Downloads |
Table Of Contents
Configuring Server Load Balancing
Restrictions for Cisco IOS SLB
Information About Cisco IOS SLB
Server Failure Detection and Recovery Features
Dual-Stack Support for GTP Load Balancing
KeepAlive Application Protocol (KAL-AP) Agent Support
RADIUS Load Balancing Accelerated Data Plane Forwarding
Stateful Backup of Redundant Route Processors
How to Configure the IOS SLB Feature
How to Configure Required and Optional IOS SLB Functions
How to Configure a Server Farm and a Real Server
How to Configure a Virtual Server
How to Verify a Virtual Server
How to Verify IOS SLB Connectivity
How to Configure Firewall Load Balancing
How to Configure a Firewall Farm
How to Verify Firewall Connectivity
How to Configure a Custom UDP Probe
How to Configure an HTTP Probe
GPRS Load Balancing Configuration Task List
How to Configure a GSN Idle Timer
GGSN-IOS SLB Messaging Task List
How to Configure GPRS Load Balancing Maps
How to Configure KAL-AP Agent Support
RADIUS Load Balancing Configuration Task List
How to Enable IOS SLB to Inspect Packets for RADIUS Framed-IP Sticky Routing
How to Configure RADIUS Load Balancing Maps
How to Configure RADIUS Load Balancing Accelerated Data Plane Forwarding
Exchange Director for mSEF Configuration Task List
RADIUS Configuration for the Exchange Director
Firewall Configuration for the Exchange Director
VPN Server Load Balancing Configuration Task List
ASN Load Balancing Configuration Task List
Home Agent Director Configuration Task List
Stateless Backup Configuration Task List
How to Verify the Stateless Backup Configuration
Stateful Backup of Redundant Route Processors Configuration Task List
How to Configure Database Entries
How to Configure Buffers for the Fragment Database
How to Clear Databases and Counters
How to Configure a Wildcard Search
How to Configure Protocol-Level Purging of MLS Entries
How to Purge and Reassign Connections
How to Disable Automatic Server Failure Detection
How to Monitor and Maintain the Cisco IOS SLB Feature
Configuration Examples for IOS SLB
Example: How to Configure a Basic IOS SLB Network
Restricted Client Configuration
Example: How to Configure a Complete IOS SLB Network
Examples: How to Configure IOS SLB with Firewall Load Balancing
Example: How to Configure IOS SLB with Basic Firewall Load Balancing
Example: How to Configure IOS SLB with Server Load Balancing and Firewall Load Balancing
Example: How to Configure IOS SLB with Multiple Firewall Farms
Example: How to Configure IOS SLB with Dual Firewall Load Balancing "Sandwich"
Examples: How to Configure IOS SLB with Probes
Example: How to Configure IOS SLB with Ping and HTTP Probes
Example: How to Configure IOS SLB with Routed Probe
Example: How to Configure a Layer 3 Switch with IOS SLB
Examples: How to Configure IOS SLB with NAT and Static NAT
Example: How to Configure IOS SLB with NAT
Example: How to Configure IOS SLB with Static NAT
Examples: How to Configure IOS SLB with Redundancy
Examples: How to Configure IOS SLB with Stateless Backup
Example: How to Configure IOS SLB with Stateful Backup
Example: How to Configure IOS SLB with Stateful Backup of Redundant Route Processors
Example: How to Configure IOS SLB with Active Standby
Example: How to Configure IOS SLB with Redistribution of Static Routes
Routing Information Protocol (RIP)
Open Shortest Path First (OSPF)
Interior Gateway Routing Protocol (IGRP)
Enhanced Interior Gateway Routing Protocol (Enhanced IGRP)
Example: How to Configure IOS SLB with WAP and UDP Load Balancing
Example: How to Balance WAP Flows on UDP Port 9201
Example: How to Balance WAP Flows on UDP Port 9203
Examples: How to Configure IOS SLB with Route Health Injection
Example: How to Configure Two Distributed Sites with One Web Server Each
Example: How to Configure Two Distributed Sites with Two Web Servers Each
Example: How to Configure Two Distributed Sites with One Web Server and a Backup IOS SLB Switch Each
Examples: How to Configure IOS SLB with GPRS Load Balancing
Example: How to Configure IOS SLB with GPRS Load Balancing Without GTP Cause Code Inspection
Example: How to Configure IOS SLB with GPRS Load Balancing and NAT
Example: How to Configure IOS SLB with GPRS Load Balancing, NAT, and GTP Cause Code Inspection
Example: How to Configure IOS SLB with GPRS Load Balancing Maps
Example: How to Configure IOS SLB with Dual-Stack Addresses for GTP Load Balancing
Example: How to Configure IOS SLB with VPN Server Load Balancing
Examples: How to Configure IOS SLB with RADIUS Load Balancing
Example: How to Configure IOS SLB with RADIUS Load Balancing for a GPRS Network
Example: How to Configure IOS SLB with RADIUS Load Balancing for a Simple IP CDMA2000 Network
Example: How to Configure IOS SLB with RADIUS Load Balancing for a Mobile IP CDMA2000 Network
Example: How to Configure IOS SLB with RADIUS Load Balancing for Multiple Service Gateway Farms
Example: How to Configure IOS SLB with RADIUS Load Balancing/Firewall Load Balancing "Sandwich"
Example: How to Configure IOS SLB with RADIUS Load Balancing Maps
Example: How to Configure IOS SLB with RADIUS Load Balancing Accelerated Data Plane Forwarding
Example: How to Configure IOS SLB with Home Agent Director
Example: How to Configure IOS SLB with Sticky Connections
Example: How to Configure IOS SLB with GTP IMSI Sticky Database
Example: How to Configure IOS SLB with ASN Sticky Database
Example: How to Configure IOS SLB with Transparent Web Cache Load Balancing
Example: How to Configure IOS SLB with KAL-AP Agent
Feature Information for IOS SLB
Configuring Server Load Balancing
First Published: January 14, 2008Last Updated: July 23, 2010This document describes how to configure the Cisco IOS Server Load Balancing (IOS SLB) feature. For a complete description of the IOS SLB commands in this chapter, refer to the "Server Load Balancing Commands" chapter of the Cisco IOS IP Application Services Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
The SLB feature is a Cisco IOS-based solution that provides IP server load balancing. Using the IOS SLB feature:
1.
The network administrator defines a virtual server that represents a group of real servers in a cluster of network servers known as a server farm. In this environment the clients are configured to connect to the IP address of the virtual server.
2.
3.
The IOS SLB feature provides load balancing for a variety of networked devices and services, including:
•
•
•
In addition, the IOS SLB Exchange Director enables advanced load-balancing routing capabilities for the following additional service nodes:
•
–
If you are running with Supervisor Engine 32 (SUP32-MSFC2A), CSG Release 3.1(3)C7(1) or later is required.
–
–
–
•
–
–
–
–
The Exchange Director also adds the following features:
•
•
Figure 1 illustrates a simple IOS SLB network.
Figure 1 Logical View of Cisco IOS SLB
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for IOS SLB" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
•
•
•
•
Restrictions for Cisco IOS SLB
General Restrictions
•
•
•
•
•
•
•
•
•
When operating in directed mode with server NAT, real servers need not be Layer 2-adjacent to IOS SLB. This function allows for more flexible network design, because servers can be placed several Layer 3 hops away from the IOS SLB switch.
•
•
•
•
•
•
•
•
•
•
Static NAT Restrictions
•
•
•
•
•
Backup Server Farm Restrictions
•
•
•
Firewall Load Balancing Restrictions
•
•
•
•
•
•
–
–
–
–
–
Restrictions for GPRS Load Balancing Without GPRS Tunneling Protocol (GTP) Cause Code Inspection Enabled
•
•
•
•
•
–
–
–
–
Restrictions for GPRS Load Balancing With GTP Cause Code Inspection Enabled
•
•
•
•
•
•
–
–
–
GTP v2 Restrictions
•
•
•
–
–
–
All other messages are dropped.
•
–
–
–
VPN Server Load Balancing Restrictions
•
RADIUS Load Balancing Accelerated Data Plane Forwarding Restrictions
•
•
•
•
•
•
•
•
VSA Correlation Restrictions
•
•
•
•
RADIUS Load Balancing for GPRS Restrictions
•
•
•
•
RADIUS Load Balancing for CDMA2000 Restrictions
•
•
•
•
•
–
–
–
•
–
–
–
Home Agent Director Restrictions
•
•
•
•
•
–
–
–
–
–
–
Restrictions for HTTP Probes
•
Restrictions for UDP Probes
•
•
•
•
–
–
–
–
•
–
The term MSFC refers to an MSFC1, MSFC2, or MSFC3, except when specifically differentiated.
The term PFC refers to a PFC1, PFC2, or PFC3, except when specifically differentiated.
–
–
–
–
–
ASN Release 6 Load Balancing Restrictions
•
•
•
–
–
•
•
–
–
–
–
–
Note
–
–
Information About Cisco IOS SLB
To configure IOS SLB, you should understand the following concepts:
•
•
Note
Benefits of IOS SLB
IOS SLB shares the same software code base as Cisco IOS and has all of the software features sets of Cisco IOS software.
On Cisco Catalyst 6500 series switches, IOS SLB uses hardware acceleration to forward packets at a very high speed when running in dispatched mode.
IOS SLB assures continuous, high availability of content and applications with techniques for actively managing servers and connections in a distributed environment. By distributing user requests across a cluster of servers, IOS SLB optimizes responsiveness and system capacity, and reduces the cost of providing Internet, database, and application services for large, medium, and small-scale sites.
IOS SLB facilitates scalability, availability, and ease of maintenance as follows:
•
•
•
•
Using DFP enables IOS SLB to provide weights to another load-balancing system. IOS SLB can act as a DFP manager, receiving weights from host servers, and it can act as a DFP agent, sending weights to a DFP manager. The functions are enabled independently—you can implement either one, or both, at the same time.
IOS SLB makes the administration of server applications easy. Clients know only about virtual servers; no administration is required for real server changes.
IOS SLB provides security for the real server because it never announces the real server's address to the external network. Users are familiar only with the virtual IP address. You can filter unwanted flows based on both IP address and TCP or UDP port numbers. Additionally, though it does not eliminate the need for a firewall, IOS SLB can help protect against some denial-of-service attacks.
In a branch office, IOS SLB allows balancing of multiple sites and disaster recovery in the event of full-site failure, and distributes the work of load balancing.
Cisco IOS SLB Features
The Cisco IOS SLB includes the following subfeatures:
•
Routing Features
IOS SLB provides the following routing features:
•
•
•
•
•
Algorithms for Server Load Balancing
IOS SLB provides the following load-balancing algorithms:
•
•
You can specify one of these algorithms as the basis for choosing a real server for each new connection request that arrives at the virtual server.
For each algorithm, connections in the closing state are counted against the number of connections assigned to a real server. This impacts the least connections algorithm more than the other algorithms, because the least connections algorithm is influenced by the number of connections. IOS SLB adjusts the number of connections per real server, and the algorithm metrics, each time a connection is assigned.
Weighted Round Robin Algorithm
The weighted round robin algorithm specifies that the real server used for a new connection to the virtual server is chosen from the server farm in a circular fashion. Each real server is assigned a weight, n, that represents its capacity to manage connections, as compared to the other real servers associated with the virtual server. That is, new connections are assigned to a given real server n times before the next real server in the server farm is chosen.
For example, assume a server farm comprised of real server ServerA with n = 3, ServerB with n = 1, and ServerC with n = 2. The first three connections to the virtual server are assigned to ServerA, the fourth connection to ServerB, and the fifth and sixth connections to ServerC.
Note
GPRS load balancing without GTP cause code inspection enabled requires the weighted round robin algorithm. You can bind a server farm that uses weighted least connections to a virtual server providing GPRS load balancing without GTP cause code inspection enabled, but you cannot place the virtual server in service. If you try to do so, IOS SLB issues an error message.
The Home Agent Director requires the weighted round robin algorithm. You can bind a server farm that uses weighted least connections to a Home Agent Director virtual server, but you cannot place the virtual server INSERVICE. If you try to do so, IOS SLB issues an error message.
RADIUS load balancing requires the weighted round robin algorithm.
RADIUS load balancing accelerated data plane forwarding does not support the weighted round robin algorithm.Weighted Least Connections Algorithm
The weighted least connections algorithm specifies that the next real server chosen from a server farm is the server with the fewest active connections. Each real server is assigned a weight for this algorithm, also. When weights are assigned, the server with the fewest connections is based on the number of active connections on each server, and on the relative capacity of each server. The capacity of a given real server is calculated as the assigned weight of that server divided by the sum of the assigned weights of all of the real servers associated with that virtual server, or n1/(n1+n2+n3...).
For example, assume a server farm comprised of real server ServerA with n = 3, ServerB with n = 1, and ServerC with n = 2. ServerA would have a calculated capacity of 3/(3+1+2), or half of all active connections on the virtual server, ServerB one-sixth of all active connections, and ServerC one-third of all active connections. At any point in time, the next connection to the virtual server would be assigned to the real server whose number of active connections is farthest below its calculated capacity.
Note
GPRS load balancing without GTP cause code inspection enabled does not support the weighted least connections algorithm.
GPRS load balancing with GTP cause code inspection enabled does support the weighted least connections algorithm.
Access Service Network (ASN) load balancing (for Mobile Station Pre-Attachment requests), the Home Agent Director, RADIUS load balancing, and RADIUS load balancing accelerated data plane forwarding do not support the weighted least connections algorithm.Route Map Algorithm
The route map algorithm is valid only with IOS SLB RADIUS load balancing accelerated data plane forwarding, also known as Turbo RADIUS load balancing. Turbo RADIUS load balancing is a high-performance solution that uses policy-based routing (PBR) route maps to manage subscriber data-plane traffic in a Cisco Content Services Gateway (CSG) environment. When Turbo RADIUS load balancing receives a RADIUS payload, it inspects the payload, extracts the framed-IP attribute, applies a route map to the IP address, and then determines which CSG is to manage the subscriber.
For more information about policy-based routing, see the "Policy-Based Routing" and "Configuring Policy-Based Routing" sections of the Cisco IOS IP Routing Configuration Guide.
Note
Bind ID Support
A bind ID allows one physical server to be bound to multiple virtual servers and report a different weight for each one. Thus, the single real server is represented as multiple instances of itself, each having a different bind ID. Dynamic Feedback Protocol (DFP) uses the bind ID to identify the instance of the real server for which a given weight is specified. Use the bind ID feature only if you are using DFP.
GPRS load balancing and the Home Agent Director do not support bind IDs.
Client-Assigned Load Balancing
Client-assigned load balancing allows you to limit access to a virtual server by specifying the list of client IP subnets that are permitted to use that virtual server. With this feature, you can assign a set of client IP subnets (such as internal subnets) connecting to a virtual IP address to one server farm or firewall farm, and assign another set of clients (such as external clients) to a different server farm or firewall farm.
GPRS load balancing and the Home Agent Director do not support client-assigned load balancing.
Connection Rate Limiting
IOS SLB enables you to specify the maximum connection rate allowed for a real server in a server farm. For more information, see the description of the rate command in real server configuration mode.
Content Flow Monitor Support
IOS SLB supports the Cisco Content Flow Monitor (CFM), a web-based status monitoring application within the CiscoWorks2000 product family. You can use CFM to manage Cisco server load-balancing devices. CFM runs on Windows NT and Solaris workstations, and is accessed using a web browser.
Delayed Removal of TCP Connection Context
Because of IP packet ordering anomalies, IOS SLB might "see" the end of a TCP connection (a finish [FIN] or reset [RST]) followed by other packets for the connection. This problem usually occurs if multiple paths exist for the TCP connection packets to follow. To correctly redirect the packets that arrive after the connection has ended, IOS SLB retains the TCP connection information, or context, for a specified length of time. The length of time the context is retained after the connection ends is controlled by a configurable delay timer.
Firewall Load Balancing
As its name implies, firewall load balancing:
•
•
You can configure more than one firewall farm in each load-balancing device.
•
•
Whereas many Layer 3 firewalls might exist off one Layer 3 interface on the load-balancing device (for example, one LAN), only one Layer 2 firewall can exist off each interface.
When configuring the load-balancing device, you configure a Layer 3 firewall using its IP address, and a Layer 2 firewall using the IP address of the interface of the device on the "other side" of the firewall.
To balance flows across the firewalls in a firewall farm, IOS SLB firewall load balancing performs a route lookup on each incoming flow, examining the source and destination IP addresses (and optionally the source and destination TCP or User Datagram Protocol [UDP] port numbers). Firewall load balancing applies a hash algorithm to the results of the route lookup and selects the best firewall to manage the connection request.
Note
To maximize availability and resilience in a network with multiple firewalls, configure a separate equal-weight route to each firewall, rather than one route to only one of the firewalls.
IOS SLB firewall load balancing provides the following capabilities:
•
•
•
•
•
•
•
•
GTP IMSI Sticky Database
IOS SLB can select a GGSN for a given International Mobile Subscriber ID (IMSI), and forward all subsequent Packet Data Protocol (PDP) create requests from the same IMSI to the selected GGSN.
To enable this feature, IOS SLB uses a GTP IMSI sticky database, which maps each IMSI to its corresponding real server, in addition to its session database.
1.
2.
3.
Home Agent Director
Home agents are the anchoring points for mobile nodes. They route flows for a mobile node to its current foreign agent (point of attachment).
The Home Agent Director load balances Mobile IP Registration Requests (RRQs) among a set of home agents (configured as real servers in a server farm). The Home Agent Director has the following characteristics:
•
•
•
•
For more information about Mobile IP, home agents, and related topics, refer to the Cisco IOS IP Mobility Configuration Guide.
Interface Awareness
Some environments require IOS SLB to take into account the input interface when mapping packets to virtual servers, firewall farms, connections, and sessions. In IOS SLB, this function is called interface awareness. When interface awareness is configured, IOS SLB processes only traffic arriving on configured access interfaces. (An access interface is any Layer 3 interface.)
Such "sandwich" environments require IOS SLB on both sides of a farm of CSGs, SSGs, or firewalls. For example, you might want IOS SLB to perform RADIUS load balancing on one side of a farm and firewall load balancing on the other, or firewall load balancing on both sides of a firewall farm.
Maximum Connections
IOS SLB allows you to configure maximum connections for server and firewall load balancing.
•
•
Multiple Firewall Farm Support
You can configure more than one firewall farm in each load-balancing device.
Network Address Translation
Cisco IOS Network Address Translation (NAT), RFC 1631, allows unregistered "private" IP addresses to connect to the Internet by translating them into globally registered IP addresses. As part of this functionality, Cisco IOS NAT can be configured to advertise only one address for the entire network to the outside world. This configuration provides additional security and network privacy, effectively hiding the entire internal network from the world behind that address. NAT has the dual functionality of security and address conservation, and is typically implemented in remote access environments.
This section includes information about the following topics:
Session Redirection
Session redirection NAT involves redirecting packets to real servers. IOS SLB can operate in one of two session redirection modes, dispatched mode or directed mode.
Note
Dispatched Mode
In dispatched NAT mode, the virtual server address is known to the real servers; you must configure the virtual server IP address as a loopback address, or secondary IP address, on each of the real servers. IOS SLB redirects packets to the real servers at the media access control (MAC) layer. Because the virtual server IP address is not modified in dispatched mode, the real servers must be Layer 2-adjacent to IOS SLB, or intervening routers might not be able to route to the chosen real server.
For Cisco Catalyst 6500 series switches, dispatched mode with hardware data packet acceleration generally yields better performance than directed mode.
Refer to the "Configuring Virtual Interfaces" chapter of the Cisco IOS Interface Configuration Guide for more information about configuring the loopback address.
Note
Directed Mode
In directed NAT mode, the virtual server can be assigned an IP address that is not known to any of the real servers. IOS SLB translates packets exchanged between a client and a real server, using NAT to translate the virtual server IP address to a real server IP address.
IOS SLB supports the following types of NAT:
•
Note
IOS SLB does not support FTP or firewall load balancing in directed mode. Therefore, FTP and firewall load balancing cannot use NAT.
IOS SLB supports only client NAT for TCP and UDP virtual servers.
IOS SLB supports only server NAT (but not server port translation) for Encapsulation Security Payload (ESP) virtual servers or Generic Routing Encapsulation (GRE) virtual servers.Server NAT
Server NAT involves replacing the virtual server IP address with the real server IP address (and vice versa). Server NAT provides the following benefits:
•
•
•
•
•
Client NAT
If you use more than one load-balancing device in your network, replacing the client IP address with an IP address associated with one of the devices results in proper routing of outbound flows to the correct device. Client NAT also requires that the ephemeral client port be modified since many clients can use the same ephemeral port. Even in cases where multiple load-balancing devices are not used, client NAT can be useful to ensure that packets from load-balanced connections are not routed around the device.
