, optionally, sets a password and initiates DFP configuration mode. See the ip slb dfp command for more details. Configures a DFP agent. See the agent command for more details. 10

11 IOS Server Load Balancing Monitoring and Maintaining IOS SLB Verifying IOS SLB To verify that the IOS SLB feature has been installed and is operating correctly, ping the real servers from IOS SLB, then ping the virtual servers from the clients. Monitoring and Maintaining IOS SLB To obtain and display runtime information about IOS SLB, use the following commands in EXEC mode: Router# show ip slb conns [vserver virtserver-name] [client ip-address] [detail] Router# show ip slb dfp [agent ip_addr port] [detail] [weights] Router# show ip slb reals [vserver virtserver-name] [detail] Router# show ip slb serverfarms [name serverfarm-name] [detail] Router# show ip slb stats Router# show ip slb sticky [client ip-address] Router# show ip slb vservers [name virtserver-name] [detail] Purpose Displays all connections handled by IOS SLB, or, optionally, only those connections associated with a particular virtual server or client. See the show ip slb conns command for more details. Displays information about DFP and DFP agents, and about the weights assigned to real servers. See the show ip slb dfp command for more details. Displays information about the real servers defined to IOS SLB. See the show ip slb reals command for more details. Displays information about the server farms defined to IOS SLB. See the show ip slb serverfarms command for more details. Displays IOS SLB statistics. See the show ip slb stats command for more details. Displays information about the sticky connections defined to IOS SLB. See the show ip slb sticky command for more details. Displays information about the virtual servers defined to IOS SLB. See the show ip slb vservers command for more details. 11

12 Configuration Examples IOS Server Load Balancing Configuration Examples This section provides a configuration example based on the network layout shown in Figure 2. Figure 2 Network Configuration for IOS SLB Web server Web server Web server Restricted web server Restricted web server x Virtual server x Client Human Resources Client Client As shown in the following sample code, the example topology has three public Web servers and two restricted Web servers for privileged clients in subnet x. The public Web servers are weighted according to their capacity, with server having the lowest capacity and having a connection limit imposed on it. The restricted Web servers are configured as members of the same sticky group, so that HTTP connections and Secure Socket Layer (SSL) connections from the same client use the same real server. 12

13 IOS Server Load Balancing Configuration Examples This configuration is coded as follows:! ip slb serverfarm PUBLIC predictor leastconns real weight 16 inservice real weight 4 maxconns 1000 inservice real weight 24 inservice! ip slb serverfarm RESTRICTED predictor leastconns real in-service real in-service! ip slb vserver PUBLIC_HTTP virtual tcp www serverfarm PUBLIC inservice! ip slb vserver RESTRICTED_HTTP virtual tcp www serverfarm RESTRICTED client sticky 60 group 1 inservice! ip slb vserver RESTRICTED_SSL virtual tcp https serverfarm RESTRICTED client sticky 60 group 1 inservice Unrestricted Web server farm Use weighted least connections algorithm First real server Second real server Restrict maximum number of connections Third real server Restricted Web server farm Use weighted least connections algorithm First real server Second real server Unrestricted Web virtual server Handle HTTP requests Use public Web server farm Restricted HTTP virtual server Handle HTTP requests Use restricted Web server farm Only allow clients from x Couple connections with RESTRICTED_SSL Restricted SSL virtual server Handle SSL requests Use restricted Web server farm Only allow clients from x Couple connections with RESTRICTED_WEB 13

14 Reference IOS Server Load Balancing Reference This section documents new or modified commands. All other commands used with this feature are documented in the Cisco IOS 12.0 and 12.0(5)T command reference publications. advertise agent bindid client delay faildetect idle inservice (real server) inservice (virtual server) ip slb dfp ip slb serverfarm ip slb vserver maxconns predictor real reassign retry serverfarm show ip slb conns show ip slb dfp show ip slb reals show ip slb serverfarms show ip slb stats show ip slb sticky show ip slb vservers sticky synguard virtual weight In Cisco IOS 12.0(1)T or later, you can search and filter the output for show and more commands. This functionality is useful when you need to sort through large amounts of output, or if you want to exclude output that you do not need to see. To use this functionality, enter a show or more command followed by the pipe character ( ), one of the keywords begin, include, or exclude, and an expression that you want to search or filter on: command {begin include exclude} regular-expression 14

15 IOS Server Load Balancing Reference Following is an example of the show atm vc command in which you want the command output to begin with the first line where the expression PeakRate appears: show atm vc begin PeakRate For more information on the search and filter functionality, refer to the Cisco IOS 12.0(1)T feature module titled CLI String Search. 15

16 advertise IOS Server Load Balancing advertise To control the installation of a static route to the Null0 interface for a virtual server address, use the advertise virtual server configuration command. Advertisement of this static route using the routing protocol requires that you configure redistribution of static routes for the routing protocol. To prevent the installation of a static route for the virtual server IP address, use the no form of this command. advertise no advertise This command has no arguments or keywords. Defaults The virtual server IP address is added to the routing table. Modes Virtual server configuration History Examples The following example prevents advertisement of the virtual server s IP address in routing protocol updates: no advertise 16

17 IOS Server Load Balancing agent agent To configure a DFP agent, use the agent DFP configuration command. To remove an agent definition from the DFP configuration, use the no form of this command. agent ip-address port [timeout [retry_count [retry_interval]]] no agent ip-address port ip-address port timeout Agent IP address Agent port number (Optional) Time period, in seconds, during which the DFP manager must receive an update from the DFP agent. The default is 0 seconds, which means there is no timeout. retry_count (Optional) Number of times DFP manager attempts to establish the TCP connection to the DFP agent. The default is 0 retries, which means there are infinite retries. retry_interval (Optional) Interval, in seconds, between retries. The default is 180 seconds. Defaults Timeout default: 0 seconds (no timeout) Retry_count default: 0 (infinite retries) Retry_interval default: 180 seconds Modes DFP configuration History Usage Guidelines You can configure up to 1024 agents. A DFP agent collects status information about a server s load capability and reports that information to a load manager. The DFP agent may reside on the server, or it may be a separate device that collects and consolidates the information from several servers before reporting to the load manager. Examples The following example configures a DFP agent: agent

18 agent IOS Server Load Balancing Related s Description ip slb dfp Configures the IOS SLB DFP. 18