Static NAT
With static NAT, address translations exist in the NAT translation table as soon as you configure static NAT commands, and they remain in the translation table until you delete the static NAT commands.
You can use static NAT to allow some users to use NAT and allow other users on the same Ethernet interface to continue with their own IP addresses. This option enables you to provide a default NAT behavior for real servers, differentiating between responses from a real server, and connection requests initiated by the real server.
For example, you can use server NAT to redirect Domain Name System (DNS) inbound request packets and outbound response packets for a real server, and static NAT to process connection requests from that real server.
Note
IOS SLB supports the following static NAT options, configured using the ip slb static command:
•
•
•
Note
•
–
–
IOS SLB uses the following logic when handling a packet from a real server:
Step 1
•
•
Step 2
•
•
Step 3
•
•
Step 4
•
•
Step 5
•
•
Step 6
•
•
Step 7
•
•
Server Port Translation
Server port translation, also known as port address translation, or PAT, is a form of server NAT that involves the translation of virtual server ports instead of virtual server IP addresses. Virtual server port translation does not require translation of the virtual server IP address, but you can use the two types of translation together.
IOS SLB supports server port translation for TCP and UDP only.
Port-Bound Servers
Port-bound servers allow one virtual server IP address to represent one set of real servers for one service, such as HTTP, and a different set of real servers for another service, such as Telnet. When you define a virtual server, you must specify the TCP or UDP port managed by that virtual server. However, if you configure NAT on the server farm, you can also configure port-bound servers.
Packets destined for a virtual server address for a port that is not specified in the virtual server definition are not redirected.
IOS SLB supports both port-bound and non-port-bound servers, but port-bound servers are recommended.
IOS SLB firewall load balancing does not support port-bound servers.
Route Health Injection
By default, a virtual server's IP address is advertised (added to the routing table) when you bring the virtual server into service (using the inservice command). If there is a preferred host route to a website's virtual IP address, you can advertise that host route, but there is no guarantee that the IP address is available. However, you can use the advertise command to configure IOS SLB to advertise the host route only when IOS SLB has verified that the IP address is available. IOS SLB withdraws the advertisement when the IP address is no longer available. This function is known as route health injection.
Sticky Connections
You can use the optional sticky command to enable IOS SLB to force connections from the same client to the same load-balanced server within a server farm.
Sometimes, a client transaction can require multiple consecutive connections, which means new connections from the same client IP address or subnet must be assigned to the same real server. These connections are especially important in firewall load balancing, because the firewall might need to profile the multiple connections in order to detect certain attacks.
•
•
•
For firewall load balancing, the connections between the same client-server pair are assigned to the same firewall. New connections are considered to be sticky as long as the following conditions are met:
•
•
This binding of new connections to the same server or firewall is continued for a user-defined period after the last sticky connection ends.
To get the client-server address sticky behavior needed for "sandwich" firewall load balancing, you must enable sticky on both sides of the firewall farm. In this configuration, client-server sticky associations are created when an initial connection is opened between a client-server address pair. After this initial connection is established, IOS SLB maintains the sticky association in the firewall load-balancing devices on either side of the farm, and applies the sticky association to connections initiated from either the client or server IP address, by both firewall load-balancing devices.
Client subnet sticky is enabled when you specify the sticky command with a subnet mask. Subnet sticky is useful when the client IP address might change from one connection to the next. For example, before reaching IOS SLB, the client connections might pass through a set of NAT or proxy firewalls that have no sticky management of their own. Such a situation can result in failed client transactions if the servers do not have the logic to cope with it. In cases where such firewalls assign addresses from the same set of subnets, IOS SLB's sticky subnet mask can overcome the problems that they might cause.
Sticky connections also permit the coupling of services that are managed by more than one virtual server or firewall farm. This option allows connection requests for related services to use the same real server. For example, web server (HTTP) typically uses TCP port 80, and HTTPS uses port 443. If HTTP virtual servers and HTTPS virtual servers are coupled, connections for ports 80 and 443 from the same client IP address or subnet are assigned to the same real server.
Virtual servers that are in the same sticky group are sometimes called buddied virtual servers.
The Home Agent Director does not support sticky connections.
TCP Session Reassignment
IOS SLB tracks each TCP SYNchronize sequence number, or SYN, sent to a real server by a client attempting to open a new connection. If several consecutive SYNs are not answered, or if a SYN is replied to with an RST, the TCP session is reassigned to a new real server. The number of SYN attempts is controlled by a configurable reassign threshold.
IOS SLB firewall load balancing does not support TCP session reassignment.
Transparent Web Cache Load Balancing
IOS SLB can load-balance HTTP flows across a cluster of transparent web caches. To set up this function, configure the subnet IP addresses served by the transparent web caches, or some common subset of them, as virtual servers. Virtual servers used for transparent web cache load balancing do not answer pings on behalf of the subnet IP addresses, and they do not affect traceroute.
In some cases, such as when its cache does not contain needed pages, a web cache must initiate its own connections to the Internet. Those connections should not be load-balanced back to the same set of web caches. To address this need, IOS SLB allows you to configure client exclude statements, which exclude connections initiated by the web caches from the load-balancing scheme.
IOS SLB firewall load balancing does not support transparent web cache load balancing.
Security Features
IOS SLB provides the following security features:
•
Alternate IP Addresses
IOS SLB enables you to telnet to the load-balancing device using an alternate IP address. To do so, use either of the following methods:
•
•
This function is similar to that provided by the LocalDirector (LD) Alias command.
Avoiding Attacks on Server Farms and Firewall Farms
IOS SLB relies on a site's firewalls to protect the site from attacks. In general, IOS SLB is no more susceptible to direct attack than is any switch or router. However, a highly secure site can take the following steps to enhance its security:
•
•
•
•
Slow Start
To prevent an overload, slow start controls the number of new connections that are directed to a real server that has just been placed in service. In an environment that uses weighted least connections load balancing, a real server that is placed in service initially has no connections, and could therefore be assigned so many new connections that it becomes overloaded.
GPRS load balancing and the Home Agent Director do not support slow start.
SynGuard
SynGuard limits the rate of TCP start-of-connection packets (SYNchronize sequence numbers, or SYNs) managed by a virtual server to prevent a type of network problem known as a SYN flood denial-of-service attack. A user might send a large number of SYNs to a server, which could overwhelm or crash the server, denying service to other users. SynGuard prevents such an attack from bringing down IOS SLB or a real server. SynGuard monitors the number of SYNs managed by a virtual server at specific intervals and does not allow the number to exceed a configured SYN threshold. If the threshold is reached, any new SYNs are dropped.
IOS SLB firewall load balancing and the Home Agent Director do not support SynGuard.
Server Failure Detection and Recovery Features
IOS SLB provides the following server failure detection and recovery features:
•
•
•
Automatic Server Failure Detection
IOS SLB automatically detects each failed Transmission Control Protocol (TCP) connection attempt to a real server, and increments a failure counter for that server. (The failure counter is not incremented if a failed TCP connection from the same client has already been counted.) If a server's failure counter exceeds a configurable failure threshold, the server is considered out of service and is removed from the list of active real servers.
For RADIUS load balancing, the IOS SLB performs automatic server failure detection when a RADIUS request is not answered by the real server.
If you have configured all-port virtual servers (that is, virtual servers that accept flows destined for all ports except GTP ports), flows can be passed to servers for which no application port exists. When the servers reject these flows, IOS SLB might fail the servers and remove them from load balancing. This situation can also occur in slow-to-respond AAA servers in RADIUS load-balancing environments. To prevent this situation, you can disable automatic server failure detection.
Note
If you specify the no faildetect inband command, the faildetect numconns command is ignored, if specified.
Automatic Unfail
When a real server fails and is removed from the list of active servers, it is assigned no new connections for a length of time specified by a configurable retry timer. After that timer expires, the server is again eligible for new virtual server connections and IOS SLB sends the server the next qualifying connection. If the connection is successful, the failed server is placed back on the list of active real servers. If the connection is unsuccessful, the server remains out of service and the retry timer is reset. The unsuccessful connection must have experienced at least one retry, otherwise the next qualifying connection is also sent to that failed server.
Backup Server Farms
A backup server farm is a server farm that can be used when none of the real servers defined in a primary server farm is available to accept new connections. When configuring backup server farms, keep in mind the following considerations:
•
•
•
Dynamic Feedback Protocol (DFP) Agent Subsystem Support
IOS SLB supports the DFP Agent Subsystem feature, also called global load balancing, which enables client subsystems other than IOS SLB to act as DFP agents. With the DFP Agent Subsystem, you can use multiple DFP agents from different client subsystems at the same time.
For more information about the DFP Agent Subsystem, refer to the DFP Agent Subsystem feature document for Cisco IOS Release 12.2(18)SXD.
DFP for Cisco IOS SLB
With IOS SLB DFP support, a DFP manager in a load-balancing environment can initiate a TCP connection with a DFP agent. Thereafter, the DFP agent collects status information from one or more real host servers, converts the information to relative weights, and reports the weights to the DFP manager. The DFP manager factors in the weights when load balancing the real servers. In addition to reporting at user-defined intervals, the DFP agent sends an early report if a sudden change occurs in a real server's status.
The weights calculated by DFP override the static weights you define using the weight command in server farm configuration mode. If DFP is removed from the network, IOS SLB reverts to the static weights.
You can define IOS SLB as a DFP manager, as a DFP agent for another DFP manager, or as both at the same time. In such a configuration, IOS SLB sends periodic reports to the other DFP manager, which uses the information to choose the best server farm for each new connection request. IOS SLB then uses the same information to choose the best real server within the chosen server farm.
DFP also supports the use of multiple DFP agents from different client subsystems (such as IOS SLB and GPRS) at the same time.
For more information, see the following sections:
•
DFP and GPRS Load Balancing
In GPRS load balancing, you can define IOS SLB as a DFP manager and define a DFP agent on each GGSN in the server farm. Thereafter, the DFP agent can report the weights of the GGSNs. The DFP agents calculate the weight of each GGSN based on CPU use, processor memory, and the maximum number of Packet Data Protocol (PDP) contexts (mobile sessions) that can be activated for each GGSN. As a first approximation, DFP calculates the weight as the number of existing PDP contexts divided by the maximum allowed PDP contexts:
(existing PDP contexts)/(maximum PDP contexts)
Maximum PDP contexts are specified using the gprs maximum-pdp-context-allowed command, which defaults to 10,000 PDP contexts. If you accept the default value, DFP might calculate a very low weight for the GGSN:
(existing PDP contexts)/10000 = Low GGSN weight
When you specify maximum PDP contexts using the gprs maximum-pdp-context-allowed command, keep this calculation in mind. For example, Cisco 7200 series routers acting as GGSNs are often configured with a maximum of 45,000 PDP contexts.
DFP and the Home Agent Director
When using the Home Agent Director, you can define IOS SLB as a DFP manager and define a DFP agent on each home agent in the server farm, and the DFP agent can report the weights of the home agents. The DFP agents calculate the weight of each home agent based on CPU use, processor memory, and the maximum number of bindings that can be activated for each home agent:
(maximum-number-of-bindings - current-number-of-bindings)/maximum-number-of-bindings * (cpu-use + memory-use)/32 * maximum-DFP-weight = reported-weight
The maximum-number-of-bindings is 235,000. The maximum-DFP-weight is 24.
GGSN-IOS SLB Messaging
You can enable a GGSN to notify IOS SLB when certain conditions occur. The notifications enable IOS SLB to make intelligent decisions, which in turn improves GPRS load balancing and failure detection.
The notifications sent by the GGSN use GTP with message types from the unused space (reserved for future use) and the following information elements (IEs):
•
•
•
GGSN-IOS SLB messaging is supported in both dispatched mode and directed modes.
INOP_REAL State for Virtual Servers
You can configure a virtual server such that, if all of the real servers that are associated with the virtual server are inactive, the following actions occur:
•
•
•
For more information, see the description of the inservice (server farm virtual server) command in SLB server farm virtual server configuration mode.
Probes
Probes determine the status of each real server in a server farm, or each firewall in a firewall farm. The Cisco IOS SLB feature supports DNS, HTTP, ping, TCP, custom UDP, and WSP probes:
•
•
HTTP probes also enable you to monitor applications that are server load-balanced. With frequent probes, the operation of each application is verified, not just connectivity to the application.
HTTP probes do not support HTTP over Secure Socket Layer (HTTPS). That is, you cannot send an HTTP probe to an SSL server.
•
•
•
–
–
–
–
–
•
You can configure more than one probe, in any combination of supported types, for each server farm, or for each firewall in a firewall farm.
You can also flag a probe as a routed probe, with the following considerations:
•
•
IOS SLB probes use the SA Agent. You might want to specify the amount of memory that the SA Agent can use, using the rtr low-memory command. If the amount of available free memory falls below the value specified in the rtr low-memory command, then the SA Agent does not allow new operations to be configured. For more details, see the description of the rtr low-memory command in the Cisco IOS IP SLAs Command Reference.
Probes in Server Load Balancing
Probes determine the status of each real server in a server farm. All real servers associated with all virtual servers tied to that server farm are probed.
If a real server fails for one probe, it fails for all probes. After the real server recovers, all probes must acknowledge its recovery before it is restored to service.
Note
Probes in Firewall Load Balancing
Probes detect firewall failures. All firewalls associated with the firewall farm are probed.
If a firewall fails for one probe, it is failed for all probes. After the firewall recovers, all probes must acknowledge its recovery before the probe is restored to service.
To prevent password problems, make sure you configure the HTTP probe to expect status code 401. For more details, see the description of the expect command.
Use the ip http server command to configure an HTTP server on the device. For more details, see the description of the ip http server command in the Cisco IOS Configuration Fundamentals Command Reference.
In a transparent web cache load-balancing environment, an HTTP probe uses the real IP address of the web cache, since there is no virtual IP address configured.
Protocol Support Features
IOS SLB provides the following protocol support features:
•
Protocol Support
IOS SLB supports the following protocols:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
–
–
–
–
AAA Load Balancing
IOS SLB provides RADIUS load-balancing capabilities for RADIUS authentication, authorization, and accounting (AAA) servers.
IOS SLB provides the following RADIUS load-balancing functions:
•
•
•
•
In addition, IOS SLB can load-balance devices that proxy the RADIUS Authorization and Accounting flows in both traditional and mobile wireless networks. For more information, see the "RADIUS Load Balancing" section.
Audio and Video Load Balancing
IOS SLB can balance RealAudio and RealVideo streams through Real-Time Streaming Protocol (RTSP), for servers running RealNetworks applications.
VPN Server Load Balancing
IOS SLB can balance Virtual Private Network (VPN) flows, including the following flows:
•
•
Redundancy Features
An IOS SLB device can represent one point of failure, and the servers can lose their connections to the backbone, if either of the following occurs:
•
•
To reduce that risk, IOS SLB supports the following redundancy enhancements, based on HSRP:
Stateless Backup
Stateless backup provides high network availability by routing IP flows from hosts on Ethernet networks without relying on the availability of one Layer 3 switch. Stateless backup is particularly useful for hosts that do not support a router discovery protocol (such as the Intermediate System-to-Intermediate System [IS-IS] Interdomain Routing Protocol [IDRP]) and do not have the functionality to shift to a new Layer 3 switch when their selected Layer 3 switch reloads or loses power.
Stateful Backup
Stateful backup enables IOS SLB to incrementally backup its load-balancing decisions, or "keep state," between primary and backup switches. The backup switch keeps its virtual servers in a dormant state until HSRP detects failover; then the backup (now primary) switch begins advertising virtual addresses and processing flows. You can use HSRP to configure a timer for failure detection.
Stateful backup provides IOS SLB with a one-to-one stateful or idle backup scheme. This means that only one instance of IOS SLB is handling client or server flows at a given time, and that there is at most one backup platform for each active IOS SLB switch.
The Home Agent Director do not support stateful backup.
Note
Active Standby
Active standby enables two IOS SLBs to load-balance the same virtual IP address while at the same time acting as backups for each other. If a site has only one virtual IP address to load-balance, an access router is used to direct a subset of the flows to each IOS SLB using policy-based routing.
IOS SLB firewall load balancing supports active standby. That is, you can configure two pairs of firewall load balancing devices (one pair on each side of the firewalls), with each device in each pair handling traffic and backing up its partner.
Exchange Director Features
IOS SLB supports the Exchange Director for the mobile Service Exchange Framework (mSEF) for Cisco Catalyst 6500 series switches and Cisco 7600 series routers. The Exchange Director provides the following features:
–
–
•
•
•
•
ASN Load Balancing
IOS SLB can provide load balancing across a set of Access Service Network (ASN) gateways. The gateway server farm appears to the base station as one ASN gateway.
When a Mobile Subscriber Station (MSS) wants to enter the network, the base station sends a Mobile Station Pre-Attachment request to the virtual IP address of the IOS SLB. IOS SLB selects an ASN gateway and forwards the request to that gateway. The gateway responds directly to the base station with a Mobile Station Pre-Attachment response. If configured to do so, the base station then returns a Mobile Station Pre-Attachment ACK to IOS SLB, which forwards the ACK to the selected gateway. Thereafter, all subsequent transactions flow between the base station and the gateway.
If sticky connections are enabled for the ASN gateways, IOS SLB makes a load-balancing decision once for a subscriber and then forwards all subsequent requests from the same subscriber to the same Cisco Broadband Wireless Gateway (BWG). The sticky information is replicated to the standby IOS SLB.
IOS SLB populates the sticky database with Mobile Stations IDs (MSIDs), with one sticky entry for each MSS. The sticky database enables IOS SLB to perform persistent session tracking of the real server selected for the MSID. The first packet sent to a virtual IP address from an MSS creates the session object and the sticky object. Subsequent packets from the MSS use the MSID to find the real server in the sticky database, if the session lookup fails. All packets that belong to a given MSS are load-balanced to same BWG as long as the sticky object exists.
Redundancy support has been provided by replicating the sticky MSID entries to the backup IOS SLB. Redundancy works in both the intra-chassis (stateful switchover) and inter-chassis (HSRP) environments. Sessions need not be replicated to the standby IOS SLB.
GPRS Load Balancing
GPRS is the packet network infrastructure based on the European Telecommunications Standards Institute (ETSI) Global System for Mobile Communication (GSM) phase 2+ standards for transferring packet data from the GSM mobile user to the packet data network (PDN). The Cisco gateway GPRS support node (GGSN) interfaces with the serving GPRS support node (SGSN) using the GTP, which in turn uses UDP for transport. IOS SLB provides GPRS load balancing and increased reliability and availability for the GGSN.
When configuring the network shared by IOS SLB and the GGSNs, keep the following considerations in mind:
•
•
–
–
•
•
•
IOS SLB supports two types of GPRS load balancing:
•
•
GPRS Load Balancing without GTP Cause Code Inspection
GPRS load balancing without GTP cause code inspection enabled is recommended for Cisco GGSNs. It has the following characteristics:
•
•
•
•
GPRS Load Balancing with GTP Cause Code Inspection
GPRS load balancing with GTP cause code inspection enabled allows IOS SLB to monitor all PDP context signaling flows to and from GGSN server farms. This enables IOS SLB to monitor GTP failure cause codes, detecting system-level problems in both Cisco and non-Cisco GGSNs.
Table 1 lists the PDP create response cause codes and the corresponding actions taken by IOS SLB.
GPRS load balancing with GTP cause code inspection enabled has the following characteristics:
•
•
•
•
•
Dual-Stack Support for GTP Load Balancing
IPv6 support enables IOS SLB to manage IPv6 addresses for GTP load balancing, for all versions of GTP (v0, v1, v2).
Dual-stack support enables IOS SLB to manage dual-stack implementations for GTP load balancing. A dual stack implementation is one that uses both IPv4 and IPv6 addresses.
When configuring dual-stack support for GTP load balancing, keep the following considerations in mind:
•
•
•
•
•
•
•
Home Agent Director
The Home Agent Director load balances Mobile IP Registration Requests (RRQs) among a set of home agents (configured as real servers in a server farm). Home agents are the anchoring points for mobile nodes. Home agents route flows for a mobile node to its current foreign agent (point of attachment).
The Home Agent Director has the following characteristics:
•
•
•
•
For more information about Mobile IP, home agents, and related topics, refer to the Cisco IOS IP Configuration Guide, Release 12.2.