19 IOS Server Load Balancing bindid bindid To configure a bind ID, use the bindid server farm configuration command. To remove a bind ID from the server farm configuration, use the no form of this command. bindid [bind_id] no bindid [bind_id] bind_id (Optional) Bind ID number. The default bind ID is 0. Defaults Bind_id default: 0 Modes Server farm configuration History Usage Guidelines You can configure one bind ID on each bindid command. The bind ID allows a single physical server to be bound to multiple virtual servers and report a different weight for each one. Thus, the single real server is represented as multiple instances of itself, each having a different bind ID. DFP uses the bind ID to identify which instance of the real server a given weight is for. Examples The following example configures bind ID 309: bindid 309 Related s ip slb dfp Description Configures the IOS SLB DFP. 19

20 client IOS Server Load Balancing client To define which clients are allowed to use the virtual server, use the client virtual server configuration command. You can use more than one client command to define more than one client. To remove a client definition from the IOS SLB configuration, use the no form of this command. client ip-address network-mask no client ip-address network-mask ip-address network-mask Client IP address. The default is (all clients). Client IP network mask. The default is (all subnetworks). Defaults Ip_address default: (all clients) Network_mask default: (all subnetworks) Taken together, the default is client (allow all clients on all subnetworks to use the virtual server). Modes Virtual server configuration History Usage Guidelines The network-mask value is applied to the source IP address of incoming connections. The result must match the ip-address value for the client to be allowed to use the virtual server. Examples The following example allows only clients from x access to the virtual server: client Related s virtual Description Configures the virtual server attributes. 20

21 IOS Server Load Balancing delay delay To change the amount of time IOS SLB maintains TCP connection context after a connection has terminated, use the delay virtual server configuration command. To restore the default delay timer, use the no form of this command. delay duration no delay duration Delay timer duration in seconds. The valid range is 1 to 600 seconds. The default value is 10 seconds. Defaults Duration default: 10 seconds Modes Virtual server configuration History Examples The following example specifies that IOS SLB maintains TCP connection context for 30 seconds after a connection has terminated: delay 30 Related s virtual Description Configures the virtual server attributes. 21

22 faildetect IOS Server Load Balancing faildetect To specify the conditions that indicate a server failure, use the faildetect real server configuration command. To restore the default values that indicate a server failure, use the no form of this command. faildetect numconns number-conns [numclients number-clients] no faildetect numconns Number of consecutive TCP connection reassignments allowed before a real server is considered to have failed. number-conns Connection reassignment threshold value in the range from 1 to 255. The default is 8 connection failures. numclients number-clients (Optional) Number of unique client connection failures, which, together with the server connection reassignment threshold, constitutes failure of a real server. (Optional) Client connection reassignment threshold value in the range from 1 to 8. The default is whichever value is less, number-conns or 8. Defaults If the faildetect command is not specified, the default value of the connection reassignment threshold is 8. If the numclients keyword is not specified, the default value of the unique client failure threshold is whichever value is less, number-conns or 8. Modes Real server configuration History Examples In the following example the connection reassignment threshold is set to 16 and, because the number-clients keyword is not configured, the threshold for unique client connection failure is set to the default value 8. The real server is considered to have failed when 8 unique clients have had connection failure and there have been 16 connection reassignments. faildetect numconns 16 Related s real Description Identifies a real server. 22

23 IOS Server Load Balancing idle idle To specify the minimum amount of time IOS SLB maintains connection information in the absence of packet activity for a connection, use the idle virtual server configuration command. To restore the default idle duration value, use the no form of this command. idle duration no idle duration Idle connection timer duration in seconds. Valid values range from 10 to The default is 3600 seconds. Defaults Duration default: 3600 seconds Modes Virtual server configuration History Examples The following example instructs IOS SLB to maintain connection information for an idle connection for 120 seconds. idle 120 Related s virtual Description Configures the virtual server attributes. 23

24 inservice (real server) IOS Server Load Balancing inservice (real server) To enable the real server for use by IOS SLB, use the inservice real server configuration command. To remove the real server from service, use the no form of this command. inservice no inservice This command has no arguments or keywords. Defaults If the inservice command is not specified, the real server is defined to IOS SLB but is not used. Modes Real server configuration History Examples The following example enables the real server for use by the IOS SLB feature: inservice Related s real Description Identifies a real server. 24

25 IOS Server Load Balancing inservice (virtual server) inservice (virtual server) To enable the virtual server for use by IOS SLB, use the inservice virtual server configuration command. To remove the virtual server from service, use the no form of this command. inservice no inservice This command has no arguments or keywords. Defaults If the inservice command is not specified, the virtual server is defined to IOS SLB but is not used. Modes Virtual server configuration History Examples The following example enables the real server for use by the IOS SLB feature: inservice Related s virtual Description Configures the virtual server attributes. 25

26 ip slb dfp IOS Server Load Balancing ip slb dfp To configure DFP and supply an optional password, use the ip slb dfp global configuration command. To remove the DFP configuration, use the no form of this command. ip slb dfp [password password [timeout]] no ip slb dfp password password timeout (Optional) Specifies a password for MD5 authentication. (Optional) Password value for MD5 authentication. This password must match the password configured on the host agent. (Optional) Delay period, in seconds, during which both the old password and the new password are accepted. The default value is 180 seconds. Defaults Timeout default: 180 seconds Modes Global configuration History Usage Guidelines The optional password, if configured, must match the password configured on the host agent. The timeout options allow you to change the password without stopping messages between the agent and the manager. Examples The following example configures DFP, sets the password to flounder, and configures a timeout period of 60 seconds: ip slb dfp flounder 60 Related s agent Description Configures a DFP agent. 26

27 IOS Server Load Balancing ip slb serverfarm ip slb serverfarm To identify a server farm and enter server farm configuration mode, use the ip slb serverfarm global configuration command. To remove the server farm from the IOS SLB configuration, use the no form of this command. ip slb serverfarm serverfarm-name no ip slb serverfarm serverfarm-name serverfarm-name Character string used to identify the server farm. The character string is limited to 15 characters. Defaults No default behavior or values. Modes Global configuration History Examples The following example identifies a server farm named PUBLIC: ip slb serverfarm PUBLIC Related s real Description Identifies a real server. 27

28 ip slb vserver IOS Server Load Balancing ip slb vserver To identify a virtual server and enter virtual server configuration mode, use the ip slb vserver global configuration command. To remove a virtual server from the IOS SLB configuration, use the no form of this command. ip slb vserver virtserver-name no ip slb vserver virtserver-name virtserver-name Character string used to identify the virtual server. The character string is limited to 15 characters. Defaults No default behavior or values. Modes Global configuration History Examples The following example identifies a virtual server named PUBLIC_HTTP: ip slb vserver PUBLIC_HTTP Related s serverfarm Description Associates a real server farm with a virtual server. 28

29 IOS Server Load Balancing maxconns maxconns To limit the number of active connections to the real server, use the maxconns real server configuration command. To restore the default of no limit, use the no form of this command. maxconns maximum-number no maxconns maximum-number Maximum number of simultaneous active connections on the real server. Valid values range from 1 to The default is Defaults Maximum_number default: Modes Real server configuration History Examples The following example limits the real server to a maximum of 1000 simultaneous active connections: maxconns 1000 Related s real Description Identifies a real server. 29

30 predictor IOS Server Load Balancing predictor To specify the load balancing algorithm for selecting a real server in the server farm, use the predictor server farm configuration command. To restore the default load balancing algorithm of weighted round robin, use the no form of this command. predictor [roundrobin leastconns] no predictor roundrobin leastconns (Optional) Use the weighted round robin algorithm for selecting the real server to handle the next new connection for the server farm. See the Weighted Round Robin section on page 3 for a detailed description of this algorithm. (Optional) Use the weighted least connections algorithm for selecting the real server to handle the next new connection for this server farm. See the Weighted Least Connections section on page 3 for a detailed description of this algorithm. Defaults Weighted round robin Modes Server farm configuration History Examples The following example specifies the weighted least connections algorithm: predictor leastconns Related s weight Description Specifies the real server s capacity, relative to other real servers in the server farm. 30

31 IOS Server Load Balancing real real To identify a real server as a member of a server farm, use the real server farm configuration command. To remove the real server from the IOS SLB configuration, use the no form of this command. real ip-address no real ip-address ip-address Real server IP address. Defaults No default behavior or values. Modes Server farm configuration History Examples The following example identifies a real server as a member of the server farm: real Related s inservice Description Enables the real server for use by IOS SLB. 31

32 reassign IOS Server Load Balancing reassign Use the reassign real server configuration command to specify the threshold of consecutive unanswered SYNs that, if exceeded, result in an attempted connection to a different real server. To restore the default reassignment threshold, use the no form of this command. reassign threshold no reassign threshold Number of unanswered TCP SYNs that are directed to a real server before the connection is reassigned to a different real server. Valid threshold values range from 1 to 4 SYNs. The default value is 3. Defaults Threshold default: 3 SYNs Modes Real server configuration History Examples The following example sets the threshold of unanswered SYNs to 2: reassign 2 Related s real Description Identifies a real server. 32

33 IOS Server Load Balancing retry retry To specify the amount of time that must elapse before a new connection is attempted to a failed server, use the retry real server configuration command. To restore the default retry value, use the no form of this command. retry retry-value no retry retry-value Interval of time, in seconds, that must elapse after the detection of a server failure before a new connection to the server is attempted. Valid values range from 1 to The default value is 60 seconds. Defaults Retry-value default: 60 seconds Modes Real server configuration History Examples The following example specifies that 120 seconds must elapse after the detection of a server failure before a new connection is attempted: retry 120 Related s real Description Identifies a real server. 33

34 serverfarm IOS Server Load Balancing serverfarm To associate a real server farm with a virtual server, use the serverfarm virtual server configuration command. To remove the server farm association from the virtual server configuration, use the no form of this command. serverfarm serverfarm-name no serverfarm serverfarm-name Name of a server farm that has already been defined using the ip slb serverfarm command. Defaults No default behavior or values. Modes Virtual server configuration History Examples The following example shows how the ip slb vserver, virtual, and serverfarm commands are used to associate the real server farm named PUBLIC with the virtual server named PUBLIC_HTTP. ip slb vserver PUBLIC_HTTP virtual tcp www serverfarm PUBLIC Related s virtual Description Configures the virtual server attributes. 34

35 IOS Server Load Balancing show ip slb conns show ip slb conns To display the active IOS SLB connections, use the show ip slb conns privileged EXEC command. show ip slb conns [vserver virtserver-name] [client ip-address] [detail] vserver virtserver-name client ip-address detail (Optional) Displays only those connections associated with a particular virtual server. (Optional) Name of the virtual server to be monitored. (Optional) Displays only those connections associated with a particular client IP address. (Optional) IP address of the client to be monitored. (Optional) Displays detailed connection information. Defaults If no options are specified, the command displays output for all active IOS SLB connections. Modes Privileged EXEC History Examples The following example shows IOS SLB active connection data: router# show ip slb conns vserver prot client real state TEST TCP : :80 CLOSING TEST TCP : :80 CLOSING TEST TCP : :80 CLOSING TEST TCP : :80 CLOSING TEST TCP : :80 CLOSING TEST TCP : :80 CLOSING TEST TCP : :80 CLOSING Table 1 show ip slb conns Field Information Field vserver prot client Description Name of the virtual server whose connections are being monitored and displayed. Information about each connection is displayed on a separate line. Protocol being used by the connection. Client IP address being used by the connection. 35

36 show ip slb conns IOS Server Load Balancing real state Real IP address of the connection. Current state of the connection. 36

37 IOS Server Load Balancing show ip slb dfp show ip slb dfp To display DFP manager and agent information, such as passwords, timeouts, retry counts, and weights, use the show ip slb dfp privileged EXEC command. show ip slb dfp [agent ip_address port detail weights] agent ip_address port detail weights (Optional) Displays information about an agent. (Optional) Agent IP address. (Optional) Agent port number. (Optional) Displays all data available. (Optional) Displays information about weights assigned to real servers for load balancing. Defaults If no options are specified, the command displays summary information. Modes Privileged EXEC History Examples The following example shows IOS SLB DFP data: router# show ip slb dfp detail DFP Manager: Current passwd:none Pending passwd:none Passwd timeout:0 sec Unexpected errors:0 DFP Agent :61936 Connection state:connected Timeout = 0 Retry Count = 0 Interval = 180 (Default) Security errors = 0 Last message received:10:20:26 UTC 11/02/99 Last reported Real weights for Protocol TCP, Port www Host Weight 1 Host Bind ID 4 Weight 4 Host Bind ID 5 Weight 5 Last reported Real weights for Protocol TCP, Port 22 Host Bind ID 111 Weight