KeepAlive Application Protocol (KAL-AP) Agent Support
Support for the KeepAlive Application Protocol (KAL-AP) agent support enables IOS SLB to perform load balancing in a global server load balancing (GSLB) environment. KAL-AP provides load information along with its keepalive response message to the KAL-AP manager or GSLB device, such as the Global Site Selector (GSS), and helps the GSLB device load-balance client requests to the least-loaded IOS SLB devices.
When configuring KAL-AP agent support for IOS SLB, keep the following considerations in mind:
•
•
KAL-AP calculates the load value in one of two ways: relatively or absolutely. (IOS SLB CPU/memory load might affect the final KAL-AP load value.)
Relative KAL-AP Load Value
If the farm-weight command is not configured in server farm configuration mode, or if DFP is not enabled for the IOS SLB, KAL-AP calculates a relative load value, using the following formula:
KAL-AP Load = 256 - (number-of-active-real-servers * 256/number-of-inservice-real-servers)
For example, if a site is provisioned with two real servers, and both real servers are inservice but only one is currently active, the resulting KAL-AP load value for that site is:
KAL-AP Load = 256 - (1 * 256/2) = 256 - 128 = 128
Absolute KAL-AP Load Value
If the farm-weight command is configured in server farm configuration mode, and DFP is enabled for the IOS SLB, KAL-AP calculates an absolute load value, using the following formula:
KAL-AP Load = 256 - (sum-of-max-dfp-weights-of-real-servers * 256/farm-weight)
Note
If the DFP connection to the real server is down, KAL-AP uses the setting of the weight command in SLB real server configuration mode. If no weight command is configured for the real server, KAL-AP uses the default weight of 8.For example, consider a site with the following settings:
•
•
•
The resulting KAL-AP load value for that site is:
KAL-AP Load = 256 - [(100 + 50) * 256/200] = 256 - 192 = 64
For best results, configure a farm-weight that is equal to the sum of the maximum DFP weights for the real servers in the server farm. For example, if there are three real servers in a server farm, configured with maximum DFP weights of 100, 50, and 50, then configure a farm-weight of 200 (that is, 100 + 50 + 50). If a real server is added to or removed from the server farm, you must adjust the farm-weight accordingly.
RADIUS Load Balancing
IOS SLB provides RADIUS load-balancing capabilities for RADIUS servers. In addition, IOS SLB can load-balance devices that proxy the RADIUS Authorization and Accounting flows in both traditional and mobile wireless networks, if desired. IOS SLB does this by correlating data flows to the same proxy that processed the RADIUS for that subscriber flow.
IOS SLB provides RADIUS load balancing in mobile wireless networks that use service gateways, such as the Cisco Service Selection Gateway (SSG) or the Cisco Content Services Gateway (CSG). The following mobile wireless networks are supported:
•
•
•
IOS SLB provides the following RADIUS load-balancing functions:
•
•
•
•
•
•
•
•
•
•
•
To perform RADIUS load balancing, IOS SLB uses the following RADIUS sticky databases:
•
Note
•
•
•
•
–
–
•
•
RADIUS Load Balancing Accelerated Data Plane Forwarding
RADIUS load balancing accelerated data plane forwarding, also known as Turbo RADIUS load balancing, is a high-performance solution that uses basic policy-based routing (PBR) route maps to manage subscriber data-plane traffic in a Cisco Content Services Gateway (CSG) environment.
When Turbo RADIUS load balancing receives a RADIUS payload, it takes the following actions:
1.
2.
3.
4.
If vendor-specific attribute (VSA) correlation is configured, and if the Cisco VSA is buffered, then the Cisco VSA is injected into the RADIUS Accounting-Start packet.
Turbo RADIUS load balancing does not require VSA correlation, but it does require a server farm configured with predictor route-map on the accounting virtual server.
Note
For more information about policy-based routing, see the "Policy-Based Routing" and "Configuring Policy-Based Routing" sections of the Cisco IOS IP Routing Configuration Guide.
In a mobile Service Exchange Framework (mSEF) environment, Turbo RADIUS load balancing does not require firewall load balancing on the network side of the CSG cluster. (Standard RADIUS load balancing does require firewall load balancing on the network side of the cluster.)
Turbo RADIUS load balancing:
•
•
•
WAP Load Balancing
You can use IOS SLB to load-balance wireless session protocol (WSP) sessions among a group of WAP gateways or servers on an IP bearer network. WAP runs on top of UDP on a set of well known ports, with each port indicating a different WAP mode:
•
•
•
•
IOS SLB uses WSP probes to detect failures in the WAP stack on port 9201.
Stateful Backup of Redundant Route Processors
When used with RPR+, IOS SLB supports the stateful backup of redundant route processors for mSEF for the Cisco Catalyst 6500 switches and Cisco 7600 routers. This enables you to deploy Cisco Multiprocessor WAN Application Modules (MWAMs) in the same chassis as IOS SLB, while maintaining high availability of load-balancing assignments.
Flow Persistence
Flow persistence provides intelligent return routing of load-balanced IP flows to the appropriate node, without the need for coordinated hash mechanisms on both sides of the load-balanced data path, and without using Network Address Translation (NAT) or proxies to change client or server IP addresses.
How to Configure the IOS SLB Feature
Configuring IOS SLB involves identifying server farms, configuring groups of real servers in server farms, and configuring the virtual servers that represent the real servers to the clients.
For configuration examples associated with these tasks, see the "Configuration Examples for IOS SLB" section.
For a complete description of the IOS SLB commands in this section, refer to the "Server Load Balancing Commands" chapter of the Cisco IOS IP Application Services Command Reference. To locate documentation of other commands that appear in this section, search online using Cisco.com.
To configure IOS SLB, perform the tasks in the following sections:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
How to Configure Required and Optional IOS SLB Functions
To configure IOS SLB functions, perform the tasks in the following sections. Required and optional tasks are indicated.
•
•
•
•
•
•
How to Configure a Server Farm and a Real Server
Perform this required task to configure a server farm and a real server.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode. If prompted, enter your password.
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 3
Adds a server farm definition to the IOS SLB configuration and enters server farm configuration mode.
Step 4
access interface
Example:Router(config-slb-sfarm)# access GigabitEthernet 0/1.1(Optional) Configures an access interface or subinterface for a server farm.
Step 5
bindid [bind-id]
Example:Router(config-slb-sfarm)# bindid 309(Optional) Specifies a bind ID on the server farm for use by Dynamic Feedback Protocol (DFP).
Note
Step 6
nat {client pool | server}
Example:Router(config-slb-sfarm)# nat server(Optional) Configures Network Address Translation (NAT) client translation mode or NAT server address translation mode on the server farm.
All IPv4 or IPv6 server farms that are associated with the same virtual server must have the same NAT configuration.
Step 7
predictor [roundrobin | leastconns | route-map mapname]
Example:Router(config-slb-sfarm)# predictor leastconns(Optional) Specifies the algorithm to be used to determine how a real server is selected.
Note
In GPRS load balancing without GTP cause code inspection enabled, you must accept the default setting (the weighted round robin algorithm).
The Home Agent Director requires the default setting (the weighted round robin algorithm).
When you specify the predictor route-map command in SLB server farm configuration mode, no further commands in SLB server farm configuration mode or real server configuration mode are allowed.For more details, see the following sections:
•
•
Step 8
probe probe
Example:Router(config-slb-sfarm)# probe PROBE1(Optional) Associates a probe with the real server.
Step 9
real ipv4-address [ipv6 ipv6-address] [port]
Example:Router(config-slb-sfarm)# real 10.1.1.1
Identifies a real server by IPv4 address, and optional IPv6 address and port number, as a member of a server farm and enters real server configuration mode.
Note
In VPN server load balancing, specify the IP addresses of the real servers acting as VPN terminators.
For the Home Agent Director, specify the IP addresses of the real servers acting as home agents.
For dual-stack support for GTP load balancing, specify the real server's IPv4 and IPv6 address.Step 10
Router(config-slb-real)# faildetect numconns 10 numclients 3
(Optional) Specifies the number of consecutive connection failures and, optionally, the number of unique client connection failures, that constitute failure of the real server.
•
•
Step 11
maxclients number-of-conns
Example:Router(config-slb-real)# maxclients 10
(Optional) Specifies the maximum number of IOS SLB RADIUS and GTP sticky subscribers that can be assigned to an individual virtual server.
Step 12
(Optional) Specifies the maximum number of active connections allowed on the real server at one time.
Step 13
(Optional) Specifies the threshold of consecutive unacknowledged SYNchronize sequence numbers (SYNs) or Create Packet Data Protocol (PDP) requests that, if exceeded, result in an attempted connection to a different real server.
Note
Step 14
retry retry-value
Example:Router(config-slb-real)# retry 120(Optional) Specifies the time interval, in seconds, to wait between the detection of a server failure and the next attempt to connect to the failed server.
Step 15
(Optional) Specifies the real server workload capacity relative to other servers in the server farm.
Note
Step 16
inservice
Example:Router(config-slb-real)# inserviceEnables the real server for use by IOS SLB.
Note
How to Configure a Virtual Server
Perform this required task to configure a virtual server. IOS SLB supports up to 500 virtual servers.
SUMMARY STEPS
1.
2.
3.
4.
or
virtual ipv4-address [ipv4-netmask [group]] [ipv6 ipv6-address [prefix ipv6-prefix]] {tcp | udp} [port | any] [service service]
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
DETAILED STEPS
How to Verify a Virtual Server
Perform the following optional task to verify a virtual server.
SUMMARY STEPS
1.
DETAILED STEPS
The following show ip slb vservers command verifies the configuration of the virtual servers PUBLIC_HTTP and RESTRICTED_HTTP:
Router# show ip slb vserversslb vserver prot virtual state conns-------------------------------------------------------------------PUBLIC_HTTP TCP 10.0.0.1:80 OPERATIONAL 0RESTRICTED_HTTP TCP 10.0.0.2:80 OPERATIONAL 0Router#How to Verify a Server Farm
Perform the following optional task to verify a server farm.
SUMMARY STEPS
1.
2.
DETAILED STEPS
The following show ip slb reals command shows the status of server farms PUBLIC and RESTRICTED, the associated real servers, and their status:
Router# show ip slb realreal farm name weight state conns---------------------------------------------------------------------10.1.1.1 PUBLIC 8 OPERATIONAL 010.1.1.2 PUBLIC 8 OPERATIONAL 010.1.1.3 PUBLIC 8 OPERATIONAL 010.1.1.20 RESTRICTED 8 OPERATIONAL 010.1.1.21 RESTRICTED 8 OPERATIONAL 0Router#The following show ip slb serverfarm command displays the configuration and status of server farms PUBLIC and RESTRICTED:
Router# show ip slb serverfarmserver farm predictor nat reals bind id---------------------------------------------------PUBLIC ROUNDROBIN none 3 0RESTRICTED ROUNDROBIN none 2 0Router#How to Verify Clients
Perform the following optional task to verify clients.
SUMMARY STEPS
1.
DETAILED STEPS
The following show ip slb conns command verifies the restricted client access and status:
Router# show ip slb connsvserver prot client real state nat-------------------------------------------------------------------------------RESTRICTED_HTTP TCP 10.4.4.0:80 10.1.1.20 CLOSING noneRouter#The following show ip slb conns command shows detailed information about the restricted client access status:
Router# show ip slb conns client 10.4.4.0 detailVSTEST_UDP, client = 10.4.4.0:80state = CLOSING, real = 10.1.1.20, nat = nonev_ip = 10.0.0.2:80, TCP, service = NONEclient_syns = 0, sticky = FALSE, flows attached = 0Router#How to Verify IOS SLB Connectivity
Perform the following optional task to verify IOS SLB connectivity.
SUMMARY STEPS
1.
DETAILED STEPS
To verify that the IOS SLB feature is installed and is operating correctly, ping the real servers from the IOS SLB switch, then ping the virtual servers from the clients.
The following show ip slb stats command shows detailed information about the IOS SLB network status:
Router# show ip slb statsPkts via normal switching: 0Pkts via special switching: 6Pkts dropped: 0Connections Created: 1Connections Established: 1Connections Destroyed: 0Connections Reassigned: 0Zombie Count: 0Connections Reused: 0•
•
See the "How to Monitor and Maintain the Cisco IOS SLB Feature" section for additional commands used to verify IOS SLB networks and connections.
How to Configure Firewall Load Balancing
Perform the following tasks to configure a basic IOS SLB firewall load-balancing network.
IOS SLB firewall load balancing uses probes to detect and recover from failures. You must configure a probe on each real server in the firewall farm. Ping probes are recommended; see the "How to Configure a Ping Probe" section for more details. If a firewall does not allow ping probes to be forwarded, use HTTP probes instead. See the "How to Configure an HTTP Probe" section for more details. You can configure more than one probe, in any combination of supported types (DNS, HTTP, TCP, or ping), for each firewall in a firewall farm.
When you perform server load balancing and firewall load balancing together on a Cisco Catalyst 6500 switch, use the mls ip slb wildcard search rp command in global configuration mode to reduce the probability of exceeding the capacity of the Telecommunications Access Method (TCAM) on the Policy Feature Card (PFC). See the "How to Configure a Wildcard Search" section for more details.
If IOS SLB experiences a high purge rate, the CPU might be impacted. If this problem occurs, use the no form of the mls ip slb purge global command in global configuration mode to disable purge throttling on TCP and UDP flow packets. See the"How to Configure Protocol-Level Purging of MLS Entries" section for more details.
This section describes the following IOS SLB firewall load-balancing configuration tasks. Required and optional tasks are indicated.
•
•
•
How to Configure a Firewall Farm
Perform the following required task to configure a firewall farm.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
DETAILED STEPS
How to Verify a Firewall Farm
Perform the following optional task to verify a firewall farm.
SUMMARY STEPS
1.
2.
DETAILED STEPS
The following show ip slb reals command shows the status of firewall farm FIRE1, the associated real servers, and the server status:
Router# show ip slb realreal farm name weight state conns--------------------------------------------------------------------10.1.1.2 FIRE1 8 OPERATIONAL 010.1.2.2 FIRE1 8 OPERATIONAL 0The following show ip slb firewallfarm command shows the configuration and status of firewall farm FIRE1:
Router# show ip slb firewallfarmfirewall farm hash state reals------------------------------------------------FIRE1 IPADDR INSERVICE 2How to Verify Firewall Connectivity
Perform the following optional task to verify firewall connectivity.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
To verify that IOS SLB firewall load balancing is configured and is operating correctly, perform the following steps:
Step 1
Step 2
Step 3
Router# show ip slb statsPkts via normal switching: 0Pkts via special switching: 0Pkts dropped: 0Connections Created: 1911871Connections Established: 1967754Connections Destroyed: 1313251Connections Reassigned: 0Zombie Count: 0Connections Reused: 59752Connection Flowcache Purges:1776582Failed Connection Allocs: 17945Failed Real Assignments: 0•
•
Step 4
Router# show ip slb reals detail172.16.88.5, SF1, state = OPERATIONAL, type = serveripv6 = 2342:2342:2343:FF04:2388:BB03:3223:8912conns = 0, dummy_conns = 0, maxconns = 4294967295weight = 8, weight(admin) = 8, metric = 0, remainder = 0reassign = 3, retry = 60failconn threshold = 8, failconn count = 0failclient threshold = 2, failclient count = 0total conns established = 0, total conn failures = 0server failures = 0Step 5
Router# show ip slb connsvserver prot client real state nat-------------------------------------------------------------------------------FirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneSee the "How to Monitor and Maintain the Cisco IOS SLB Feature" section for additional commands used to verify IOS SLB networks and connections.
How to Configure a Probe
The following sections describe how to configure and verify probes. By default, no probes are configured in IOS SLB.
IOS SLB uses probes to verify connectivity and detect failures. For a detailed description of each type of probe, see the "Probes" section.
Perform the following task to configure a probe. Required and optional tasks are indicated.
•
•
•
•
•
•
•
•
How to Configure a Custom UDP Probe
Perform the following task to configure a custom User Datagram Protocol (UDP) probe.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
How to Configure a DNS Probe
Perform the following task to configure a Domain Name System (DNS) probe.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
How to Configure an HTTP Probe
Perform the following task to configure an HTTP probe.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
How to Configure a Ping Probe
Perform the following task to configure a ping probe.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
How to Configure a TCP Probe
Perform the following task to configure a TCP probe.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
How to Configure a WSP Probe
Perform the following task to configure a Wireless Session Protocol (WSP) probe.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
How to Associate a Probe
Perform the following task to associate a probe with a real server or firewall.
After configuring a probe, you must associate the probe with a real server or firewall using the probe command. See the "How to Configure a Server Farm and a Real Server" section and the "How to Configure Firewall Load Balancing" section for more details.
Note
SUMMARY STEPS
1.
2.
3.
or
ip slb serverfarm server-farm
4.
DETAILED STEPS
How to Verify a Probe
Perform the following optional task to verify a probe.
SUMMARY STEP
1.
DETAILED STEP
To verify that a probe is configured correctly, use the show ip slb probe command:
Router# show ip slb probeServer:Port State Outages Current Cumulative----------------------------------------------------------------10.1.1.1:80 OPERATIONAL 0 never 00:00:0010.1.1.2:80 OPERATIONAL 0 never 00:00:0010.1.1.3:80 OPERATIONAL 0 never 00:00:00How to Configure DFP
Perform the following task to configure IOS SLB as a Dynamic Feedback Protocol (DFP) manager, and to identify a DFP agent with which IOS SLB can initiate connections.
You can define IOS SLB as a DFP manager, as a DFP agent for another DFP manager, or as both at the same time. Depending on your network configuration, you might enter the commands for configuring IOS SLB as a DFP manager and the commands for configuring IOS SLB as a DFP agent on the same device or on different devices.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
GPRS Load Balancing Configuration Task List
Perform the following tasks to configure general packet radio service (GPRS) load balancing.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Step 1
Configure a server farm and a real server.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for GPRS load balancing, keep the following considerations in mind:
•
–
–
•
•
•
–
Step 2
Configure a virtual server.
See the "How to Configure a Virtual Server" section.
When you configure the virtual command, keep the following considerations in mind:
•
•
•
•
–
In GPRS load balancing without GTP cause code inspection enabled, when you configure the idle timer using the idle command, specify an idle timer greater than the longest possible interval between PDP context requests on the SGSN.
–
•
–
–
–
Step 3
Configure the virtual IP address as a loopback on each of the GGSNs in the servers.
(Required for dispatched mode) This step is required only if you are using dispatched mode without GTP cause code inspection enabled. Refer to the Cisco IOS Interface Configuration Guide "Configuring Virtual Interfaces" section for more information.
Step 4
Route each GGSN to each associated SGSN.
The route can be static or dynamic, but the GGSN needs to be able to reach the SGSN. Refer to the Cisco IOS Mobile Wireless Configuration Guide "Configuring Network Access to the GGSN" section for more details.
Step 5
Route each SGSN to the virtual templates on each associated Cisco GGSN, and to the GPRS load-balancing virtual server.
(Required) Refer to the configuration guide for your SGSN for more details.
Step 6
Configure a GSN idle timer.
(Optional) This step is applicable only if GTP cause code inspection is enabled.
See the "How to Configure a GSN Idle Timer" section for more information.
How to Configure a GSN Idle Timer
Perform this task to configure a GPRS support node (GSN) idle timer.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
GGSN-IOS SLB Messaging Task List
Perform this task to configure GGSN-IOS SLB messaging.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Step 1
Configure the GGSN to support GGSN-IOS SLB messaging.
When you configure GGSN-IOS SLB messaging support, configure all IOS SLB virtual servers that share the same GGSN to use the same NAT mode, either dispatched mode or directed mode, using the gprs slb mode command. The virtual servers cannot use a mix of dispatched mode and directed mode, because you can configure only one NAT mode on a given GGSN.
For more information, refer to the Cisco IOS Mobile Wireless Configuration Guide for GGSN Release 5.0 for Cisco IOS Release 12.3(2)XU or later.
Step 2
Configure a server farm and a real server.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for GGSN-IOS SLB messaging, to prevent IOS SLB from failing the current real server when reassigning the session to a new real server, disable automatic server failure detection by specifying the no faildetect inband command.
Step 3
Configure a virtual server.
See the "How to Configure a Virtual Server" section.
When you configure the virtual server for GGSN-IOS SLB messaging, specify the gtp notification cac command to limit the number of times IOS SLB can reassign a session to a new real server.
How to Configure GPRS Load Balancing Maps
Perform this task to configure GPRS load balancing maps.
GPRS load balancing maps enable IOS SLB to categorize and route user traffic based on access point names (APNs). To enable maps for GPRS load balancing, you must define a GPRS Tunneling Protocol (GTP) map, then associate the map with a server farm.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
How to Configure KAL-AP Agent Support
Perform this task to configure KeepAlive Application Protocol (KAL-AP) agent support.
KAL-AP agent support enables IOS SLB to perform load balancing in a global server load balancing (GSLB) environment.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
DETAILED STEPS
RADIUS Load Balancing Configuration Task List
Perform this task to configure RADIUS load balancing.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Step 1
Configure a server farm and a real server.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for RADIUS load balancing, keep the following considerations in mind:
•
•
•
Step 2
Configure a virtual server.
See the "How to Configure a Virtual Server" section.
When you configure the virtual server for RADIUS load balancing, keep the following considerations in mind:
•
•
If you configure the access interface route framed-ip command, you must also configure the virtual command with the service radius keywords specified.
•
•
•
Configure a virtual server.
(continued)•
If you configure the sticky radius framed-ip command, you must also configure the virtual command with the service radius keywords specified.
•
To prevent IOS SLB from purging entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting On or Off message, specify the no purge radius framed-ip acct on-off virtual server configuration command.
•
To prevent IOS SLB from purging entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting-Stop message, specify the no purge radius framed-ip acct stop virtual server configuration command.
•
To enable IOS SLB to create the IOS SLB RADIUS username sticky database and direct RADIUS requests from a subscriber to the same service gateway based on the username, specify the sticky command with the radius username keywords.
If you configure the sticky radius calling-station-id command or the sticky radius username command, you must also configure the virtual command with the service radius keywords specified, and you must configure the sticky radius framed-ip command.
You cannot configure both the sticky radius calling-station-id command and the sticky radius username command on the same virtual server.
•
To configure a timer for VSA correlation for an authentication virtual server, configure the radius inject auth timer command.
To buffer VSAs for VSA correlation for an authentication virtual server, configure the radius inject auth vsa command.
To configure a VSA correlation group for an accounting virtual server, and to enable Message Digest Algorithm Version 5 (MD5) authentication for VSA correlation, configure the radius inject acct command.
Step 3
Enable IOS SLB to inspect packets for RADIUS framed-IP sticky routing.
(Optional) See the "How to Enable IOS SLB to Inspect Packets for RADIUS Framed-IP Sticky Routing" section.
Step 4
Configure RADIUS load balancing maps.
(Optional) See the "How to Configure RADIUS Load Balancing Maps" section.
Step 5
Configure RADIUS load balancing accelerated data plane forwarding.
(Optional) See the "How to Configure RADIUS Load Balancing Accelerated Data Plane Forwarding" section.
Step 6
Increase the number of available MLS entries.
(Optional) If you are running IOS SLB in dispatched mode on a Cisco Catalyst 6500 series switch with Cisco Supervisor Engine 2, you can improve performance by configuring the no mls netflow command. This command increases the number of MLS entries available for hardware switching of end-user flows.
Note
For more information about configuring MLS NetFlow, refer to the Cisco Catalyst 6000 Family IOS Software Configuration Guide.
Step 7
Configure a probe.
See the "How to Configure a Probe" section.
To verify the health of the server, configure a ping probe.
How to Enable IOS SLB to Inspect Packets for RADIUS Framed-IP Sticky Routing
Perform this task to enable IOS SLB to inspect packets for RADIUS framed-IP sticky routing.
You can enable IOS SLB to inspect packets whose source IP addresses match a configured IP address and subnet mask. If the source IP address of an inspected packet matches an entry in the IOS SLB RADIUS framed-IP sticky database, IOS SLB uses that entry to route the packet. Otherwise, IOS routes the packet.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
How to Configure RADIUS Load Balancing Maps
Perform this task to configure RADIUS load balancing maps.
RADIUS load balancing maps enable IOS SLB to categorize and route user traffic based on RADIUS calling station IDs and usernames. To enable maps for RADIUS load balancing, you must define a RADIUS map, then associate the map with a server farm.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
DETAILED STEPS
How to Configure RADIUS Load Balancing Accelerated Data Plane Forwarding
Perform this task to configure RADIUS load balancing accelerated data plane forwarding.
RADIUS load balancing accelerated data plane forwarding, also known as Turbo RADIUS load balancing, is a high-performance solution that uses basic policy-based routing (PBR) route maps to manage subscriber data-plane traffic in a Cisco Content Services Gateway (CSG) environment.
Prerequisites
Turbo RADIUS load balancing requires a server farm configured with predictor route-map on the accounting virtual server.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
DETAILED STEPS
Exchange Director for mSEF Configuration Task List
Perform this task to configure Exchange Director for mobile Service Exchange Framework (mSEF).
This section contains the following information:
•
•
RADIUS Configuration for the Exchange Director
Perform this task to configure RADIUS load balancing for the Exchange Director.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Step 1
Configure a server farm and a real server.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for RADIUS for the Exchange Director, keep the following considerations in mind:
•
•
Step 2
Configure a virtual server.
See the "How to Configure a Virtual Server" section.
When you configure the virtual server for RADIUS for the Exchange Director, keep the following considerations in mind:
•
•
If you configure the access interface route framed-ip command, you must also configure the virtual command with the service radius keywords specified.
•
•
•
•
If you configure the sticky radius framed-ip command, you must also configure the virtual command with the service radius keywords specified.
Configure a virtual server.
(continued)•
To enable IOS SLB to create the IOS SLB RADIUS username sticky database and direct RADIUS requests from a subscriber to the same service gateway based on the username, specify the sticky command with the radius username keywords.
If you configure the sticky radius calling-station-id command or the sticky radius username command, you must also configure the virtual command with the service radius keywords specified, and you must configure the sticky radius framed-ip command.
You cannot configure both the sticky radius calling-station-id command and the sticky radius username command on the same virtual server.
Step 3
Enable IOS SLB to inspect packets for RADIUS framed-IP sticky routing.
(Optional) See the "How to Enable IOS SLB to Inspect Packets for RADIUS Framed-IP Sticky Routing" section.
Step 4
Configure RADIUS load balancing maps.
(Optional) See the "How to Configure RADIUS Load Balancing Maps" section.
Step 5
Increase the number of available MLS entries.
(Optional) If you are running IOS SLB in dispatched mode on a Cisco Catalyst 6500 series switch with Cisco Supervisor Engine 2, you can improve performance by configuring the no mls netflow command. This command increases the number of MLS entries available for hardware switching of end-user flows.
Note
For more information about configuring MLS NetFlow, refer to the Cisco Catalyst 6000 Family IOS Software Configuration Guide.
Step 6
Configure a probe.
See the "How to Configure a Probe" section.
To verify the health of the server, configure a ping probe.
Firewall Configuration for the Exchange Director
Perform this task to configure firewall load balancing for the Exchange Director.
This section lists the tasks used to configure firewalls for the Exchange Director. Detailed configuration information is contained in the referenced sections of this or other documents. Required and optional tasks are indicated.
•
•
•
•
•
•
•
•
How to Configure a Firewall Farm
Perform the following required task to configure a firewall farm.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
DETAILED STEPS
How to Verify a Firewall Farm
Perform the following optional task to verify a firewall farm.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Step 1
Router# show ip slb realreal farm name weight state conns--------------------------------------------------------------------10.1.1.2 FIRE1 8 OPERATIONAL 010.1.2.2 FIRE1 8 OPERATIONAL 0Step 2
Router# show ip slb firewallfarmfirewall farm hash state reals------------------------------------------------FIRE1 IPADDR INSERVICE 2
How to Verify Firewall Connectivity
Perform the following optional task to verify firewall connectivity.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
To verify that IOS SLB firewall load balancing is configured and operating correctly, perform the following steps:
Step 1
Step 2
Step 3
Router# show ip slb statsPkts via normal switching: 0Pkts via special switching: 0Pkts dropped: 0Connections Created: 1911871Connections Established: 1967754Connections Destroyed: 1313251Connections Reassigned: 0Zombie Count: 0Connections Reused: 59752Connection Flowcache Purges:1776582Failed Connection Allocs: 17945Failed Real Assignments: 0•
•
Step 4
Router# show ip slb reals detail172.16.88.5, SF1, state = OPERATIONAL, type = serveripv6 = 2342:2342:2343:FF04:2388:BB03:3223:8912conns = 0, dummy_conns = 0, maxconns = 4294967295weight = 8, weight(admin) = 8, metric = 0, remainder = 0reassign = 3, retry = 60failconn threshold = 8, failconn count = 0failclient threshold = 2, failclient count = 0total conns established = 0, total conn failures = 0server failures = 0Step 5
Router# show ip slb connsvserver prot client real state nat-------------------------------------------------------------------------------FirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFirewallTCP TCP 80.80.50.187:40000 10.1.1.4 ESTAB noneFor additional commands used to verify IOS SLB networks and connections, see the "How to Monitor and Maintain the Cisco IOS SLB Feature" section.
How to Configure a Probe
Perform the following required task to configure a probe.
SUMMARY STEPS
1.
DETAILED STEPS
The Exchange Director uses probes to detect and recover from failures. You must configure a probe on each real server in the firewall farm.
•
•
•
How to Configure a Wildcard Search
Perform the following optional task to configure a wildcard search.
SUMMARY STEPS
1.
DETAILED STEPS
Use the mls ip slb wildcard search rp command to reduce the probability of exceeding the capacity of the Telecommunications Access Method (TCAM) on the Policy Feature Card (PFC).
How to Configure Protocol-Level Purging of MLS entries
Perform the following task to configure protocol-level purging of MLS entries from active TCP and UDP flow packets.
SUMMARY STEPS
1.
DETAILED STEPS
Use the mls ip slb purge global command to enable purge throttling on TCP and UDP flow packets. (This is the default setting.)
To disable purge throttling on TCP and UDP flow packets, use the no form of this command.
How to Configure Connection Purge Request Behavior
Perform the following task to enable IOS SLB firewall load balancing to send purge requests for connections.
SUMMARY STEPS
1.
DETAILED STEPS
Use the purge connection command to enable IOS SLB firewall load balancing to send purge requests for connections. (This is the default setting.)
To completely stop the sending of purge requests, use the no form of this command.
How to Configure Sticky Connection Purge Request Behavior
Perform the following task to enable IOS SLB firewall load balancing to send purge requests for sticky connections when the sticky timer expires.
SUMMARY STEPS
1.
DETAILED STEPS
Use the purge sticky command to enable IOS SLB firewall load balancing to send purge requests for sticky connections when the sticky timer expires. (This is the default setting.)
To completely stop the sending of purge requests for sticky connections, use the no form of this command.
VPN Server Load Balancing Configuration Task List
Perform the following task to configure VPN server load balancing.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Step 1
Configure a server farm and a real server.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for VPN server load balancing, specify the IP addresses of the real servers acting as VPN terminators using the real command.
Step 2
Configure a virtual server.
See the "How to Configure a Virtual Server" section.
When you configure the virtual server for VPN server load balancing of IPSec flows, keep the following considerations in mind:
•
•
•
When you configure the virtual server for VPN server load balancing of Point-to-Point Tunneling Protocol (PPTP) flows, keep the following considerations in mind:
•
•
•
Step 3
Configure a probe.
See the "How to Configure a Probe" section.
To verify the health of the server, configure a ping probe.
ASN Load Balancing Configuration Task List
Perform the following task to configure load balancing across a set of Access Service Network (ASN) gateways.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Step 1
Configure the base station.
To enable IOS SLB to manage requests from the Mobile Subscriber Station (MSS), configure the base station with the virtual IP address of the IOS SLB device.
Step 2
Configure a probe.
See the "How to Configure a Probe" section.
To verify the health of the server, configure a ping probe.
Step 3
Associate a server farm and a real server with the probe.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for ASN load balancing, keep the following considerations in mind:
•
•
Step 4
Associate a virtual server with the server farm.
See the "How to Configure a Virtual Server" section.
When you configure the virtual server for ASN load balancing, keep the following considerations in mind:
•
•
•
•
•
Home Agent Director Configuration Task List
Perform the following task to configure the Home Agent Director.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Step 1
Configure a server farm and a real server.
See the "How to Configure a Server Farm and a Real Server" section.
When you configure the server farm and real server for the Home Agent Director, keep the following considerations in mind:
•
•
Step 2
Configure a virtual server.
See the "How to Configure a Virtual Server" section.
When you configure the virtual server for the Home Agent Director using the virtual command, keep the following considerations in mind:
•
•
•
•
Step 3
Configure the virtual IP address as a loopback on each of the home agents in the servers.
(Required for dispatched mode) This step is required only if you are using dispatched mode. Refer to the "Configuring a Loopback Interface" section in the Cisco IOS Interface Configuration Guide, Release 12.2 for more information.
Step 4
Configure DFP.
(Optional) See the "How to Configure DFP" section.
When you configure DFP for the Home Agent Director, keep the following considerations in mind:
•
•
•
For information about these Mobile IP commands, refer to the Cisco Mobile Wireless Home Agent Release 2.0 feature module.
How to Configure NAT
Perform the following task to configure the IOS SLB Network Address Translation (NAT) client address pool for client NAT.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
You must also specify either NAT client translation mode or NAT server address translation mode on the server farm, using the nat command. See the "How to Configure a Server Farm and a Real Server" section for more details. When you configure the virtual server for NAT, remember that you cannot configure client NAT for an ESP or GRE virtual server.
How to Configure Static NAT
Perform the following task to configure static NAT.
Static NAT enables you to allow some users to use NAT and allow other users on the same Ethernet interface to continue with their own IP addresses. This option enables you to provide a default NAT behavior for real servers, differentiating between responses from a real server, and connection requests initiated by the real server.
Note
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Stateless Backup Configuration Task List
Perform the following task to configure stateless backup over VLANs between IOS SLB devices.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Step 1
Configure required and optional IOS SLB functions.
(Required for server load balancing) See the "How to Configure Required and Optional IOS SLB Functions" section.
Step 2
Configure firewall load balancing.
(Required for firewall load balancing) See the "How to Configure Firewall Load Balancing" section.
Step 3
Configure the IP routing protocol.
Refer to the "IP Routing Protocols" chapter of the Cisco IOS IP Configuration Guide, Release 12.2 for details.
Step 4
Configure the VLAN between the IOS SLB devices.
Refer to the "Virtual LANs" chapter of the Cisco IOS Switching Services Configuration Guide, Release 12.2 for details.
Step 5
Verify the stateless backup configuration.
(Optional) See the "How to Verify the Stateless Backup Configuration" section.
How to Verify the Stateless Backup Configuration
Perform the following task to verify the stateless backup configuration.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
For server load balancing, to verify that stateless backup has been configured and is operating correctly, use the following show ip slb vservers commands to display information about the IOS SLB virtual server status:
Router# show ip slb vserversslb vserver prot virtual state conns-------------------------------------------------------------------VS1 TCP 10.10.10.12:23 OPERATIONAL 2VS2 TCP 10.10.10.18:23 OPERATIONAL 2Router# show ip slb vservers detailVS1, state = OPERATIONAL, v_index = 10virtual = 10.10.10.12:23, TCP, service = NONE, advertise = TRUEserver farm = SERVERGROUP1, delay = 10, idle = 3600sticky timer = 0, sticky subnet = 255.255.255.255sticky group id = 0synguard counter = 0, synguard period = 0conns = 0, total conns = 0, syns = 0, syn drops = 0standby group = NoneVS2, state = INSERVICE, v_index = 11virtual = 10.10.10.18:23, TCP, service = NONE, advertise = TRUEserver farm = SERVERGROUP2, delay = 10, idle = 3600sticky timer = 0, sticky subnet = 255.255.255.255sticky group id = 0synguard counter = 0, synguard period = 0conns = 0, total conns = 0, syns = 0, syn drops = 0standby group = NoneFor firewall load balancing, to verify that stateless backup has been configured and is operating correctly, use the following show ip slb firewallfarm commands to display information about the IOS SLB firewall farm status:
Router# show ip slb firewallfarmfirewall farm hash state reals------------------------------------------------FIRE1 IPADDR INSERVICE 2Router# show ip slb firewallfarm detailsFIRE1, hash = IPADDRPORT, state = INSERVICE, reals = 2FirewallTCP:sticky timer = 0, sticky subnet = 255.255.255.255idle = 3600, delay = 10, syns = 1965732, syn drop = 0maxconns = 4294967295, conns = 597445, total conns = 1909512FirewallUDP:sticky timer = 0, sticky subnet = 255.255.255.255idle = 3600maxconns = 1, conns = 0, total conns = 1Real firewalls:10.1.1.3, weight = 10, OPERATIONAL, conns = 29882310.1.1.4, weight = 10, OPERATIONAL, conns = 298622Total connections = 597445Stateful Backup of Redundant Route Processors Configuration Task List
Perform the following task to configure stateful backup of redundant route processors.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Step 1
Configure the replication message rate for slave replication.
Specify the ip slb replicate slave rate command in global configuration mode.
Step 2
Configure required and optional IOS SLB functions.
(Required for server load balancing) See the "How to Configure Required and Optional IOS SLB Functions" section.
When you configure the virtual server for stateful backup of redundant route processors, keep the following considerations in mind:
•
•
Step 3
Configure firewall load balancing.
(Required for firewall load balancing) See the "How to Configure Firewall Load Balancing" section.
When you configure the firewall farm for stateful backup of redundant route processors, keep the following considerations in mind:
•
•
How to Configure Database Entries
Perform the following task to configure database entries.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
How to Configure Buffers for the Fragment Database
Perform the following task to configure buffers for the fragment database.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
How to Clear Databases and Counters
Perform the following task to clear databases and counters.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
How to Configure a Wildcard Search
Perform the following task to configure a wildcard search.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
How to Configure Protocol-Level Purging of MLS Entries
Perform the following task to specify protocol-level purging of MLS entries from active TCP and UDP flow packets.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
How to Purge and Reassign Connections
Perform the following task to purge and reassign connections.
You can enable IOS SLB to automatically remove connections to failed real servers and firewalls from the connection database even if the idle timers have not expired. This function is useful for applications that do not rotate the source port (such as IKE), and for protocols that do not have ports to differentiate flows (such as ESP).
You can also enable IOS SLB to automatically reassign to a new real server or firewall RADIUS sticky objects that are destined for a failed real server or firewall.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
How to Disable Automatic Server Failure Detection
Perform the following task to disable automatic server failure detection.