38 show ip slb dfp IOS Server Load Balancing router# show ip slb dfp weights Real IP Address Protocol TCP Port 22 Bind_ID 111 Weight 111 Set by Agent at UTC 12/03/99 Real IP Address Protocol TCP Port www Bind_ID 1 Weight 1 Set by Agent at UTC 12/03/99 Real IP Address Protocol TCP Port www Bind_ID 4 Weight 4 Set by Agent at UTC 12/03/99 Real IP Address Protocol TCP Port www Bind_ID 5 Weight 5 Set by Agent at UTC 12/03/99 router# show ip slb dfp DFP Manager: Current passwd:none Pending passwd:none Passwd timeout:0 sec Agent IP Port Timeout Retry Count Interval (Default) Table 2 show ip slb dfp Field Information Field Agent IP Port Timeout Retry Count Interval Description IP address of the agent about which information is being displayed. Port number of the agent. Time period, in seconds, during which the DFP manager must receive an update from the DFP agent. A value of 0 means there is no timeout. Number of times the DFP manager attempts to establish the TCP connection to the DFP agent. A value of 0 means there are infinite retries. Interval, in seconds, between retries. 38

39 IOS Server Load Balancing show ip slb reals show ip slb reals To display information about the real servers, use the show ip slb reals privileged EXEC command. show ip slb reals [vserver virtserver-name] [detail] vserver virtserver-name detail (Optional) Displays information about only those real servers associated with a particular virtual server. (Optional) Name of the virtual server. (Optional) Displays detailed information. Defaults If no options are specified, the command displays information about all real servers. Modes Privileged EXEC History Examples The following example shows IOS SLB real server data: router# show ip slb reals real server farm weight state conns FRAG 8 OUTOFSERVICE FRAG 8 INSERVICE FRAG 8 OUTOFSERVICE FRAG 8 OUTOFSERVICE LINUX 8 INSERVICE LINUX 8 INSERVICE LINUX 8 INSERVICE SRE 8 INSERVICE SRE 8 INSERVICE SRE 8 INSERVICE SRE 8 TESTING SRE 8 INSERVICE SRE 8 INSERVICE TEST 100 READY_TO_TEST TEST 100 READY_TO_TEST TEST 100 READY_TO_TEST TEST 100 READY_TO_TEST 0 39

40 show ip slb reals IOS Server Load Balancing Table 3 show ip slb reals Field Information Field real server farm weight state Description IP address of the real server about which information is being displayed. Used to identify each real server. Information about each real server is displayed on a separate line. Name of the server farm to which the real server. Weight assigned to the real server. The weight identifies the real server s capacity, relative to other real servers in the server farm. Current state of the real server. 40

41 IOS Server Load Balancing show ip slb serverfarms show ip slb serverfarms To display information about the server farms, use the show ip slb serverfarms privileged EXEC command. show ip slb serverfarms [name serverfarm-name] [detail] name serverfarm-name detail (Optional) Displays information about only a particular server farm. (Optional) Name of the server farm. (Optional) Displays detailed server farm information. Defaults No default behavior or values. Modes Privileged EXEC History Examples The following example shows IOS SLB server farm data: router# show ip slb serverfarms server farm predictor reals bind id FRAG ROUNDROBIN 4 0 LINUX ROUNDROBIN 3 0 SRE ROUNDROBIN 6 0 TEST ROUNDROBIN 4 0 Table 4 show ip slb serverfarms Field Information Field server farm predictor reals bind id Description Name of the server farm about which information is being displayed. Information about each server farm is displayed on a separate line. Type of load balancing algorithm (ROUNDROBIN or LEASTCONNS) used by the server farm. Number of real servers configured in the server farm. Bind ID configured on the server farm. 41

42 show ip slb stats IOS Server Load Balancing show ip slb stats To display IOS SLB statistics, use the show ip slb stats privileged EXEC command. show ip slb stats This command has no arguments or keywords. Defaults No default behavior or values. Modes Privileged EXEC History Examples The following example shows IOS SLB statistics: router# show ip slb stats Pkts via normal switching: Pkts via special switching: Connections Created: Connections Established: Connections Destroyed: Connections Reassigned: 0 Zombie Count: 0 Table 5 show ip slb stats Field Information Field Pkts via normal switching Pkts via special switching Connections Created Connections Established Connections Destroyed Connections Reassigned Zombie Count Description Number of packets that have been handled by IOS SLB via normal switching since the last time counters were cleared. Number of packets that have been handled by IOS SLB via special switching since the last time counters were cleared. Number of connections that have been created since the last time counters were cleared. Number of connections that have been created and have become established since the last time counters were cleared. Number of connections that have been destroyed since the last time counters were cleared. Number of connections that have been reassigned to a different real server since the last time counters were cleared. Number of connections that are currently pending destruction, awaiting a timeout or some other condition to be met. 42

43 IOS Server Load Balancing show ip slb sticky show ip slb sticky To display the IOS SLB sticky database, use the show ip slb sticky privileged EXEC command. show ip slb sticky [client ip_address] client ip-address (Optional) Displays only those sticky database entries associated with a particular client IP address. (Optional) IP address of the client. Defaults If no options are specified, the command displays information about all virtual servers. Modes Privileged EXEC History Examples The following example shows the IOS SLB sticky database: router# show ip slb sticky client group real conns ftp-cntrl Table 6 show ip slb sticky Field Information Field client group real conns ftp-cntrl Description Client IP address which is bound to this sticky assignment. Group ID for this sticky assignment. Real server used by all clients connecting with the client IP address detailed on this line. Number of connections currently sharing this sticky assignment. Number of File Transfer Protocol (FTP) control connections currently using this sticky assignment. 43

IOS Server Load Balancing

IOS Server Load Balancing IOS Server Load Balancing This feature module describes the Cisco IOS Server Load Balancing (SLB) feature. It includes the following sections: Feature Overview, page 1 Supported Platforms, page 5 Supported

More information

Configuring Server Load Balancing

Configuring Server Load Balancing Configuring Server Load Balancing This chapter describes how to configure the IOS Server Load Balancing (SLB) feature. For a complete description of the SLB commands in this chapter, refer to the Server

More information

Firewall Load Balancing

Firewall Load Balancing CHAPTER 6 This chapter describes the (FWLB) feature. It includes the following sections: FWLB Overview, page 6-1 FWLB Features, page 6-2 FWLB Configuration Tasks, page 6-3 Monitoring and Maintaining FWLB,

More information

IOS Server Load Balancing

IOS Server Load Balancing IOS Server Load Balancing Feature History Release 12.0(7)XE 12.1(1)E Modification This feature was introduced with support for the following platforms: Catalyst 6000 Family Switches with Supervisor Engine

More information

Server Load Balancing Configuration Guide Cisco IOS Release 12.2SX

Server Load Balancing Configuration Guide Cisco IOS Release 12.2SX Server Load Balancing Configuration Guide Cisco IOS Release 12.2SX Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800

More information

NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes

NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes NetFlow Aggregation This document describes the Cisco IOS NetFlow Aggregation feature, which allows Cisco NetFlow users to summarize NetFlow export data on an IOS router before the data is exported to