If you have configured all-port virtual servers (that is, virtual servers that accept flows destined for all ports except GTP ports), flows can be passed to servers for which no application port exists. When the servers reject these flows, IOS SLB might fail the servers and remove them from load balancing. This situation can also occur in slow-to-respond AAA servers in RADIUS load-balancing environments. To prevent this situation, you can disable automatic server failure detection.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
How to Monitor and Maintain the Cisco IOS SLB Feature
Perform the following task to obtain and display runtime information about IOS SLB.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
DETAILED STEPS
Step 1
Displays all connections managed by IOS SLB, or, optionally, only those connections associated with a particular virtual server or client. The following is sample output from this command:
Router# show ip slb connsvserver prot client real state----------------------------------------------------------------------------TEST TCP 10.150.72.183:328 10.80.90.25:80 INITTEST TCP 10.250.167.226:423 10.80.90.26:80 INITTEST TCP 10.234.60.239:317 10.80.90.26:80 ESTABTEST TCP 10.110.233.96:747 10.80.90.26:80 ESTABTEST TCP 10.162.0.201:770 10.80.90.30:80 CLOSINGTEST TCP 10.22.225.219:995 10.80.90.26:80 CLOSINGTEST TCP 10.2.170.148:169 10.80.90.30:80Step 2
Displays information about Dynamic Feedback Protocol (DFP) and DFP agents, and about the weights assigned to real servers. The following is sample output from this command:
Router# show ip slb dfpDFP Manager:Current passwd:NONE Pending passwd:NONEPasswd timeout:0 secAgent IP Port Timeout Retry Count Interval--------------------------------------------------------------172.16.2.34 61936 0 0 180 (Default)Step 3
Displays information about firewall farms. The following is sample output from this command:
Router# show ip slb firewallfarmfirewall farm hash state reals------------------------------------------------FIRE1 IPADDR OPERATIONAL 2Step 4
Displays information from the IOS SLB fragment database. The following is sample output from this command:
Router# show ip slb fragmentsip src id forward src nat dst nat---------------------------------------------------------------------10.11.2.128 12 10.11.2.128 10.11.11.11 10.11.2.12810.11.2.128 13 10.11.2.128 10.11.11.11 10.11.2.12810.11.2.128 14 10.11.2.128 10.11.11.11 10.11.2.12810.11.2.128 15 10.11.2.128 10.11.11.11 10.11.2.12810.11.2.128 16 10.11.2.128 10.11.11.11 10.11.2.128Step 5
Displays IOS SLB GPRS Tunneling Protocol (GTP) information. The following is sample output from this command:
Router# show ip slb gtp gsn 10.0.0.0type ip recovery-ie purging------------------------------------------SGSN 10.0.0.0 UNKNOWN NStep 6
Displays information about IOS SLB protocol maps. The following is sample output from this command:
Router# show ip slb mapID: 1, Service: GTPAPN: Cisco.com, yahoo.comPLMN ID(s): 11122, 444353SGSN access list: 100ID: 2, Service: GTPPLMN ID(s): 67523, 345222PDP Type: IPv4, PPPID: 3, Service: GTPPDP Type: IPv6ID: 4, Service: RADIUSCalling-station-id: "?919*"ID: 5, Service: RADIUSUsername: ". .778cisco.*"Step 7
Displays information about the IOS SLB NAT configuration. The following is sample output from this command:
Router# show ip slb natpoolnat client B 209.165.200.225 1.1.1.6 1.1.1.8 Netmask 255.255.255.0nat client A 10.1.1.1 1.1.1.5 Netmask 255.255.255.0Step 8
Displays information about probes defined to IOS SLB. The following is sample output from this command:
Router# show ip slb probeServer:Port State Outages Current Cumulative----------------------------------------------------------------10.10.4.1:0 OPERATIONAL 0 never 00:00:0010.10.5.1:0 FAILED 1 00:00:06 00:00:06Step 9
Displays information about the real servers defined to IOS SLB. The following is sample output from this command:
Router# show ip slb realsreal farm name weight state conns--------------------------------------------------------------------10.80.2.112 FRAG 8 OUTOFSERVICE 010.80.5.232 FRAG 8 OPERATIONAL 010.80.15.124 FRAG 8 OUTOFSERVICE 010.254.2.2 FRAG 8 OUTOFSERVICE 010.80.15.124 LINUX 8 OPERATIONAL 010.80.15.125 LINUX 8 OPERATIONAL 010.80.15.126 LINUX 8 OPERATIONAL 010.80.90.25 SRE 8 OPERATIONAL 22010.80.90.26 SRE 8 OPERATIONAL 21610.80.90.27 SRE 8 OPERATIONAL 21610.80.90.28 SRE 8 TESTING 110.80.90.29 SRE 8 OPERATIONAL 22110.80.90.30 SRE 8 OPERATIONAL 22410.80.30.3 TEST 100 READY_TO_TEST 010.80.30.4 TEST 100 READY_TO_TEST 010.80.30.5 TEST 100 READY_TO_TEST 010.80.30.6 TEST 100 READY_TO_TEST 0Step 10
Displays information about the IOS SLB replication configuration. The following is sample output from this command:
Router# show ip slb replicateVS1, state = NORMAL, interval = 10Slave Replication: EnabledSlave Replication statistics:unsent conn updates: 0conn updates received: 0conn updates transmitted: 0update messages received: 0update messages transmitted: 0Casa Replication:local = 10.1.1.1 remote = 10.2.2.2 port = 1024current password = <none> pending password = <none>password timeout = 180 sec (Default)Casa Replication statistics:unsent conn updates: 0conn updates received: 0conn updates transmitted: 0update packets received: 0update packets transmitted: 0failovers: 0Step 11
Displays information about the server farms defined to IOS SLB. The following is sample output from this command:
Router# show ip slb serverfarmsserver farm predictor reals bind id-------------------------------------------------FRAG ROUNDROBIN 4 0LINUX ROUNDROBIN 3 0SRE ROUNDROBIN 6 0TEST ROUNDROBIN 4 0Step 12
Displays information about sessions managed by IOS SLB. The following is sample output from this command:
Router# show ip slb sessions radiusSource Dest RetryAddr/Port Addr/Port Id Count Real Vserver------------------------------------------------------------------------------10.10.11.1/1645 10.10.11.2/1812 15 1 10.10.10.1 RADIUS_ACCTStep 13
Displays information about the IOS SLB server Network Address Translation (NAT) configuration. The following is sample output from this command:
Router# show ip slb staticreal action address counter---------------------------------------------------------------10.11.3.4 drop 0.0.0.0 010.11.3.1 NAT 10.11.11.11 310.11.3.2 NAT sticky 10.11.11.12 010.11.3.3 NAT per-packet 10.11.11.13 0Step 14
Displays IOS SLB statistics. The following is sample output from this command:
Router# show ip slb statsPkts via normal switching: 779Pkts via special switching: 0Pkts via slb routing: 0Pkts Dropped: 4Connections Created: 4Connections Established: 4Connections Destroyed: 4Connections Reassigned: 5Zombie Count: 0Connections Reused: 0Connection Flowcache Purges: 0Failed Connection Allocs: 0Failed Real Assignments: 0RADIUS Framed-IP Sticky Count: 0RADIUS username Sticky Count: 0RADIUS calling-station-id Sticky Count: 0GTP IMSI Sticky Count: 0Failed Correlation Injects: 0Pkt fragments drops in ssv: 0ASN MSID sticky count: 1Step 15
Displays information about the sticky connections defined to IOS SLB. The following is sample output from this command:
Router# show ip slb stickyclient netmask group real conns-----------------------------------------------------------------------10.10.2.12 255.255.0.0 4097 10.10.3.2 1Step 16
Displays information about the virtual servers defined to IOS SLB. The following is sample output from this command:
Router# show ip slb vserversslb vserver prot virtual state conns---------------------------------------------------------------------TEST TCP 10.80.254.3:80 OPERATIONAL 1013TEST21 TCP 10.80.254.3:21 OUTOFSERVICE 0TEST23 TCP 10.80.254.3:23 OUTOFSERVICE 0Step 17
Displays information about the wildcard representation for virtual servers defined to IOS SLB. The following is sample output from this command:
Router# show ip slb wildcardInterface Source Address Port Destination Address Port ProtANY 0.0.0.0/0 0 3.3.3.3/32 2123 UDPANY 0.0.0.0/0 0 3.3.3.3/32 0 UDPANY 0.0.0.0/0 0 0.0.0.0/0 0 ICMPInterface: ANYSource Address [Port]: : :/0[0]Destination Address [Port]: 2342:2342:2343:FF04:2341:AA03:2323:8912/128[0]Protocol: ICMPV6Interface: ANYSource Address [Port]: : :/0[0]Destination Address [Port]: 2342:2342:2343:FF04:2341:AA03:2323:8912/128[2123]Protocol: UDPConfiguration Examples for IOS SLB
This section provides real-world examples of IOS SLB configurations. For a complete description of the IOS SLB commands in this section, refer to the Cisco IOS IP Application Services Command Reference. To locate documentation of other commands that appear in this section, search online using Cisco.com.
This section includes the following examples:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
Example: How to Configure a Basic IOS SLB Network
Figure 2 shows a sample IOS SLB network with the following components:
•
•
–
–
•
–
–
Figure 2 Example IOS SLB Network
The following sections include examples of the configuration commands used to configure and verify the IOS SLB network shown in Figure 2:
•
Server Farm Configuration
The following example shows the configuration for the server farm PUBLIC, associated with three real servers:
ip slb serverfarm PUBLICreal 10.1.1.1reassign 2faildetect numconns 4 numclients 2retry 20inserviceexitreal 10.1.1.2reassign 2faildetect numconns 4retry 20inserviceexitreal 10.1.1.3reassign 2faildetect numconns 4retry 20inserviceendThe following example shows the configuration for the server farm RESTRICTED, associated with two real servers:
ip slb serverfarm RESTRICTEDreal 10.1.1.20reassign 2faildetect numconns 4retry 20inserviceexitreal 10.1.1.21reassign 2faildetect numconns 4retry 20inserviceendVirtual Server Configuration
The following example shows the configuration for the virtual servers PUBLIC_HTTP and RESTRICTED_HTTP:
ip slb vserver PUBLIC_HTTPvirtual 10.0.0.1 tcp wwwserverfarm PUBLICidle 120delay 5inserviceexitip slb vserver RESTRICTED_HTTPvirtual 10.0.0.2 tcp wwwserverfarm RESTRICTEDidle 120delay 5inserviceendRestricted Client Configuration
The following example shows the configuration for the virtual server RESTRICTED_HTTP:
ip slb vserver RESTRICTED_HTTPno inserviceclient 10.4.4.0 255.255.255.0inserviceendExample: How to Configure a Complete IOS SLB Network
The following example provides a complete configuration using many of the commands described in this feature document:
ip slb probe PROBE2 httprequest method POST url /probe.cgi?allheader HeaderName HeaderValue!ip slb serverfarm PUBLICnat serverreal 10.1.1.1reassign 4faildetect numconns 16retry 120inservicereal 10.1.1.2reassign 4faildetect numconns 16retry 120inserviceprobe PROBE2!ip slb serverfarm RESTRICTEDpredictor leastconnsbindid 309real 10.1.1.1weight 32maxconns 1000reassign 4faildetect numconns 16retry 120inservicereal 10.1.1.20reassign 4faildetect numconns 16retry 120inservicereal 10.1.1.21reassign 4faildetect numconns 16retry 120inservice!ip slb vserver PUBLIC_HTTPvirtual 10.0.0.1 tcp wwwserverfarm PUBLIC!ip slb vserver RESTRICTED_HTTPvirtual 10.0.0.2 tcp wwwserverfarm RESTRICTEDno advertisesticky 60 group 1idle 120delay 5client 10.4.4.0 255.255.255.0synguard 3600000inserviceExamples: How to Configure IOS SLB with Firewall Load Balancing
This section contains the following examples, illustrating several different IOS SLB firewall load-balancing configurations:
•
•
•
•
•
Example: How to Configure IOS SLB with Basic Firewall Load Balancing
Figure 3 shows a sample IOS SLB firewall load-balancing network with the following components:
•
•
•
•
Figure 3 IOS SLB with Layer 3 Firewalls in Different Subnets
When you configure IOS SLB firewall load balancing, the load-balancing devices use route lookup to recognize flows destined for the firewalls. To enable route lookup, you must configure each device with the IP address of each firewall that will route flows to that device.
In the following firewall farm configuration samples:
•
•
Internal Firewall Load-Balancing Device
The following example shows the configuration for ping probe PROBE1, HTTP probe PROBE2, and firewall farm FIRE1, associated with the two real servers for the load-balancing device on the internal (secure) side of the firewall:
!-----Ping probeip slb probe PROBE1 ping!-----IP address of other load-balancing deviceaddress 10.1.1.1faildetect 4!-----HTTP probeip slb probe PROBE2 http!-----IP address of other load-balancing deviceaddress 10.1.2.1expect status 401!-----Firewall farm FIRE1ip slb firewallfarm FIRE1!-----First firewallreal 10.1.4.1probe PROBE1!-----Enable first firewallinservice!-----Second firewallreal 10.1.3.1probe PROBE2!-----Enable second firewallinserviceExternal Firewall Load-Balancing Device
The following example shows the configuration for ping probe PROBE1, HTTP probe PROBE2, and firewall farm FIRE1, associated with the two real servers for the load-balancing device on the external (Internet) side of the firewall:
!-----Ping probeip slb probe PROBE1 ping!-----IP address of other load-balancing deviceaddress 10.1.4.2faildetect 4!-----HTTP probeip slb probe PROBE2 http!-----IP address of other load-balancing deviceaddress 10.1.3.2expect status 401!-----Firewall farm FIRE1ip slb firewallfarm FIRE1!-----First firewallreal 10.1.1.2probe PROBE1!-----Enable first firewallinservice!-----Second firewallreal 10.1.2.2probe PROBE2!-----Enable second firewallinserviceexitinserviceExample: How to Configure IOS SLB with Server Load Balancing and Firewall Load Balancing
Figure 4 shows a sample IOS SLB load-balancing network with server load balancing and firewall load balancing running together, and the following components:
•
•
•
•
•
•
Figure 4 IOS SLB with Server Load Balancing and Firewall Load Balancing
In the following firewall farm configuration samples:
•
•
Internal Server and Firewall Load-Balancing Device
The following example shows the configuration for ping probes ABCPROBE and XYZPROBE, firewall farm FIRE1, and server farm PUBLIC for the load-balancing device on the internal (secure) side of the firewalls:
ip slb probe ABCPROBE pingaddress 10.1.1.1ip slb probe XYZPROBE pingaddress 10.1.2.1!ip slb firewallfarm FIRE1real 10.1.4.1probe ABCPROBEinservicereal 10.1.3.1probe XYZPROBEinserviceinservice!ip slb serverfarm PUBLICnat serverreal 10.2.1.1inservicereal 10.2.1.2inservice!ip slb vserver HTTP1virtual 128.1.0.1 tcp wwwserverfarm PUBLICidle 120delay 5inservice
Note
External Firewall Load-Balancing Device
The following example shows the configuration for ping probes ABCPROBE and XYZPROBE and firewall farm FIRE1 for the load-balancing device on the external (Internet) side of the firewalls:
ip slb probe ABCPROBE pingaddress 10.1.4.2ip slb probe XYZPROBE pingaddress 10.1.3.2ip slb firewallfarm FIRE1real 10.1.1.2probe ABCPROBEinserviceprobe XYZPROBEinserviceExample: How to Configure IOS SLB with Multiple Firewall Farms
Figure 5 shows a sample IOS SLB load-balancing network with multiple firewall farms and the following components:
•
•
•
•
•
Figure 5 IOS SLB with Multiple Firewall Farms
In the following firewall farm configuration samples:
•
•
Internal Firewall Load-Balancing Device
The following example shows the configuration for ping probes ABCPROBE and XYZPROBE and firewall farms ABCFARM and XYZFARM for the load-balancing device on the internal (secure) side of the firewalls:
ip slb probe ABCPROBE pingaddress 10.1.2.1ip slb probe XYZPROBE pingaddress 10.1.1.1ip slb firewallfarm ABCFARMaccess source 10.1.6.0 255.255.255.0inservicereal 10.1.4.2probe ABCPROBEinservicereal 10.1.4.3probe ABCPROBEinserviceip slb firewallfarm XYZFARMaccess source 10.1.5.0 255.255.255.0inservicereal 10.1.3.2probe XYZPROBEinservicereal 10.1.3.3probe XYZPROBEinserviceExternal Firewall Load-Balancing Device
The following example shows the configuration for ping probes ABCPROBE and XYZPROBE and firewall farms ABCFARM and XYZFARM for the load-balancing device on the external (Internet) side of the firewalls:
ip slb probe ABCPROBE pingaddress 10.1.4.1ip slb probe XYZPROBE pingaddress 10.1.3.1ip slb firewallfarm ABCFARMaccess destination 10.1.6.0 255.255.255.0inservicereal 10.1.2.2probe ABCPROBEinservicereal 10.1.2.3probe ABCPROBEinserviceip slb firewallfarm XYZFARMaccess destination 10.1.5.0 255.255.255.0inservicereal 10.1.1.2probe XYZPROBEinservicereal 10.1.1.3probe XYZPROBEinserviceExample: How to Configure IOS SLB with Dual Firewall Load Balancing "Sandwich"
Figure 6 illustrates a basic dual firewall load balancing "sandwich" configuration hosted on one IOS SLB device, including Virtual Private Network (VPN) routing and forwarding (VRF) and access interface configuration. VL105, VL106, VL107, and VL108 are VLANs.
Note
Figure 6 IOS SLB with Dual Firewall Load Balancing "Sandwich"
Following are the IOS SLB configuration statements for the configuration shown in Figure 6:
ip vrf clientrd 0:1!ip slb probe P642 pingaddress 10.10.106.42interval 120ip slb probe P643 pingaddress 10.10.106.43interval 120ip slb probe P742 pingaddress 10.10.107.42interval 120ip slb probe P743 pingaddress 10.10.107.43interval 120!ip slb firewallfarm CLIENTaccess inbound Vlan105access outbound Vlan106no inservice!real 10.10.106.42probe P642inservicereal 10.10.106.43probe P643inserviceprotocol tcpsticky 180 sourceprotocol datagramsticky 180 sourcepredictor hash address port!ip slb firewallfarm SERVERaccess inbound Vlan108access outbound Vlan107inservice!real 10.10.107.42probe P742inservicereal 10.10.107.43probe P743inserviceprotocol tcpsticky 180 destinationprotocol datagramsticky 180 destinationpredictor hash address port!mls flow ip interface-full!!*************************************************!* Switchports, port channels and trunks *!* added to vlans 105-108 (left out for brevity) *!*************************************************!interface Vlan105ip vrf forwarding clientip address 10.10.105.2 255.255.255.0!interface Vlan106ip vrf forwarding clientip address 10.10.106.2 255.255.255.0!interface Vlan107ip address 10.10.107.2 255.255.255.0!interface Vlan108ip address 10.10.108.2 255.255.255.0!ip route 10.10.105.0 255.255.255.0 10.10.107.42ip route vrf client 10.10.108.0 255.255.255.0 10.10.106.42Examples: How to Configure IOS SLB with Probes
This section contains the following examples, illustrating several different IOS SLB probe configurations:
•
•
Example: How to Configure IOS SLB with Ping and HTTP Probes
Figure 7 shows a sample configuration with IOS SLB real server connections configured as part of a server farm, focusing on using ping and HTTP probes to monitor applications that are server load-balanced.
Figure 7 Sample Ping and HTTP Probe Topology
:
The topology shown in Figure 7 is a heterogeneous server farm servicing one virtual server. Following are the configuration statements for this topology, including a ping probe named PROBE1 and an HTTP probe named PROBE2:
! Configure ping probe PROBE1, change CLI to IOS SLB probe configuration modeip slb probe PROBE1 ping! Configure probe to receive responses from IP address 13.13.13.13address 13.13.13.13! Configure unacknowledged ping threshold to 16faildetect 16! Configure ping probe timer interval to send every 11 secondsinterval 11! Configure HTTP probe PROBE2ip slb probe PROBE2 http! Configure request method as POST, set URL as /probe.cgi?allrequest method post url /probe.cgi?all! Configure header HeaderNameheader HeaderName HeaderValue! Configure basic authentication username and passwordcredentials Semisweet chips! Exit to global configuration modeexit! Enter server farm configuration mode for server farm PUBLICip slb serverfarm PUBLIC! Configure NAT server and real servers on the server farmnat serverreal 10.1.1.1inservicereal 10.1.1.2inservicereal 10.1.1.3inservicereal 10.1.1.4inservicereal 10.1.1.5inservice! Configure ping probe on the server farmprobe PROBE1! Configure HTTP probe on the server farmprobe PROBE2endExample: How to Configure IOS SLB with Routed Probe
Figure 8 shows a typical datacenter and IOS SLB configuration. Virtual server ACME_VSERVER is configured with two real servers (10.10.10.1 and 10.10.10.2) in server farm ACME_FARM. The user wants the real servers to fail based on the health of the backend server (10.10.10.3). To accomplish this configuration without sending health checks through the real servers, the user defines BACKEND, a routed ping probe to the backend server's IP address.
Figure 8 IOS SLB with a Routed Ping Probe
Following are the IOS SLB configuration statements for the configuration shown in Figure 8:
ip slb probe BACKEND pingaddress 10.10.10.3 routedip slb serverfarm ACME_SFARMnat serverprobe BACKENDreal 10.10.10.1inservicereal 10.10.10.2inserviceip slb vserver ACME_VSERVERvirtual 10.10.10.10 tcp 80serverfarm ACME_SFARMinserviceExample: How to Configure a Layer 3 Switch with IOS SLB
Figure 9 shows a sample configuration with IOS SLB server connections configured as part of a server farm.
Figure 9 Network Configuration for IOS SLB
As shown in the following sample configuration, the example topology has three public web servers and two restricted web servers for privileged clients in subnet 10.4.4.0. The public web servers are weighted according to their capacity, with server 10.1.1.2 having the lowest capacity and having a connection limit imposed on it. The restricted web servers are configured as members of the same sticky group, so that HTTP connections and Secure Socket Layer (SSL) connections from the same client use the same real server.
The network configuration to provide the previously described IOS SLB functionality follows:
ip slb probe PROBE2 httprequest method POST url /probe.cgi?allheader HeaderName HeaderValueheader Authorization Basic U2VtaXN3ZWV0OmNoaXBz!ip slb serverfarm PUBLICnat serverpredictor leastconns! First real serverreal 10.1.1.1reassign 4faildetect numconns 16retry 120inservice! Second real serverreal 10.1.1.2reassign 4faildetect numconns 16retry 120inservice! Third real serverreal 10.1.1.3reassign 4faildetect numconns 16retry 120inservice! Probeprobe PROBE2! Restricted web server farmip slb serverfarm RESTRICTEDpredictor leastconns! First real serverreal 10.1.1.20reassign 2faildetect numconns 4retry 20inservice! Second real serverreal 10.1.1.21reassign 2faildetect numconns 4retry 20inservice!! Unrestricted web virtual serverip slb vserver PUBLIC_HTTPvirtual 10.0.0.1 tcp wwwserverfarm PUBLICidle 120delay 5inservice!! Restricted HTTP virtual serverip slb vserver RESTRICTED_HTTPvirtual 10.0.0.1 tcp wwwserverfarm RESTRICTEDclient 10.4.4.0 255.255.255.0sticky 60 group 1idle 120delay 5inservice!! Restricted SSL virtual serverip slb vserver RESTRICTED_SSLvirtual 10.0.0.1 tcp httpsserverfarm RESTRICTEDclient 10.4.4.0 255.255.255.0sticky 60 group 1idle 120delay 5inservice!interface GigabitEthernet1/1switchportswitchport access vlan 3switchport mode accessno ip address!interface FastEthernet2/1switchportswitchport access vlan 2switchport mode accessno ip address!interface FastEthernet2/2switchportswitchport access vlan 2switchport mode accessno ip address!interface FastEthernet2/3switchportswitchport access vlan 2switchport mode accessno ip address!interface Vlan2ip address 10.1.1.100 255.255.255.0!interface Vlan3ip address 40.40.40.1 255.255.255.0Examples: How to Configure IOS SLB with NAT and Static NAT
This section contains the following examples, illustrating several different IOS SLB NAT configurations:
•
•
•
•
Example: How to Configure IOS SLB with NAT
Figure 10 shows a sample configuration with IOS SLB real server connections configured as part of a server farm, focusing on the configuration of the NAT server and address pool of clients.
Figure 10 Sample IOS SLB NAT Topology
The topology in Figure 10 has four web servers, configured as follows:
•
•
Server 1 and Server 2 are load-balanced using Switch A, which is performing server address translation.
Server 3 and Server 4 are load-balanced using Switch B and Switch C. These two switches are performing both server and client address translation since there are multiple paths between the clients and the servers. These switches also must perform server port translation for HTTP packets to and from Server 4.
Switch A Configuration Statements
ip slb serverfarm FARM1! Translate server addressesnat server! Server 1 port 80real 10.1.1.1reassign 2faildetect numconns 4 numclients 2retry 20inservice! Server 2 port 80real 10.2.1.1reassign 2faildetect numconns 4retry 20inservice!ip slb vserver HTTP1! Manage HTTP (port 80) requestsvirtual 128.1.0.1 tcp wwwserverfarm FARM1idle 120delay 5inserviceSwitch B Configuration Statements
ip slb natpool web-clients 128.3.0.1 128.3.0.254! NAT address pool for clientsip slb serverfarm FARM2! Translate server addressesnat server! Translate client addressesnat client web-clients! Server 3 port 80real 10.3.1.1reassign 2faildetect numconns 4retry 20inservice! Server 4 port 8080real 10.4.1.1 port 8080reassign 2faildetect numconns 4retry 20inservice! Server 4 port 8081real 10.4.1.1 port 8081reassign 2faildetect numconns 4retry 20inservice! Server 4 port 8082real 10.4.1.1 port 8082reassign 2faildetect numconns 4retry 20inservice!ip slb vserver HTTP2! Manage HTTP (port 80) requestsvirtual 128.2.0.1 tcp wwwserverfarm FARM2idle 120delay 5inserviceSwitch C Configuration Statements
ip slb natpool web-clients 128.5.0.1 128.5.0.254! NAT address pool for clientsip slb serverfarm FARM2! Translate server addressesnat server! Translate client addressesnat client web-clients! Server 3 port 80real 10.3.1.1reassign 2faildetect numconns 4retry 20inservice! Server 4 port 8080real 10.4.1.1 port 8080reassign 2faildetect numconns 4retry 20inservice! Server 4 port 8081real 10.4.1.1 port 8081reassign 2faildetect numconns 4retry 20inservice! Server 4 port 8082real 10.4.1.1 port 8082reassign 2faildetect numconns 4retry 20inservice!ip slb vserver HTTP2! Manage HTTP (port 80) requestsvirtual 128.4.0.1 tcp wwwserverfarm FARM2idle 120delay 5inserviceExample: How to Configure IOS SLB with Static NAT
The following example shows configuration statements for the following items:
•
•
•
•
ip slb probe PROBE4 dnslookup 13.13.13.13!ip slb serverfarm DNSnat serverprobe PROBE4real 10.1.1.3inservice!ip slb vserver DNSvirtual 10.11.11.11 UDP 0 service per-packetserverfarm DNS!ip slb static nat 10.11.11.11 per-packetreal 10.1.1.3Examples: How to Configure IOS SLB with Redundancy
This section contains the following examples, illustrating several different IOS SLB configurations with redundancy:
•
•
•
•
Examples: How to Configure IOS SLB with Stateless Backup
There are several different ways in which you can configure IOS SLB stateless backup. The differences between the configurations depend on the networking capabilities of your load balancing devices, and on the capabilities of the distribution devices that direct client traffic to those load balancing devices.
•
•
•
•
•
This section contains the following examples, illustrating several different IOS SLB stateless backup configurations:
•
•
•
•
Note
Example: How to Configure Dynamic Routing and Trunking
Figure 11 shows a sample IOS SLB stateless backup configuration with the following characteristics:
•
•
•
•
•
•
Figure 11 Stateless Backup with Layer 3 and Trunking
SLB 1 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4 numclients 2retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface Ethernet1switchportswitchport vlan 1interface Ethernet2ip address 10.10.2.1 255.255.255.0interface vlan 1ip address 10.10.1.1 255.255.255.0standby ip 10.10.1.100standby priority 10 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3router eigrp 666redistribute staticnetwork 10.0.0.0SLB 2 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface GigabitEthernet1no ip addressswitchportswitchport trunk encapsulation islinterface Ethernet1switchportswitchport vlan 1interface Ethernet2ip address 10.10.3.1 255.255.255.0interface vlan 1ip address 10.10.1.2 255.255.255.0standby ip 10.10.1.100standby priority 5 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3router eigrp 666redistribute staticnetwork 10.0.0.0Example: How to Configure Dynamic Routing and No Trunking
Figure 12 shows a sample IOS SLB stateless backup configuration with the following characteristics:
•
•
•
•
•
Figure 12 Stateless Backup with Layer 3 and No Trunking
SLB 1 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface Ethernet1ip address 10.10.1.1 255.255.255.0standby ip 10.10.1.100standby priority 10 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3interface Ethernet2ip address 10.10.2.1 255.255.255.0router eigrp 666redistribute staticnetwork 10.0.0.0SLB 2 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface Ethernet1ip address 10.10.1.2 255.255.255.0standby ip 10.10.1.100standby priority 5 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3interface Ethernet2ip address 10.10.3.1 255.255.255.0router eigrp 666redistribute staticnetwork 10.0.0.0Example: How to Configure Static Routing and Trunking
Figure 13 shows a sample IOS SLB stateless backup configuration with the following characteristics:
•
•
•
•
•
•
Figure 13 Stateless Backup with Layer 2 and Trunking
SLB 1 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface Ethernet1switchportswitchport vlan 1interface Ethernet2ip address 10.10.2.1 255.255.255.0standby ip 10.10.2.100standby priority 10 preempt delay sync 20standby track vlan1standby timers 1 3interface vlan 1ip address 10.10.1.1 255.255.255.0standby ip 10.10.1.100standby priority 10 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3SLB 2 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface GigabitEthernet1no ip addressswitchportswitchport trunk encapsulation islinterface Ethernet1switchportswitchport vlan 1interface Ethernet2ip address 10.10.2.2 255.255.255.0standby ip 10.10.2.100standby priority 5 preempt delay sync 20standby track vlan 1standby timers 1 3interface vlan 1ip address 10.10.1.2 255.255.255.0standby ip 10.10.1.100standby priority 5 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3Distribution Device Configuration Statements
interface Ethernet1switchportswitchport distribution vlan 2interface Ethernet2switchportswitchport distribution vlan 2interface vlan2ip address 10.10.2.3 255.255.255.0no shutip route 10.10.14.1 255.255.255.255 10.10.2.100Example: How to Configure Static Routing and No Trunking
Figure 14 shows a sample IOS SLB stateless backup configuration with the following characteristics:
•
•
•
•
•
Figure 14 Stateless Backup with Layer 2 and No Trunking
SLB 1 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface Ethernet1ip address 10.10.1.1 255.255.255.0standby ip 10.10.1.100standby priority 10 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3interface Ethernet2ip address 10.10.2.1 255.255.255.0standby ip 10.10.2.100standby priority 10 preempt delay sync 20standby track Ethernet1standby timers 1 3SLB 2 Configuration Statements
ip slb serverfarm SF1real 10.10.1.3reassign 2faildetect numconns 4retry 20inservicereal 10.10.1.4reassign 2faildetect numconns 4retry 20inserviceip slb vserver VS1virtual 10.10.14.1 tcp wwwserverfarm SF1idle 120delay 5inservice standby SERVER!interface Ethernet1ip address 10.10.1.2 255.255.255.0standby ip 10.10.1.100standby priority 5 preempt delay sync 20standby name SERVERstandby track Ethernet2standby timers 1 3!interface Ethernet2ip address 10.10.2.2 255.255.255.0standby ip 10.10.2.100standby priority 5 preempt delay sync 20standby track Ethernet1standby timers 1 3Distribution Device Configuration Statements
interface Ethernet1switchportswitchport distribution vlan 2interface Ethernet2switchportswitchport distribution vlan 2interface vlan2ip address 10.10.2.3 255.255.255.0no shutip route 10.10.14.1 255.255.255.255 10.10.2.100Example: How to Configure IOS SLB with Stateful Backup
This sample configuration focuses on the IOS SLB real server connections configured as part of a server farm, with real and virtual servers over Fast Ethernet interfaces configured with stateful backup standby connections.
Figure 15 is an example of a stateful backup configuration, using HSRP on both the client and server sides to manage failover. The real servers route outbound flows to 10.10.3.100, which is the HSRP address on the server side interfaces. The client (or access router), routes to the virtual IP address (10.10.10.12) through 10.10.2.100, HSRP address on the client side.
Notice the loopback interfaces configured on both devices for the exchange of these messages. Each IOS SLB should also be given duplicate routes to the other switch loopback address. This configuration allows replication messages to flow despite an interface failure.
Note
Figure 15 IOS SLB Stateful Environment
Switch SLB1 Configuration Statements
ip slb serverfarm SF1nat serverreal 10.10.3.1inservicereal 10.10.3.2inservicereal 10.10.3.3inservice!ip slb vserver VS1virtual 10.10.10.12 tcp telnetserverfarm SF1replicate casa 10.10.99.132 10.10.99.99 1024 password PASSinservice standby virt!interface loopback 1ip address 10.10.99.132 255.255.255.255!interface FastEthernet1ip address 10.10.3.132 255.255.255.0no ip redirectsno ip mroute-cachestandby priority 5 preemptstandby name outstandby ip 10.10.3.100standby track FastEthernet2standby timers 1 3interface FastEthernet2ip address 10.10.2.132 255.255.255.0no ip redirectsstandby priority 5standby name virtstandby ip 10.10.2.100standby timers 1 3Switch SLB2 Configuration Statements
ip slb serverfarm SF1nat serverreal 10.10.3.1inservicereal 10.10.3.2inservicereal 10.10.3.3inservice!ip slb vserver VS1virtual 10.10.10.12 tcp telnetserverfarm SF1replicate casa 10.10.99.99 10.10.99.132 1024 password PASSinservice standby virt!interface loopback 1ip address 10.10.99.99 255.255.255.255!interface FastEthernet2ip address 10.10.2.99 255.255.255.0no ip redirectsno ip route-cacheno ip mroute-cachestandby priority 10 preempt delay sync 20standby name virtstandby ip 10.10.2.100standby track FastEthernet3standby timers 1 3!interface FastEthernet3ip address 10.10.3.99 255.255.255.0no ip redirectsno ip route-cacheno ip mroute-cachestandby priority 10 preempt delay 20standby name outstandby ip 10.10.3.100standby track FastEthernet2standby timers 1 3Example: How to Configure IOS SLB with Stateful Backup of Redundant Route Processors
In Figure 16, the IOS SLB device includes two Supervisor engines configured for stateful backup. If the active Supervisor engine fails, the backup Supervisor engine takes over through RPR+ with IOS SLB synchronization information already populated. IOS SLB replicates state information for virtual server ACME_VSERVER (10.10.10.10) from the active Supervisor engine to the backup every 20 seconds. The real servers (10.10.10.1, 10.10.10.2, and 10.10.10.3) are configured in server farm ACME_SFARM.
Figure 16 IOS SLB with Redundant Route Processors
Following are the IOS SLB configuration statements for the configuration shown in Figure 16:
ip slb replicate slave rate 300ip slb serverfarm ACME_SFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inservicereal 10.10.10.3inserviceip slb vserver ACME_VSERVERvirtual 10.10.10.10 tcp 80replicate interval 20replicate slaveserverfarm ACME_SFARMinserviceExample: How to Configure IOS SLB with Active Standby
Figure 17 shows an IOS SLB network configured for active standby, with two IOS SLB devices load-balancing the same virtual IP address while backing up each other. If either device fails, the other takes over its load through normal HSRP failover and IOS SLB stateless redundancy.
Figure 17 IOS SLB Active Standby
The sample network configuration in Figure 17 has the following characteristics:
•
•
•
•
•
•
SLB 1 Configuration Statements
ip slb serverfarm EVENnat serverreal 10.10.3.2reassign 2faildetect numconns 4 numclients 2retry 20inservicereal 10.10.3.3reassign 2faildetect numconns 4retry 20inservice!ip slb serverfarm ODDnat serverreal 10.10.3.2reassign 2faildetect numconns 4retry 20inservicereal 10.10.3.3reassign 2faildetect numconns 4retry 20inservice!-----Same EVEN virtual server as in SLB 2ip slb vserver EVENvirtual 10.10.10.12 tcp wwwserverfarm EVENclient 0.0.0.0 0.0.0.1idle 120delay 5!-----See standby name in Ethernet 3/3 belowinservice standby STANDBY_EVEN!-----Same ODD virtual server as in SLB 2ip slb vserver ODDvirtual 10.10.10.12 tcp wwwserverfarm ODDclient 0.0.0.1 0.0.0.1idle 120delay 5!-----See standby name in Ethernet 3/2 belowinservice standby STANDBY_ODD!interface Ethernet3/2ip address 10.10.5.132 255.255.255.0standby priority 20 preempt delay sync 20!-----See standby name in SLB 2, Ethernet 3/5standby name STANDBY_ODDstandby ip 10.10.5.100standby track Ethernet3/3standby timers 1 3!interface Ethernet3/3ip address 10.10.2.132 255.255.255.0standby priority 10!-----See standby name in SLB 2, Ethernet 3/1standby name STANDBY_EVENstandby ip 10.10.2.100standby track Ethernet3/2standby timers 1 3SLB 2 Configuration Statements
ip slb serverfarm EVENnat serverreal 10.10.3.4reassign 2faildetect numconns 4retry 20inservicereal 10.10.3.5reassign 2faildetect numconns 4retry 20inservice!ip slb serverfarm ODDnat serverreal 10.10.3.4reassign 2faildetect numconns 4retry 20inservicereal 10.10.3.5reassign 2faildetect numconns 4retry 20inservice!-----Same EVEN virtual server as in SLB 1ip slb vserver EVENvirtual 10.10.10.12 tcp wwwserverfarm EVENclient 0.0.0.0 0.0.0.1idle 120delay 5!-----See standby name in Ethernet 3/1 belowinservice standby STANDBY_EVEN!-----Same ODD virtual server as in SLB 1ip slb vserver ODDvirtual 10.10.10.12 tcp wwwserverfarm ODDclient 0.0.0.1 0.0.0.1idle 120delay 5!-----See standby name in Ethernet 3/5 belowinservice standby STANDBY_ODD!interface Ethernet3/1ip address 10.10.2.128 255.255.255.0standby priority 20 preempt delay sync 20!-----See standby name in SLB 1, Ethernet 3/3standby name STANDBY_EVENstandby ip 10.10.2.100standby track Ethernet3/5standby timers 1 3!interface Ethernet3/5ip address 10.10.5.128 255.255.255.0standby priority 10 preempt delay sync 20!-----See standby name in SLB 1, Ethernet 3/2standby name STANDBY_ODDstandby ip 10.10.5.100standby track Ethernet3/1standby timers 1 3Access Router Configuration Statements
interface Ethernet0/0ip address 10.10.5.183 255.255.255.0no ip directed-broadcastno ip route-cacheno ip mroute-cache!interface Ethernet0/1ip address 10.10.2.183 255.255.255.0no ip directed-broadcastno ip route-cacheno ip mroute-cache!interface Ethernet0/2ip address 10.10.6.183 255.255.255.0no ip directed-broadcastno ip route-cacheno ip mroute-cacheip policy route-map virts!access-list 100 permit ip 0.0.0.1 255.255.255.254 host 10.10.10.12access-list 101 permit ip 0.0.0.0 255.255.255.254 host 10.10.10.12route-map virts permit 10match ip address 100set ip next-hop 10.10.5.100!route-map virts permit 15match ip address 101set ip next-hop 10.10.2.100Example: How to Configure IOS SLB with Redistribution of Static Routes
Figure 18 shows an IOS SLB network configured to distribute static routes to a virtual server's IP address. The route to the address is added to the routing table as static if you advertise the address when you bring the virtual server into service (using the inservice command). See the description of the advertise command in the Cisco IOS IP Application Services Command Reference for more details about advertising virtual server IP addresses.
Because the routing configuration varies from protocol to protocol, sample configurations for several different routing protocols are given.
Figure 18 IOS SLB Redistribution of Static Routes
Routing Information Protocol (RIP)
Following is the RIP static route redistribution configuration for the IOS SLB switch shown in Figure 18:
router ripredistribute staticnetwork 10.0.0.0network 8.0.0.0Following is the RIP static route redistribution configuration for the access router that is listening for routing updates shown in Figure 18:
router ripnetwork 10.0.0.0network 8.0.0.0Open Shortest Path First (OSPF)
Following is the OSPF static route redistribution configuration for the IOS SLB switch shown in Figure 18:
router ospf 1redistribute static subnetsnetwork 10.10.6.217 0.0.0.0 area 0network 8.8.8.0 0.0.0.255 area 0Following is the OSPF static route redistribution configuration for the access router that is listening for routing updates shown in Figure 18:
router ospf 1network 10.10.6.2 0.0.0.0 area 0network 8.8.8.0 0.0.0.255 area 0Interior Gateway Routing Protocol (IGRP)
Following is the IGRP static route redistribution configuration for the IOS SLB switch shown in Figure 18:
router igrp 1redistribute connectedredistribute staticnetwork 8.0.0.0network 10.0.0.0Following is the IGRP static route redistribution configuration for the access router that is listening for routing updates shown in Figure 18:
router igrp 1network 8.0.0.0network 10.0.0.0Enhanced Interior Gateway Routing Protocol (Enhanced IGRP)
Following is the Enhanced IGRP static route redistribution configuration for the IOS SLB switch shown in Figure 18:
router eigrp 666redistribute staticnetwork 10.0.0.0network 8.0.0.0Following is the Enhanced IGRP static route redistribution configuration for the access router that is listening for routing updates shown in Figure 18:
router eigrp 666network 10.0.0.0network 8.0.0.0Example: How to Configure IOS SLB with WAP and UDP Load Balancing
Figure 19 shows an IOS SLB network configured to balance WAP flows. In this example:
•
•
•
Figure 19 IOS SLB with WAP Load Balancing
There are two ways to configure IOS SLB load balancing for WAP:
•
•
Example: How to Balance WAP Flows on UDP Port 9201
The following example shows the configuration for the IOS SLB device shown in Figure 19, which balances WAP flows on UDP port 9201 (WSP/WTP/UDP):
ip slb probe PROBE3 wspurl http://localhost/test.txt!ip slb serverfarm WAPFARMnat serverreal 10.10.2.1inservicereal 10.10.2.2inservicereal 10.10.2.3inserviceprobe PROBE3!ip slb vserver VSERVERvirtual 10.10.1.1 udp 9201serverfarm WAPFARMidle 3000inserviceExample: How to Balance WAP Flows on UDP Port 9203
The following example shows the configuration for the IOS SLB device shown in Figure 19, which balances WAP flows on UDP port 9203 (WSP/WTP/WTLS/UDP):
ip slb probe PROBE1 ping!ip slb serverfarm WAPFARMnat serverreal 10.10.2.1inservicereal 10.10.2.2inservicereal 10.10.2.3inserviceprobe PROBE1!ip slb vserver VSERVERvirtual 10.10.1.1 udp 9203serverfarm WAPFARMidle 3000inserviceExamples: How to Configure IOS SLB with Route Health Injection
This section contains the following examples, illustrating several different IOS SLB route health injection configurations:
•
•
•
Example: How to Configure Two Distributed Sites with One Web Server Each
Figure 20 shows an IOS SLB network configured with route health injection with the following characteristics:
•
•
•
Figure 20 Two Distributed Sites with One Web Server Each
When both web servers in Figure 20 are operational, the client router receives the host route from both IOS SLB devices.