More information

Configuring Health Monitoring

Configuring Health Monitoring CHAPTER 6 This chapter describes how to configure the health monitoring on the CSM and contains these sections: Configuring Probes for Health Monitoring, page 6-1 Configuring Route Health Injection, page

More information

GLBP - Gateway Load Balancing Protocol

GLBP - Gateway Load Balancing Protocol GLBP - Gateway Load Balancing Protocol Gateway Load Balancing Protocol (GLBP) protects data traffic from a failed router or circuit, like Hot Standby Router Protocol (HSRP) and Virtual Router Redundancy

More information

Configuring Health Monitoring

Configuring Health Monitoring CHAPTER4 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features that are described in this chapter apply to both IPv6 and IPv4 unless

More information

Chapter 11 Network Address Translation

Chapter 11 Network Address Translation Chapter 11 Network Address Translation You can configure an HP routing switch to perform standard Network Address Translation (NAT). NAT enables private IP networks that use nonregistered IP addresses

More information

Supported Platforms. Supported Standards, MIBs, and RFCs. Prerequisites. Related Features and Technologies. Related Documents. Improved Server Access

Supported Platforms. Supported Standards, MIBs, and RFCs. Prerequisites. Related Features and Technologies. Related Documents. Improved Server Access Configuring Timeout, Retransmission, and Key Values per RADIUS Server The Configuring Timeout, Retransmission, and Key Values per RADIUS Server feature extends the functionality of the existing radius-server

More information

Understanding Slow Start

Understanding Slow Start Chapter 1 Load Balancing 57 Understanding Slow Start When you configure a NetScaler to use a metric-based LB method such as Least Connections, Least Response Time, Least Bandwidth, Least Packets, or Custom

More information

Configuring Redundancy

Configuring Redundancy 7 CHAPTER This chapter describes how to configure redundancy and contains these sections: Configuring Fault Tolerance, page 7-1 Configuring HSRP, page 7-5 Configuring Interface and Device Tracking, page

More information

Server Iron Hands-on Training

Server Iron Hands-on Training Server Iron Hands-on Training Training Session Agenda Server Iron L4 Solutions Server Iron L7 Solutions Server Iron Security Solutions High Availability Server Iron Designs 2 Four Key Reasons for Server

More information

Configuring Static and Dynamic NAT Translation

Configuring Static and Dynamic NAT Translation This chapter contains the following sections: Network Address Translation Overview, page 1 Information About Static NAT, page 2 Dynamic NAT Overview, page 3 Timeout Mechanisms, page 4 NAT Inside and Outside

More information

- Redundancy and Load Balancing -

- Redundancy and Load Balancing - 1 - Redundancy and Load Balancing - Importance of Redundancy High availability is critical in most environments. Even a brief outage due to hardware failure may be considered unacceptable. Consider the

More information

Firewall Load Balancing

Firewall Load Balancing Firewall Load Balancing 2015-04-28 17:50:12 UTC 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement Contents Firewall Load Balancing... 3 Firewall Load Balancing...

More information

HTTP 1.1 Web Server and Client

HTTP 1.1 Web Server and Client HTTP 1.1 Web Server and Client Finding Feature Information HTTP 1.1 Web Server and Client Last Updated: August 17, 2011 The HTTP 1.1 Web Server and Client feature provides a consistent interface for users

More information

642 523 Securing Networks with PIX and ASA

642 523 Securing Networks with PIX and ASA 642 523 Securing Networks with PIX and ASA Course Number: 642 523 Length: 1 Day(s) Course Overview This course is part of the training for the Cisco Certified Security Professional and the Cisco Firewall

More information

Configuring Network Address Translation

Configuring Network Address Translation CHAPTER5 Configuring Network Address Translation The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. This chapter contains the following major sections

More information

Overview: Load Balancing with the MNLB Feature Set for LocalDirector

Overview: Load Balancing with the MNLB Feature Set for LocalDirector CHAPTER 1 Overview: Load Balancing with the MNLB Feature Set for LocalDirector This chapter provides a conceptual overview of load balancing and introduces Cisco s MultiNode Load Balancing (MNLB) Feature

More information

DHCP Server Port-Based Address Allocation

DHCP Server Port-Based Address Allocation The feature provides port-based address allocation support on the Cisco IOS Dynamic Host Configuration Protocol (DHCP) server for the Ethernet platform. The DHCP server provides address assignment support

More information

Configuring a Load-Balancing Scheme

Configuring a Load-Balancing Scheme Configuring a Load-Balancing Scheme Last Updated: October 5, 2011 This module contains information about Cisco Express Forwarding and describes the tasks for configuring a load-balancing scheme for Cisco

More information

Domain Name System Server Round-Robin Functionality for the Cisco AS5800

Domain Name System Server Round-Robin Functionality for the Cisco AS5800 Domain Name System Server Round-Robin Functionality for the Cisco AS5800 This feature module describes Domain Name System (DNS) server round-robin functionality for the Cisco AS5800 universal access server.

More information

RADIUS Server Load Balancing

RADIUS Server Load Balancing First Published: March 20, 2006 Last Updated: September 22, 2009 The feature distributes authentication, authorization, and accounting (AAA) authentication and accounting transactions across servers in

More information

Content Switching Module for the Catalyst 6500 and Cisco 7600 Internet Router

Content Switching Module for the Catalyst 6500 and Cisco 7600 Internet Router Content Switching Module for the Catalyst 6500 and Cisco 7600 Internet Router Product Overview The Cisco Content Switching Module (CSM) is a Catalyst 6500 line card that balances client traffic to farms

More information

Link Load Balancing 2015-04-28 08:50:44 UTC. 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement

Link Load Balancing 2015-04-28 08:50:44 UTC. 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement Link Load Balancing 2015-04-28 08:50:44 UTC 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement Contents Link Load Balancing... 3 Link Load Balancing... 4 Configuring

More information

Configuring Class Maps and Policy Maps

Configuring Class Maps and Policy Maps CHAPTER 4 Configuring Class Maps and Policy Maps This chapter describes how to configure class maps and policy maps to provide a global level of classification for filtering traffic received by or passing

More information

Configuring Advanced Server Load Balancing

Configuring Advanced Server Load Balancing CHAPTER 5 This chapter describes how to configure advanced server load balancing (SLB) on the CSM and contains these sections: Configuring URL Hashing, page 5-1 Configuring Firewall Load Balancing, page

More information

Configuring Stickiness

Configuring Stickiness CHAPTER5 This chapter describes how to configure stickiness (sometimes referred to as session persistence) on an ACE module. It contains the following major sections: Stickiness Overview Configuration

More information

VRRPv3: Object Tracking Integration

VRRPv3: Object Tracking Integration Virtual Router Redundancy Protocol (VRRP) enables a group of devices to form a single virtual device to provide redundancy. The LAN clients then can be configured with the virtual device as the default

More information

LAB THREE STATIC ROUTING

LAB THREE STATIC ROUTING LAB THREE STATIC ROUTING In this lab you will work with four different network topologies. The topology for Parts 1-4 is shown in Figure 3.1. These parts address router configuration on Linux PCs and a

More information

login timeout 30 access list ALL line 20 extended permit ip any any port 9053 interval 15 passdetect interval 30

login timeout 30 access list ALL line 20 extended permit ip any any port 9053 interval 15 passdetect interval 30 logging enable logging console 4 logging timestamp logging trap 5 logging buffered 4 logging device id hostname logging host 10.0.128.240 udp/514 format emblem logging host 10.0.143.24 udp/514 login timeout

More information

PA-MC-T3 Multi-Channel T3 Synchronous Serial Port Adapter Enhancement

PA-MC-T3 Multi-Channel T3 Synchronous Serial Port Adapter Enhancement PA-MC-T3 Multi-Channel T3 Synchronous Serial Port Adapter Enhancement This feature module describes the PA-MC-T3 Multi-Channel T3 port adapter (PA-MC-T3 [=]), which can now be configured as either customer

More information

Configuring Timeout, Retransmission, and Key Values Per RADIUS Server

Configuring Timeout, Retransmission, and Key Values Per RADIUS Server Configuring Timeout, Retransmission, and Key Values Per RADIUS Server Feature Summary The radius-server host command functions have been extended to include timeout, retransmission, and encryption key

More information

Configuring a Load-Balancing Scheme

Configuring a Load-Balancing Scheme This module contains information about Cisco Express Forwarding and describes the tasks for configuring a load-balancing scheme for Cisco Express Forwarding traffic. Load-balancing allows you to optimize

More information

Virtual Fragmentation Reassembly

Virtual Fragmentation Reassembly Virtual Fragmentation Reassembly Currently, the Cisco IOS Firewall specifically context-based access control (CBAC) and the intrusion detection system (IDS) cannot identify the contents of the IP fragments

More information

Configuring TCP Intercept (Preventing Denial-of-Service Attacks)

Configuring TCP Intercept (Preventing Denial-of-Service Attacks) Configuring TCP Intercept (Preventing Denial-of-Service Attacks) This chapter describes how to configure your router to protect TCP servers from TCP SYN-flooding attacks, a type of denial-of-service attack.

More information

Managing Virtual Servers

Managing Virtual Servers CHAPTER 4 Content Switching Module Device Manager (CVDM-CSM) displays details of existing virtual servers and enables users to perform detailed tasks that include creating or deleting virtual servers,

More information

NetFlow Subinterface Support

NetFlow Subinterface Support NetFlow Subinterface Support Feature History Release Modification 12.2(14)S This feature was introduced. 12.2(15)T This feature was integrated into Cisco IOS Release 12.2 T. This document describes the

More information

Firewall Authentication Proxy for FTP and Telnet Sessions

Firewall Authentication Proxy for FTP and Telnet Sessions Firewall Authentication Proxy for FTP and Telnet Sessions First Published: May 14, 2003 Last Updated: August 10, 2010 Before the introduction of the Firewall Authentication Proxy for FTP and Telnet Sessions

More information

Advanced SLB High Availability and Stateless SLB

Advanced SLB High Availability and Stateless SLB Advanced SLB High Availability and Stateless SLB Objectives Upon completion of this module, you will be able to: Describe Server Load Balancing (SLB) high availability Distinguish between different high

More information

IP Application Services Commands show vrrp. This command was introduced. If no group is specified, the status for all groups is displayed.

IP Application Services Commands show vrrp. This command was introduced. If no group is specified, the status for all groups is displayed. show vrrp show vrrp To display a brief or detailed status of one or all configured Virtual Router Redundancy Protocol (VRRP) groups on the router, use the show vrrp command in privileged EXEC mode. show

More information

Transferring Files Using HTTP or HTTPS

Transferring Files Using HTTP or HTTPS Transferring Files Using HTTP or HTTPS First Published: May 5, 2005 Last Updated: May 14, 2009 Cisco IOS Release 12.4 provides the ability to transfer files between your Cisco IOS software-based device

More information

Configuring Enhanced Object Tracking

Configuring Enhanced Object Tracking Configuring Enhanced Object Tracking First Published: May 2, 2005 Last Updated: July 1, 2009 Before the introduction of the Enhanced Object Tracking feature, the Hot Standby Router Protocol (HSRP) had

More information

Configuring DNS. Finding Feature Information

Configuring DNS. Finding Feature Information The Domain Name System (DNS) is a distributed database in which you can map hostnames to IP addresses through the DNS protocol from a DNS server. Each unique IP address can have an associated hostname.

More information

Objectives. Access methods for CLI environment. Configuration files

Objectives. Access methods for CLI environment. Configuration files 2007 Cisco Systems, Inc. All rights reserved. Cisco Public Configuring and Testing Your Network Network Fundamentals Chapter 11 ITE PC v4.0 Chapter 1 1 Objectives Define the role of the Internetwork Operating

More information

co Characterizing and Tracing Packet Floods Using Cisco R

co Characterizing and Tracing Packet Floods Using Cisco R co Characterizing and Tracing Packet Floods Using Cisco R Table of Contents Characterizing and Tracing Packet Floods Using Cisco Routers...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1

More information

Deployment Guide AX Series with Citrix XenApp 6.5

Deployment Guide AX Series with Citrix XenApp 6.5 Deployment Guide AX Series with Citrix XenApp 6.5 DG_XenApp_052012.1 TABLE OF CONTENTS 1 Introduction... 4 1 Deployment Guide Overview... 4 2 Deployment Guide Prerequisites... 4 3 Accessing the AX Series

More information

Firewall Stateful Inspection of ICMP

Firewall Stateful Inspection of ICMP The feature addresses the limitation of qualifying Internet Control Management Protocol (ICMP) messages into either a malicious or benign category by allowing the Cisco IOS firewall to use stateful inspection

More information

Lab 4.1.2 Characterizing Network Applications

Lab 4.1.2 Characterizing Network Applications Lab 4.1.2 Characterizing Network Applications Objective Device Designation Device Name Address Subnet Mask Discovery Server Business Services 172.17.1.1 255.255.0.0 R1 FC-CPE-1 Fa0/1 172.17.0.1 Fa0/0 10.0.0.1

More information

Implementing Object Tracking on Cisco IOS XR Software

Implementing Object Tracking on Cisco IOS XR Software Implementing Object Tracking on Cisco IOS XR Software This module describes the configuration of object tracking on your Cisco IOS XR network. For information about its application in IPSec, see Cisco

More information

Enabling Remote Access to the ACE

Enabling Remote Access to the ACE CHAPTER 2 This chapter describes how to configure remote access to the Cisco Application Control Engine (ACE) module by establishing a remote connection by using the Secure Shell (SSH) or Telnet protocols.