If Web Server A fails, the virtual server for the virtual IP address on SLB A enters FAILED state and stops advertising the host route for the virtual IP address. The client router then begins using the route to SLB B.
When Web Server A is again available, the virtual server again advertises the host route for the virtual IP address, and the client router begins using SLB A.
Example: How to Configure Two Distributed Sites with Two Web Servers Each
Figure 21 shows an IOS SLB network configured with route health injection with the following characteristics:
•
•
•
Figure 21 Two Distributed Sites with Two Web Servers Each
When all web servers in Figure 21 are operational, the client router receives the host route from both IOS SLB devices.
If one web server in either server farm fails, the route continues to be advertised by the given IOS SLB device.
If both Web Server A1 and Web Server A2 fail, the virtual server for the virtual IP address on SLB A enters FAILED state and stops advertising the host route for the virtual IP address. The client router then begins using the route to SLB B.
When either Web Server A1 or Web Server A2 is again available, the virtual server again advertises the host route for the virtual IP address, and the client router begins using SLB A.
Example: How to Configure Two Distributed Sites with One Web Server and a Backup IOS SLB Switch Each
Figure 22 shows an IOS SLB network configured with route health injection with the following characteristics:
•
•
•
•
Figure 22 Two Distributed Sites with One Web Server and a Backup IOS SLB Switch Each
When both web servers in Figure 22 are operational, the client router receives the host route from both SLB A Primary and SLB B Primary.
If SLB A Primary fails, SLB A Backup begins advertising the host route to the virtual IP address. If SLB A Backup also fails, the virtual server for the virtual IP address on SLB A Primary and SLB A Backup enters FAILED state and stops advertising the host route for the virtual IP address. The client router then begins using the route to SLB B Primary (or to SLB B Backup, if SLB B Primary is not available).
When either SLB A Primary or SLB A Backup is again available, the virtual server again advertises the host route for the virtual IP address, and the client router begins using SLB A Primary or SLB A Backup.
Examples: How to Configure IOS SLB with GPRS Load Balancing
This section contains the following examples, illustrating several different IOS SLB configurations with redundancy:
•
•
•
•
•
•
Example: How to Configure IOS SLB with GPRS Load Balancing Without GTP Cause Code Inspection
Figure 23 shows a typical GPRS load-balancing configuration without GTP cause code inspection enabled. In this configuration:
•
•
•
•
•
Figure 23 IOS SLB with GPRS Load Balancing
Following are the configuration statements for the configuration shown in Figure 23:
•
•
•
•
For more detailed GGSN configuration examples, refer to the Cisco IOS Mobile Wireless Configuration Guide.
IOS SLB Configuration Statements
hostname GTP_SLB!ip domain-name gprs.com!ip slb serverfarm GPRSreal 192.168.1.1weight 1faildetect numconns 1 numclients 1inservice!real 192.168.2.2weight 1faildetect numconns 1 numclients 1inservice!real 192.168.3.3weight 1faildetect numconns 1 numclients 1inservice!ip slb vserver FOR_GPRSvirtual 10.10.10.10 udp 3386 service gtpserverfarm GPRSinservice!ip slb dfp password Password1 0agent 10.1.1.201 1111 30 0 10agent 10.1.1.202 1111 30 0 10agent 10.1.1.203 1111 30 0 10!interface FastEthernet1/0description TO SERVERFARM GPRSip address 10.1.1.100 255.255.255.0no ip redirectsduplex half!interface FastEthernet3/0description TO SGSNip address 10.2.1.100 255.255.255.0no ip mroute-cacheduplex half!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0ip route 192.168.1.1 255.255.255.255 10.1.1.201ip route 192.168.2.2 255.255.255.255 10.1.1.202ip route 192.168.3.3 255.255.255.255 10.1.1.203GGSN1 Configuration Statements
service gprs ggsn!hostname GGSN1!ip dfp agent gprsport 1111password Password1 0inservice!ip domain-name gprs.com!interface loopback 1description LOOPBACK SAME AS IOS SLB VSERVER ADDRESSip address 10.10.10.10 255.255.255.255no ip route-cacheno ip mroute-cache!interface FastEthernet1/0description TO SLBip address 10.1.1.201 255.255.255.0ip directed-broadcastno ip mroute-cacheduplex half!interface Virtual-Template1description GTP VIRTUAL TEMPLATEip address 192.168.1.1 255.255.255.0encapsulation gtpgprs access-point-list gprs1!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0!gprs access-point-list gprs1access-point 1access-point-name gprs.company.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6dhcp-gateway-address 10.27.3.1exit!gprs maximum-pdp-context-allowed 45000gprs qos map canonical-qosgprs gtp path-echo-interval 0gprs dfp max-weight 32gprs slb cef 10.10.10.10GGSN2 Configuration Statements
service gprs ggsn!hostname GGSN2!ip dfp agent gprsport 1111password Password1 0inservice!ip domain-name gprs.com!interface loopback 1description LOOPBACK SAME AS IOS SLB VSERVER ADDRESSip address 10.10.10.10 255.255.255.255no ip route-cacheno ip mroute-cache!interface FastEthernet1/0description TO SLBip address 10.1.1.202 255.255.255.0ip directed-broadcastno ip mroute-cacheduplex half!interface Virtual-Template1description GTP VIRTUAL TEMPLATEip address 192.168.2.2 255.255.255.0encapsulation gtpgprs access-point-list gprs1!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0!gprs access-point-list gprs1access-point 1access-point-name gprs.company.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6dhcp-gateway-address 10.27.3.1exit!gprs maximum-pdp-context-allowed 45000gprs qos map canonical-qosgprs gtp path-echo-interval 0gprs dfp max-weight 32gprs slb cef 10.10.10.10GGSN3 Configuration Statements
service gprs ggsn!hostname GGSN3!ip dfp agent gprsport 1111password Password1 0inservice!ip domain-name gprs.com!interface loopback 1description LOOPBACK SAME AS IOS SLB VSERVER ADDRESSip address 10.10.10.10 255.255.255.255no ip route-cacheno ip mroute-cache!interface FastEthernet1/0description TO SLBip address 10.1.1.203 255.255.255.0ip directed-broadcastno ip mroute-cacheduplex half!interface Virtual-Template1description GTP VIRTUAL TEMPLATEip address 192.168.3.3 255.255.255.0encapsulation gtpgprs access-point-list gprs1!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0!gprs access-point-list gprs1access-point 1access-point-name gprs.company.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6dhcp-gateway-address 10.27.3.1exit!gprs maximum-pdp-context-allowed 45000gprs qos map canonical-qosgprs gtp path-echo-interval 0gprs dfp max-weight 32gprs slb cef 10.10.10.10Example: How to Configure IOS SLB with GPRS Load Balancing and NAT
The following example uses the same basic configuration as in the "Example: How to Configure IOS SLB with GPRS Load Balancing Without GTP Cause Code Inspection" section, including the network shown in Figure 23, but with the addition of NAT:
•
•
•
•
For more detailed GGSN configuration examples, refer to the Cisco IOS Mobile Wireless Configuration Guide.
IOS SLB Configuration Statements
hostname GTP_SLB!ip domain-name gprs.com!ip slb serverfarm GPRSnat serverreal 192.168.1.1weight 1faildetect numconns 1 numclients 1inservice!real 192.168.2.2weight 1faildetect numconns 1 numclients 1inservice!real 192.168.3.3weight 1faildetect numconns 1 numclients 1inservice!ip slb vserver FOR_GPRSvirtual 10.10.10.10 udp 3386 service gtpserverfarm GPRSinservice!ip slb dfp password Password1 0agent 10.1.1.201 1111 30 0 10agent 10.1.1.202 1111 30 0 10agent 10.1.1.203 1111 30 0 10!interface FastEthernet1/0description TO SERVERFARM GPRSip address 10.1.1.100 255.255.255.0no ip redirectsduplex half!interface FastEthernet3/0description TO SGSNip address 10.2.1.100 255.255.255.0no ip mroute-cacheduplex half!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0ip route 192.168.1.1 255.255.255.255 10.1.1.201ip route 192.168.2.2 255.255.255.255 10.1.1.202ip route 192.168.3.3 255.255.255.255 10.1.1.203GGSN1 Configuration Statements
service gprs ggsn!hostname GGSN1!ip dfp agent gprsport 1111password Password1 0inservice!ip domain-name gprs.com!interface FastEthernet1/0description TO SLBip address 10.1.1.201 255.255.255.0ip directed-broadcastno ip mroute-cacheduplex half!interface Virtual-Template1description GTP VIRTUAL TEMPLATEip address 192.168.1.1 255.255.255.0encapsulation gtpgprs access-point-list gprs1!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0!gprs access-point-list gprs1access-point 1access-point-name gprs.company.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6dhcp-gateway-address 10.27.3.1exit!gprs maximum-pdp-context-allowed 45000gprs qos map canonical-qosgprs gtp path-echo-interval 0gprs dfp max-weight 32GGSN2 Configuration Statements
service gprs ggsn!hostname GGSN2!ip dfp agent gprsport 1111password Password1 0inservice!ip domain-name gprs.com!interface FastEthernet1/0description TO SLBip address 10.1.1.202 255.255.255.0ip directed-broadcastno ip mroute-cacheduplex halfinterface Virtual-Template1description GTP VIRTUAL TEMPLATEip address 192.168.2.2 255.255.255.0encapsulation gtpgprs access-point-list gprs1!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0!gprs access-point-list gprs1access-point 1access-point-name gprs.company.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6dhcp-gateway-address 10.27.3.1exit!gprs maximum-pdp-context-allowed 45000gprs qos map canonical-qosgprs gtp path-echo-interval 0gprs dfp max-weight 32GGSN3 Configuration Statements
service gprs ggsn!hostname GGSN3!ip dfp agent gprsport 1111password Password1 0inservice!ip domain-name gprs.com!interface FastEthernet1/0description TO SLBip address 10.1.1.203 255.255.255.0ip directed-broadcastno ip mroute-cacheduplex half!interface Virtual-Template1description GTP VIRTUAL TEMPLATEip address 192.168.3.3 255.255.255.0encapsulation gtpgprs access-point-list gprs1!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0!gprs access-point-list gprs1access-point 1access-point-name gprs.company.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6dhcp-gateway-address 10.27.3.1exit!gprs maximum-pdp-context-allowed 45000gprs qos map canonical-qosgprs gtp path-echo-interval 0gprs dfp max-weight 32Example: How to Configure IOS SLB with GPRS Load Balancing, NAT, and GTP Cause Code Inspection
The following example uses the same basic configuration as in the "Example: How to Configure IOS SLB with GPRS Load Balancing and NAT" section, including the network shown in Figure 23, but with the GTP cause code inspection enabled. In this configuration:
•
•
•
Following are the configuration statements for the configuration shown in Figure 23, with the addition of NAT and GTP cause code inspection support:
•
•
•
•
For more detailed GGSN configuration examples, refer to the Cisco IOS Mobile Wireless Configuration Guide.
IOS SLB Configuration Statements
hostname GTP_SLB!ip domain-name gprs.com!ip slb timers gtp gsn 20!ip slb serverfarm GPRSnat serverreal 192.168.1.1weight 1faildetect numconns 1 numclients 1inservice!real 192.168.2.2weight 1faildetect numconns 1 numclients 1inservice!real 192.168.3.3weight 1faildetect numconns 1 numclients 1inservice!ip slb vserver FOR_GPRSvirtual 10.10.10.10 udp 0 service gtp-inspectidle gtp request 15client gtp carrier-code mcc 222 mnc 22serverfarm GPRSinservice!ip slb dfp password Password1 0agent 10.1.1.201 1111 30 0 10agent 10.1.1.202 1111 30 0 10agent 10.1.1.203 1111 30 0 10!interface FastEthernet1/0description TO SERVERFARM GPRSip address 10.1.1.100 255.255.255.0no ip redirectsduplex half!interface FastEthernet3/0description TO SGSNip address 10.2.1.100 255.255.255.0no ip mroute-cacheduplex half!ip route 10.111.111.111 255.255.255.255 FastEthernet1/0ip route 192.168.1.1 255.255.255.255 10.1.1.201ip route 192.168.2.2 255.255.255.255 10.1.1.202ip route 192.168.3.3 255.255.255.255 10.1.1.203Example: How to Configure IOS SLB with GPRS Load Balancing Maps
The following sample configuration enables IOS SLB to support multiple server farms behind a GPRS load balancing virtual server, using access point names (APNs) to select server farms. Server farm farm6 is configured without an associated map, and therefore acts as a default server farm. If IOS SLB cannot match any of the other server farm maps, and a default server farm is configured, IOS SLB sends the GPRS request to the default serverfarm.
ip slb map 1 gtpapn cisco*ip slb map 4 gtpapn abc.microsoft.comapn xyz.intel.comip slb map 5 gtpapn yahoo.com!ip slb serverfarm farm1real 10.0.0.1inservicereal 10.0.0.2inserviceip slb serverfarm farm2real 10.0.0.3inservicereal 10.0.0.4inserviceip slb serverfarm farm3real 10.0.0.5inservicereal 10.0.0.6inserviceip slb serverfarm farm4real 10.0.0.7inservicereal 10.0.0.8inserviceip slb serverfarm farm5real 10.0.0.9inservicereal 10.0.0.10inserviceip slb serverfarm farm6real 10.0.0.11inservice!ip slb map 1 gtpapn cisco*ip slb map 4 gtpapn abc.microsoft.comapn xyz.intel.comip slb map 5 gtpapn yahoo.com!ip slb vserver GGSN_SERVERvirtual 10.10.10.10 udp 0 service gtpserverfarm farm1 backup farm2 map 1 priority 3serverfarm farm4 map 4 priority 1serverfarm farm5 map 5 priority 4serverfarm farm6inserviceExample: How to Configure IOS SLB with Dual-Stack Addresses for GTP Load Balancing
The following sample configuration enables IOS SLB to support dual-stack addresses for GTP load balancing.
ip slb serverfarm SF1real 172.16.88.5weight 1inservice!ip slb serverfarm SF2real 172.16.88.6weight 1inservice!ip slb serverfarm SF3real 172.16.88.7 ipv6 2342:2342:2343:FF04:2388:BB03:3329:8612weight 1inservice!ip slb serverfarm SF4real 172.16.88.8 ipv6 2342:2342:2343:FF04:2388:BB03:3423:8912weight 1inservice!ip slb vserver VS2virtual 4.3.2.1 ipv6 2342:2342:2343:FF04:2341:AA03:2323:8912 udp 0 service gtpserverfarm sf1 backup sf2 ipv6-primary sf3 ipv6-backup sf4idle gtp request 90idle gtp imsi 10000000sticky gtp imsi group 1gtp notification cac 3inserviceExample: How to Configure IOS SLB with VPN Server Load Balancing
Figure 24 shows a typical VPN server load-balancing configuration. In this configuration:
•
•
•
•
Figure 24 IOS SLB with VPN Server Load Balancing
Following are the IOS SLB configuration statements for the configuration shown in Figure 24:
ip slb serverfarm VPNnat serverreal 20.20.20.10inservicereal 20.20.20.20inservicefailaction purge!ip slb vserver ESPvirtual 10.10.1.1 ESPserverfarm VPNsticky 3600 group 69inservice!ip slb vserver UDPvirtual 10.10.1.1 UDP isakmpserverfarm VPNsticky 3600 group 69inserviceExamples: How to Configure IOS SLB with RADIUS Load Balancing
This section contains the following examples, illustrating several different IOS SLB RADIUS load-balancing configurations:
•
•
•
•
•
•
•
Example: How to Configure IOS SLB with RADIUS Load Balancing for a GPRS Network
Figure 25 shows a typical IOS SLB RADIUS load-balancing configuration for a GPRS network. In this configuration:
•
•
•
•
Figure 25 IOS SLB with RADIUS Load Balancing for a GPRS Network
Following are the IOS SLB configuration statements for the configuration shown in Figure 25:
ip slb route 1.1.0.0 255.255.0.0 framed-ip!ip slb serverfarm SSGFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inservice!ip slb vserver RADIUS_ACCTvirtual 10.10.10.10 udp 1813 service radiusserverfarm SSGFARMidle radius request 20idle radius framed-ip 7200sticky radius framed-ip group 1inservice!ip slb vserver RADIUS_AUTHvirtual 10.10.10.10 udp 1812 service radiusserverfarm SSGFARMidle radius request 20idle radius framed-ip 7200sticky radius framed-ip group 1inserviceExample: How to Configure IOS SLB with RADIUS Load Balancing for a Simple IP CDMA2000 Network
Figure 26 shows a typical IOS SLB RADIUS load-balancing configuration for a CDMA2000 network with simple IP service. In this configuration:
•
•
•
•
Figure 26 IOS SLB with RADIUS Load Balancing for a Simple IP CDMA2000 Network
Following are the IOS SLB configuration statements for the configuration shown in Figure 26:
ip slb route 1.1.0.0 255.255.0.0 framed-ip!ip slb serverfarm SSGFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inservice!ip slb vserver RADIUS_SIPvirtual 10.10.10.10 udp 0 service radiusserverfarm SSGFARMidle radius framed-ip 3600sticky radius usernamesticky radius framed-ipinserviceExample: How to Configure IOS SLB with RADIUS Load Balancing for a Mobile IP CDMA2000 Network
Figure 27 shows a typical IOS SLB RADIUS load-balancing configuration for a CDMA2000 network with Mobile IP service. In this configuration:
•
•
•
•
Figure 27 IOS SLB with RADIUS Load Balancing for a Mobile IP CDMA2000 Network
Following are the IOS SLB configuration statements for the configuration shown in Figure 27:
ip slb route 1.1.0.0 255.255.0.0 framed-ip!ip slb serverfarm SSGFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inservice!ip slb vserver RADIUS_SIPvirtual 10.10.10.10 udp 0 service radiusserverfarm SSGFARMidle radius framed-ip 3600sticky radius usernamesticky radius framed-ipinserviceExample: How to Configure IOS SLB with RADIUS Load Balancing for Multiple Service Gateway Farms
The following sample configuration enables IOS SLB to balance packet flows for a set of subscribers among multiple service gateway server farms (in this sample, a server farm of SSGs and a server farm of CSGs):
ip slb route 1.1.0.0 255.255.0.0 framed-ip!ip slb serverfarm SSGFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inservice!ip slb serverfarm CSGFARMnat serverreal 20.20.20.1inservicereal 20.20.20.2inservice!ip slb vserver SSG_AUTHvirtual 10.10.10.10 udp 1812 service radiusserverfarm SSGFARMidle radius request 20idle radius framed-ip 7200sticky radius framed-ip group 1access Vlan20 route framed-ipinservice!ip slb vserver SSG_ACCTvirtual 10.10.10.10 udp 1813 service radiusserverfarm SSGFARMidle radius request 20idle radius framed-ip 7200sticky radius framed-ip group 1access Vlan20 route framed-ipinservice!ip slb vserver CSG_ACCTvirtual 20.20.20.20 udp 1813 service radiusserverfarm CSGFARMidle radius request 25idle radius framed-ip 0sticky radius framed-ipaccess Vlan30 route framed-ipinserviceExample: How to Configure IOS SLB with RADIUS Load Balancing/Firewall Load Balancing "Sandwich"
Figure 28 shows a RADIUS load balancing/firewall load balancing "sandwich" on one IOS SLB device. In this sample configuration:
•
•
•
•
•
•
Figure 28 IOS SLB with RADIUS Load Balancing/Firewall Load Balancing "Sandwich"
Following are the IOS SLB configuration statements for the configuration shown in Figure 28:
ip vrf clientrd 0:1!ip slb probe P742 pingaddress 10.10.107.42interval 120!ip slb probe P743 pingaddress 10.10.107.43interval 120!ip slb route 1.0.0.0 255.0.0.0 framed-ipip slb route framed-ip deny!ip slb firewallfarm SERVERaccess inbound Vlan108access outbound Vlan107inservicereal 10.10.107.42probe P742inservicereal 10.10.107.43probe P743inserviceprotocol tcpsticky 180 destinationprotocol datagramsticky 180 destinationpredictor hash address port!ip slb serverfarm SF1nat serveraccess Vlan106!real 10.10.106.42inservicereal 10.10.106.43inservice!ip slb vserver VS1virtual 5.5.5.5 udp 0 service radiusserverfarm SF1sticky radius framed-ipaccess Vlan105 route framed-ipaccess Vlan105inservice!mls flow ip interface-full!!*************************************************!* Switchports, port channels and trunks *!* added to vlans 105-108 (left out for brevity) *!*************************************************!interface Vlan105ip vrf forwarding clientip address 10.10.105.2 255.255.255.0!interface Vlan106ip vrf forwarding clientip address 10.10.106.2 255.255.255.0!interface Vlan107ip address 10.10.107.2 255.255.255.0!interface Vlan108ip address 10.10.108.2 255.255.255.0!ip route 10.10.105.0 255.255.255.0 10.10.107.42ip route vrf client 10.10.108.0 255.255.255.0 10.10.106.42Example: How to Configure IOS SLB with RADIUS Load Balancing Maps
The following sample configuration enables IOS SLB to support multiple server farms behind a RADIUS load balancing virtual server, using RADIUS calling station IDs and usernames to select server farms. Server farm farm3 is configured without an associated map, and therefore acts as a default server farm. If IOS SLB cannot match any of the other server farm maps, and a default server farm is configured, IOS SLB sends the RADIUS request to the default serverfarm.