More information

Cisco Configuring Commonly Used IP ACLs

Cisco Configuring Commonly Used IP ACLs Table of Contents Configuring Commonly Used IP ACLs...1 Introduction...1 Prerequisites...2 Hardware and Software Versions...3 Configuration Examples...3 Allow a Select Host to Access the Network...3 Allow

More information

HP Load Balancing Module

HP Load Balancing Module HP Load Balancing Module Load Balancing Configuration Guide Part number: 5998-2685 Document version: 6PW101-20120217 Legal and notice information Copyright 2012 Hewlett-Packard Development Company, L.P.

More information

FWSM introduction Intro 5/1

FWSM introduction Intro 5/1 Intro 5/0 Content: FWSM introduction Requirements for FWSM 3.2 How the Firewall Services Module Works with the Switch Using the MSFC Firewall Mode Overview Stateful Inspection Overview Security Context

More information

Exam Name: Foundry Networks Certified Layer4-7 Professional Exam Type: Foundry Exam Code: FN0-240 Total Questions: 267

Exam Name: Foundry Networks Certified Layer4-7 Professional Exam Type: Foundry Exam Code: FN0-240 Total Questions: 267 Question: 1 SYN-Guard and SYN-Defense can be configured on: A. ServerIron XL B. ServerIron 100 C. ServerIron 400 D. ServerIron 800 E. ServerIron 450 F. ServerIron 850 G. ServerIron GT-E, C, D, E, F, G

More information

Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data

Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides

More information

Firewall Stateful Inspection of ICMP

Firewall Stateful Inspection of ICMP The feature categorizes Internet Control Management Protocol Version 4 (ICMPv4) messages as either malicious or benign. The firewall uses stateful inspection to trust benign ICMPv4 messages that are generated

More information

Network Data Encryption Commands

Network Data Encryption Commands Network Data Encryption Commands This chapter describes the function and displays the syntax for network data encryption commands. For more information about defaults and usage guidelines, see the corresponding

More information

CCNP Switch 642-813 Questions/Answers Implementing High Availability and Redundancy

CCNP Switch 642-813 Questions/Answers Implementing High Availability and Redundancy Which Catalyst 6500 switch component integrates on individual line modules as well as on the supervisor engine? A. CPU B. Flash C. ASIC D. NVRAM Answer: C Cisco Catalyst 6500 Series with Cisco IOS Software

More information

TCP/IP Concepts Review. Ed Crowley

TCP/IP Concepts Review. Ed Crowley TCP/IP Concepts Review Ed Crowley 1 Objectives At the end of this unit, you will be able to: Describe the TCP/IP protocol stack For each level, explain roles and vulnerabilities Explain basic IP addressing

More information

Configuring a Load-Balancing Scheme

Configuring a Load-Balancing Scheme Configuring a Load-Balancing Scheme Finding Feature Information Configuring a Load-Balancing Scheme Last Updated: August 15, 2011 This module contains information about Cisco Express Forwarding and describes

More information

Configuring DHCP Snooping

Configuring DHCP Snooping CHAPTER 19 This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping on Catalyst 4500 series switches. It provides guidelines, procedures, and configuration examples.

More information

Server Management in the WSD

Server Management in the WSD Technical Application Note 1025 Server Management in the WSD Scope RADWare s Web Server Director (WSD) essentially allows multiple clients to be load balanced between an identical and redundant group of

More information

FortiOS Handbook - Load Balancing VERSION 5.2.2

FortiOS Handbook - Load Balancing VERSION 5.2.2 FortiOS Handbook - Load Balancing VERSION 5.2.2 FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE

More information

Cisco IOS Flexible NetFlow Command Reference

Cisco IOS Flexible NetFlow Command Reference Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION

More information

To use DNS, you must have a DNS name server on your network.

To use DNS, you must have a DNS name server on your network. Configuring DNS Last Updated: December 15, 2011 The Domain Name System (DNS) is a distributed database in which you can map hostnames to IP addresses through the DNS protocol from a DNS server. Each unique

More information

Chapter 8 Router and Network Management

Chapter 8 Router and Network Management Chapter 8 Router and Network Management This chapter describes how to use the network management features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. These features can be found by

More information

Configuring the Firewall Management Interface

Configuring the Firewall Management Interface Configuring the Firewall Management Interface The firewall management interface can be configured under each firewall context to provide a virtualized management interface (see Figure 7). The management

More information

Deployment Guide AX Series with Active Directory Federation Services 2.0 and Office 365

Deployment Guide AX Series with Active Directory Federation Services 2.0 and Office 365 Deployment Guide AX Series with Active Directory Federation Services 2.0 and Office 365 DG_ADFS20_120907.1 TABLE OF CONTENTS 1 Overview... 4 2 Deployment Guide Overview... 4 3 Deployment Guide Prerequisites...

More information

Monitoring Traffic Interception

Monitoring Traffic Interception CHAPTER 2 This chapter describes how to use traffic interception to monitor your WAAS devices and contains the following sections: Verifying WCCPv2 Interception, page 2-1 Verifying Inline Interception,

More information

ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy

ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to

More information

RADIUS Server Load Balancing

RADIUS Server Load Balancing The feature distributes authentication, authorization, and accounting (AAA) authentication and accounting transactions across RADIUS servers in a server group These servers can share the AAA transaction

More information

Sampled NetFlow. Feature Overview. Benefits

Sampled NetFlow. Feature Overview. Benefits Sampled NetFlow This feature module describes the Sampled NetFlow feature. It includes information on the benefits of the new feature, supported platforms, supported standards, and the commands necessary

More information

Flow-Based per Port-Channel Load Balancing

Flow-Based per Port-Channel Load Balancing The feature allows different flows of traffic over a Gigabit EtherChannel (GEC) interface to be identified based on the packet header and then mapped to the different member links of the port channel.

More information

Enhanced Password Security - Phase I

Enhanced Password Security - Phase I Enhanced Password Security - Phase I Feature History 120(18)S 121(8a)E 122(14)S This feature was introduced Support for this feature was integrated into Cisco IOS Release 121(8a)E This feature was integrated

More information

Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1

Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1 Smart Tips Enabling WAN Load Balancing Overview Many small businesses today use broadband links such as DSL or Cable, favoring them over the traditional link such as T1/E1 or leased lines because of the

More information

Note: This case study utilizes Packet Tracer. Please see the Chapter 5 Packet Tracer file located in Supplemental Materials.

Note: This case study utilizes Packet Tracer. Please see the Chapter 5 Packet Tracer file located in Supplemental Materials. Note: This case study utilizes Packet Tracer. Please see the Chapter 5 Packet Tracer file located in Supplemental Materials. CHAPTER 5 OBJECTIVES Configure a router with an initial configuration. Use the

More information

IP SLAs Overview. Finding Feature Information. Information About IP SLAs. IP SLAs Technology Overview

IP SLAs Overview. Finding Feature Information. Information About IP SLAs. IP SLAs Technology Overview This module describes IP Service Level Agreements (SLAs). IP SLAs allows Cisco customers to analyze IP service levels for IP applications and services, to increase productivity, to lower operational costs,

More information

Controlling Access to a Virtual Terminal Line

Controlling Access to a Virtual Terminal Line Controlling Access to a Virtual Terminal Line First Published: August 18, 2006 Last Updated: August 18, 2006 You can control who can access the virtual terminal lines (vtys) to a router by applying an

More information

Skills Assessment Student Training Exam

Skills Assessment Student Training Exam Skills Assessment Student Training Exam Topology Assessment Objectives Part 1: Initialize Devices (8 points, 5 minutes) Part 2: Configure Device Basic Settings (28 points, 30 minutes) Part 3: Configure

More information

Configuring Load Balancing

Configuring Load Balancing When you use Cisco VXC Manager to manage thin client devices in a very large enterprise environment, a single Cisco VXC Manager Management Server cannot scale up to manage the large number of devices.

More information

Scaling Next-Generation Firewalls with Citrix NetScaler

Scaling Next-Generation Firewalls with Citrix NetScaler Scaling Next-Generation Firewalls with Citrix NetScaler SOLUTION OVERVIEW Citrix NetScaler service and application delivery solutions are deployed in thousands of networks around the globe to optimize

More information

Configuring DHCP. DHCP Server Overview

Configuring DHCP. DHCP Server Overview Configuring DHCP This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP). For a complete description of the DHCP commands listed in this chapter, refer to the DHCP s chapter

More information

Configuring DHCP. DHCP Server Overview

Configuring DHCP. DHCP Server Overview Configuring DHCP This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP). For a complete description of the DHCP commands listed in this chapter, refer to the DHCP s chapter

More information

NetFlow v9 Export Format

NetFlow v9 Export Format NetFlow v9 Export Format With this release, NetFlow can export data in NetFlow v9 (version 9) export format. This format is flexible and extensible, which provides the versatility needed to support new

More information

Enhanced Password Security - Phase I

Enhanced Password Security - Phase I Enhanced Password Security - Phase I Feature History 120(18)S This feature was introduced This document describes the Enhanced Password Security feature in It includes the following sections: Feature Overview,

More information

Using Cisco IOS Software

Using Cisco IOS Software Using Cisco IOS Software This chapter provides helpful tips for understanding and configuring Cisco IOS software using the command-line interface (CLI). It contains the following sections: Understanding

More information

Lab 8.4.2 Configuring Access Policies and DMZ Settings

Lab 8.4.2 Configuring Access Policies and DMZ Settings Lab 8.4.2 Configuring Access Policies and DMZ Settings Objectives Log in to a multi-function device and view security settings. Set up Internet access policies based on IP address and application. Set

More information

PT Activity: Configure Cisco Routers for Syslog, NTP, and SSH Operations

PT Activity: Configure Cisco Routers for Syslog, NTP, and SSH Operations PT Activity: Configure Cisco Routers for Syslog, NTP, and SSH Operations Instructor Version Topology Diagram Addressing Table Device Interface IP Address Subnet Mask Default Gateway Switch Port R1 FA0/1

More information

Configuring DHCP Snooping and IP Source Guard

Configuring DHCP Snooping and IP Source Guard CHAPTER 19 This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping and IP Source Guard on Catalyst 4500 series switches. It provides guidelines, procedures, and configuration

More information

Using Cisco IOS Software for Release 12.3

Using Cisco IOS Software for Release 12.3 Using Cisco IOS Software for Release 123 This chapter provides helpful tips for understanding and configuring Cisco IOS software using the command-line interface (CLI) It contains the following sections:

More information

Configuring Server Load Balancing

Configuring Server Load Balancing CHAPTER 6 This chapter describes how to configure server load balancing (SLB) on the Cisco Application Control Engine (ACE) module. This chapter contains the following sections: Information About Server

More information

Chapter 2 Quality of Service (QoS)

Chapter 2 Quality of Service (QoS) Chapter 2 Quality of Service (QoS) Software release 06.6.X provides the following enhancements to QoS on the HP 9304M, HP 9308M, and HP 6208M-SX routing switches. You can choose between a strict queuing

More information

Configuring Network Address Translation (NAT)

Configuring Network Address Translation (NAT) 8 Configuring Network Address Translation (NAT) Contents Overview...................................................... 8-3 Translating Between an Inside and an Outside Network........... 8-3 Local and

More information

Load Balancing. FortiOS Handbook v3 for FortiOS 4.0 MR3

Load Balancing. FortiOS Handbook v3 for FortiOS 4.0 MR3 Load Balancing FortiOS Handbook v3 for FortiOS 4.0 MR3 FortiOS Handbook Load Balancing v3 8 February 2012 01-431-99686-20120208 Copyright 2012 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, and

More information

Configuring CSS Remote Access Methods

Configuring CSS Remote Access Methods CHAPTER 11 Configuring CSS Remote Access Methods This chapter describes how to configure the Secure Shell Daemon (SSH), Remote Authentication Dial-In User Service (RADIUS), and the Terminal Access Controller

More information

Chapter 16 Route Health Injection

Chapter 16 Route Health Injection Chapter 16 Route Health Injection You can configure an HP Routing Switch to check the health of the HTTP application and inject a host route into the network to force a preferred route to an actively responding

More information

Emerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc.

Emerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc. Emerald Network Collector Version 4.0 Emerald Management Suite IEA Software, Inc. Table Of Contents Purpose... 3 Overview... 3 Modules... 3 Installation... 3 Configuration... 3 Filter Definitions... 4

More information