ip slb serverfarm CSGFARMpredictor route-map rlb-pbrip slb serverfarm AAAFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inserviceip slb vserver RADIUS_ACCTvirtual 10.10.10.10 udp 1813 service radiusserverfarm CSGFARMradius inject acct 1 key 0 ciscoinserviceip slb vserver RADIUS_AUTHvirtual 10.10.10.10 udp 1812 service radiusserverfarm AAAFARMradius inject auth 1 calling-station-idradius inject auth timer 45radius inject auth vsa ciscoinservice!interface vlan 100ip policy route-map rlb-pbr!access-list 1 permit 0.0.0.1 255.255.255.254access-list 2 permit 0.0.0.0 255.255.255.254!route-map rlb-pbr permit 10match ip address 1set ip next-hop 10.10.10.1!route-map rlb-pbr permit 20match ip address 2set ip next-hop 10.10.10.2Example: How to Configure IOS SLB with RADIUS Load Balancing Accelerated Data Plane Forwarding
The following IOS SLB configuration has the following characteristics:
•
•
•
•
•
–
–
Figure 29 IOS SLB with RADIUS Load Balancing Accelerated Data Plane Forwarding
Following are the IOS SLB configuration statements for the configuration shown in Figure 29:
ip slb serverfarm CSGFARMpredictor route-map rlb-pbrip slb serverfarm AAAFARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inservice!ip slb vserver RADIUS_ACCTvirtual 10.10.10.10 udp 1813 service radiusserverfarm CSGFARMradius inject acct 1 key 0 ciscoinservice!ip slb vserver RADIUS_AUTHvirtual 10.10.10.10 udp 1812 service radiusserverfarm AAAFARMradius inject auth 1 calling-station-idradius inject auth timer 45radius inject auth vsa ciscoinservice!interface vlan 100ip policy route-map rlb-pbr!access-list 1 permit 0.0.0.1 255.255.255.254access-list 2 permit 0.0.0.0 255.255.255.254!route-map rlb-pbr permit 10match ip address 1set ip next-hop 10.10.10.1!route-map rlb-pbr permit 20match ip address 2set ip next-hop 10.10.10.2Example: How to Configure IOS SLB with Home Agent Director
The following sample configuration enables IOS SLB to balance Mobile IP RRQs among multiple home agents.
Figure 30 IOS SLB with Home Agent Director
Following are the IOS SLB configuration statements for the configuration shown in Figure 30:
ip slb serverfarm HA_FARMnat serverreal 10.10.10.1inservicereal 10.10.10.2inserviceip slb vserver VIRTUAL_HAvirtual 10.10.10.10 udp 434 service ipmobileserverfarm HA_FARMinserviceExample: How to Configure IOS SLB with Sticky Connections
The following sample configuration assigns all HTTP connections from a subnet to the same real server in server farm PUBLIC:
ip slb vserver httpserverfarm PUBLICsticky 30 group 1 netmask 255.255.255.248virtual 20.20.20.20 tcp 80inserviceThe following sample configuration adds HTTPS connections to the above configuration, using the same sticky information but with a different virtual server:
ip slb vserver httpsserverfarm PUBLICsticky 30 group 1 netmask 255.255.255.248virtual 20.20.20.20 tcp 443inserviceNow, all HTTP and HTTPS connections from the subnet are assigned to the same real server. For example, if a user connects to HTTP, then a second user connects to HTTPS, both connections are assigned to the same real server.
Example: How to Configure IOS SLB with GTP IMSI Sticky Database
The following sample configuration shows how to enable the IOS SLB GTP IMSI sticky database:
ip slb serverfarm GGSN_FARMfailaction gtp purgereal 10.20.10.1weight 1faildetect numconns 255 numclients 8inservice!real 10.20.10.2weight 1faildetect numconns 255 numclients 8inservice!real 10.20.10.3weight 1faildetect numconns 255 numclients 8inservice!ip slb vserver GGSN_SERVER1virtual 10.10.10.10 udp 3386 service gtpserverfarm GGSN_FARM backup GGSN_FARMidle gtp request 90idle gtp imsi 10000000sticky gtp imsi group 1gtp notification cac 3inservice!ip slb vserver GGSN_SERVER2virtual 10.10.10.10 udp 2123 service gtpserverfarm GGSN_FARM backup GGSN_FARMidle gtp request 90idle gtp imsi 10000000sticky gtp imsi group 1gtp notification cac 3inserviceExample: How to Configure IOS SLB with ASN Sticky Database
The following sample configuration shows how to enable the IOS SLB ASN sticky database:
ip slb entries sticky 15000 800000ip slb serverfarm ASNLB_FARMfailaction asn purge!real 10.20.10.1weight 1faildetect numconns 255 numclients 8inservice!real 10.20.10.2weight 1faildetect numconns 255 numclients 8inservice!real 10.20.10.3weight 1faildetect numconns 255 numclients 8inservice!ip slb vserver ASNLB_SERVERvirtual 10.10.10.10 udp 0 service asnserverfarm ASNLB_FARMidle asn request 90idle asn msid 100000sticky asn msid group 1gw port 63082replicate casa 100.100.100.102 100.100.100.101 1024 password helloinserviceExample: How to Configure IOS SLB with Transparent Web Cache Load Balancing
In the following sample configuration, virtual server WEBCACHE examines all web flows passing through the load-balancing device and dispatches them to server farm WEBCACHE-FARM. The client exclude statement ignores flows originating from subnet 80.80.7.0, enabling the real servers 80.80.7.188 and 80.80.7.189 to communicate with the Internet as needed.
ip slb serverfarm WEBCACHE-FARMreal 80.80.7.188inservicereal 80.80.7.189inserviceip slb vserver WEBCACHEvirtual 0.0.0.0 0.0.0.0 tcp wwwserverfarm WEBCACHE-FARMclient 80.80.7.0 255.255.255.0 excludeinserviceExample: How to Configure IOS SLB with KAL-AP Agent
In the following sample configuration, the client is configured to send a Domain Name System (DNS) query abcd.com to the GSS. The Global Site Selector (GSS) in the DUBLIN site receives the requests from the client. The GSS answers the DNS query with the virtual IP address of either CHICAGO (10.0.0.100) or NEWYORK (10.0.0.200), based on the load reported by those virtual servers.
Figure 31 IOS SLB with KAL-AP Agent
Following are the IOS SLB configuration statements for the configuration shown in Figure 31:
GSS
shared-keepalive kalap 192.168.1.1 capp-secure enable key kapshared-keepalive kalap 192.168.2.1 capp-secure enable key kap!answer vip 10.0.0.100 name CHICAGO activatekeepalive type kalap tag 192.168.1.1 chicao.comanswer vip 10.0.0.200 name NEWYORK activatekeepalive type kalap tag 192.168.2.1 newyork.com!answer-group ABCD owner System type vipanswer-add 10.0.0.100 name CHICAGO weight 1 order 0 load-threshold 254 activateanswer-add 10.0.0.200 name NEWYORK weight 1 order 0 load-threshold 254 activatedns rule ABCDGPRS owner System source-address-list Anywhere domain-list abcd.com query aclause 1 vip-group method least-loaded ttl 20 count 1 sticky disableSite-1: IOS SLB - CHICAGO
ip slb capp udppeer port 6000 secret 0 kap!ip slb serverfarm SFkal-ap domain chicago.comfarm-weight 200real 10.10.10.1inservicereal 10.10.10.2inservice!ip slb vserver chicagovirtual 10.0.0.100 udp 0serverfarm SFinservice!ip slb dfpagent 10.10.10.1 5000 30 0 10agent 10.10.10.2 5000 30 0 10!int vlan100ip address 192.168.1.1 255.255.255.0GGSN-1
gprs dfp max-weight 100gprs maximum-pdp-context-allowed 20000!ip dfp agent gprsport 5000inserviceGGSN-2
gprs dfp max-weight 100gprs maximum-pdp-context-allowed 20000!ip dfp agent gprsport 5000inserviceSite-2: IOS SLB - NEWYORK
ip slb capp udppeer port 6000peer 192.1.1.1 secret 0 testpeer 10.100.100.100 port 1234!ip slb serverfarm SFkal-ap domain newyork.comfarm-weight 6200real 10.20.20.1inservicereal 10.20.20.2inservicereal 10.20.20.3inservicereal 10.20.20.4inservice!ip slb vserver chicagovirtual 10.0.0.200 udp 0serverfarm SFinservice!ip slb dfpagent 10.10.10.1 5000 30 0 10agent 10.10.10.2 5000 30 0 10!int vlan200ip address 192.168.2.1 255.255.255.0GGSN-1
gprs dfp max-weight 100gprs maximum-pdp-context-allowed 20000!ip dfp agent gprsport 5000inserviceGGSN-2
gprs dfp max-weight 100gprs maximum-pdp-context-allowed 20000!ip dfp agent gprsport 5000inserviceWhere to Go Next
The following sections provide additional information related to IOS SLB.
Troubleshooting
Can I use IOS SLB to load-balance clients and real servers that are on the same LAN or VLAN?
NO!
IOS SLB does not support load balancing of flows between clients and real servers that are on the same LAN or VLAN. The packets being load-balanced cannot enter and leave the load-balancing device on the same interface.
Why is IOS SLB not marking my connections as ESTABLISHED even though I'm transferring data?
If you are using dispatched mode, make sure there are no alternate paths that allow outbound flows to bypass IOS SLB. Also, make sure the clients and real servers are not on the same IP subnet (that is, they are not on the same LAN or VLAN).
Why am I able to connect to real servers directly, but unable to connect to the virtual server?
Make sure that the virtual IP address is configured as a loopback in each of the real servers (if you are running in dispatched mode).
Why is IOS SLB not marking my real server as failed when I disconnect it from the network?
Tune the values for the numclients, numconns, and delay keywords.
If you have a very small client population (for example, in a test environment), the numclients keyword could be causing the problem. This parameter prevents IOS SLB from mistaking the failure of a small number of clients for the failure of a real server.
Why does IOS SLB show my real server as INSERVICE even though I have taken it down or physically disconnected it?
The INSERVICE and OUTOFSERVICE states indicate whether the network administrator intends for that real server to be used when it is operational. A real server that was INSERVICE but was removed from the selection list dynamically by IOS SLB as a result of automatic failure detection, is marked as FAILED. Use the show ip slb reals detail command to display these real server states.
Beginning with release 12.1(1)E, INSERVICE is changed to OPERATIONAL, to better reflect what is actually occurring.
How can I verify that IOS SLB sticky connections are working properly?
Use the following procedure:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
How can I verify that server failures are being detected correctly?
Use the following procedure:
1.
2.
3.
–
–
–
Does the no inservice command take a resource out of service immediately?
When you use the no form of the inservice command to remove a firewall, firewall farm, real server, or virtual server from service, the resource acquiesces gracefully. No new connections are assigned, and existing connections are allowed to complete.
To stop all existing connections for an entire firewall farm or virtual server immediately, use the clear ip slb connections command.
I configured both IOS SLB and input ACLs on the same Catalyst 6500 Family Switch, and now I see TCAM Capacity Exceeded messages. Why?
If you configure IOS SLB and either input ACLs or firewall load balancing on the same Catalyst 6500 Family Switch, you can exceed the capacity of the Telecommunications Access Method (TCAM) on the Policy Feature Card (PFC). To correct the problem, use the mls ip slb search wildcard rp command to reduce the amount of TCAM space used by IOS SLB, but be aware that this command can result in a slight increase in route processor use.
Which IOS releases and platforms support IOS SLB VRF?
Virtual Private Network (VPN) routing and forwarding (VRF) for IOS SLB is supported in IOS release 12.2(18)SXE or later on the Supervisor Engine 720 with an MSFC3 (SUP720-MSFC3) for the Cisco 7600 series routers.
What can cause IOS SLB out-of-sync messages on the Supervisor?
If you are using one Supervisor Engine with replicate slave configured, you might receive out-of-sync messages on the Supervisor.
Can IOS SLB provide both firewall load balancing and RADIUS load balancing on the same Supervisor?
IOS SLB can provide both firewall load balancing and RADIUS load balancing on the same Supervisor Engine 720 (SUP720-MSFC3).
Supported Platforms
Additional References
The following sections provide references related to IOS SLB.
•
•
Related Documents
Cisco IOS commands
Cisco IOS configuration fundamentals
Cisco IOS Configuration Fundamentals Configuration Guide
Cisco IOS IP configuration information
Cisco IOS IP Addressing Configuration Guide
Cisco IOS IP Addressing Command Reference
Cisco IOS IP Application Services Configuration Guide
Cisco IOS mobile wireless configuration information
Cisco IOS IP Mobility Configuration Guide
DFP configuration information
Dynamic Feedback Protocol Support in Distributed Director
CFM configuration information
Using Content Flow Monitor
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
Technical Assistance
Feature Information for IOS SLB
Table 2 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Release 12.2(1) or a later release appear in the table.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, refer to the Cisco IOS IP Application Services Command Reference.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 2 Feature Information for IOS SLB
IOS SLB, First Release on 12.2
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SThe IOS SLB feature is an IOS-based solution that provides load balancing for a variety of networked devices and services.
AAA Load Balancing
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB provides RADIUS load-balancing capabilities for RADIUS authentication, authorization, and accounting (AAA) servers.
The following section provides information about this feature:
Active Standby
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SActive standby enables two IOS SLBs to load-balance the same virtual IP address while at the same time acting as backups for each other.
The following sections provide information about this feature:
•
Algorithms for Server Load Balancing
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB provides the following load-balancing algorithms:
•
•
The following sections provide information about this feature:
•
Alternate IP Addresses
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB enables you to telnet to the load-balancing device using an alternate IP address.
The following section provides information about this feature:
ASN Load Balancing
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB provides load balancing across a set of ASN gateways. The cluster of gateways appears to the base station as one ASN gateway.
The following sections provide information about this feature:
•
•
The following commands were modified by this feature:
debug ip slb, idle (virtual server), show ip slb sessions, show ip slb stats, show ip slb vservers, virtual
ASN Load Balancing: Stateful and Sticky Support
12.2(33)SRE
15.0(1)SAccess Service Network (ASN) Load Balancing supports stateful redundancy and sticky connections.
The following sections provide information about this feature:
•
•
The following commands are new for this feature:
clear ip slb sticky asn msid, gw port, show ip slb sticky
The following commands were modified by this feature:
debug ip slb, failaction (server farm), idle (virtual server), show ip slb sticky, sticky (virtual server)
Audio and Video Load Balancing
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB can balance RealAudio and RealVideo streams through Real-Time Streaming Protocol (RTSP), for servers running RealNetworks applications.
The following section provides information about this feature:
Automatic Server Failure Detection
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB automatically detects each failed TCP connection attempt to a real server, and increments a failure counter for that server. If a server's failure counter exceeds a configurable failure threshold, the server is considered out of service and is removed from the list of active real servers.
The following sections provide information about this feature:
•
Automatic Server Failure Detection: Disabling Automatic Server Failure Detection
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB automatically detects each failed TCP connection attempt to a real server, and increments a failure counter for that server. If a server's failure counter exceeds a configurable failure threshold, the server is considered out of service and is removed from the list of active real servers.
The following sections provide information about this feature:
•
Automatic Unfail
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SWhen a real server fails and is removed from the list of active servers, it is assigned no new connections for a length of time specified by a configurable retry timer. After that timer expires, the server is again eligible for new virtual server connections and IOS SLB sends the server the next qualifying connection. If the connection is successful, the failed server is placed back on the list of active real servers. If the connection is unsuccessful, the server remains out of service and the retry timer is reset. The unsuccessful connection must have experienced at least one retry, otherwise the next qualifying connection would also be sent to that failed server.
The following section provides information about this feature:
Avoiding Attacks on Server Farms and Firewall Farms
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SA highly secure site can take certain steps to protect its server farms and firewall farms from attacks.
The following section provides information about this feature:
Backup Server Farms
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SA backup server farm is a server farm that can be used when none of the real servers defined in a primary server farm is available to accept new connections.
The following sections provide information about this feature:
Bind ID Support
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SThe bind ID allows one physical server to be bound to multiple virtual servers and report a different weight for each one. Thus, the single real server is represented as multiple instances of itself, each having a different bind ID. Dynamic Feedback Protocol (DFP) uses the bind ID to identify for which instance of the real server a given weight is specified. The bind ID is needed only if you are using DFP.
The following sections provide information about this feature:
Client-Assigned Load Balancing
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SClient-assigned load balancing allows you to limit access to a virtual server by specifying the list of client IP subnets that are permitted to use that virtual server. With this feature, you can assign a set of client IP subnets (such as internal subnets) connecting to a virtual IP address to one server farm or firewall farm, and assign another set of clients (such as external clients) to a different server farm or firewall farm.
The following section provides information about this feature:
Connection Rate Limiting
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB enables you to specify the maximum connection rate allowed for a real server in a server farm.
The following sections provide information about this feature:
Content Flow Monitor Support
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports the Cisco Content Flow Monitor (CFM), a web-based status monitoring application within the CiscoWorks2000 product family. You can use CFM to manage Cisco server load-balancing devices. CFM runs on Windows NT and Solaris workstations, and is accessed using a web browser.
The following section provides information about this feature:
Delayed Removal of TCP Connection Context
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SBecause of IP packet ordering anomalies, IOS SLB might "see" the end of a TCP connection (a finish [FIN] or reset [RST]) followed by other packets for the connection. This problem usually occurs when there are multiple paths that the TCP connection packets can follow. To correctly redirect the packets that arrive after the connection has ended, IOS SLB retains the TCP connection information, or context, for a specified length of time. The length of time the context is retained after the connection has ended is controlled by a configurable delay timer.
The following sections provide information about this feature:
•
DFP Support
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports the Dynamic Feedback Protocol (DFP).
The following sections provide information about this feature:
•
DFP Agent Subsystem Support
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports the DFP Agent Subsystem feature, also called global load balancing, which enables client subsystems other than IOS SLB to act as DFP agents. With the DFP Agent Subsystem, you can use multiple DFP agents from different client subsystems at the same time.
The following sections provide information about this feature:
•
•
•
DFP and the Home Agent Director
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SFor the Home Agent Director, you can define IOS SLB as a DFP manager and define a DFP agent on each home agent in the server farm, and the DFP agent can report the weights of the home agents. The DFP agents calculate the weight of each home agent based on CPU use, processor memory, and the maximum number of bindings that can be activated for each home agent.
The following sections provide information about this feature:
•
•
•
•
Exchange Director Features
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports the Exchange Director for the mobile Service Exchange Framework (mSEF) for Cisco 7600 series routers.
The following section provides information about this feature:
Firewall Load Balancing
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SAs its name implies, firewall load balancing enables IOS SLB to balance flows to firewalls. Firewall load balancing uses a load-balancing device on each side of a group of firewalls (called a firewall farm) to ensure that the traffic for each flow travels to the same firewall, ensuring that the security policy is not compromised.
The following sections provide information about this feature:
•
•
Firewall Load Balancing: Multiple Firewall Farm Support
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SYou can configure more than one firewall farm in each load-balancing device.
The following sections provide information about this feature:
•
•
•
Firewall Load Balancing: Performance Improvements
12.2(33)SRE
15.0(1)SIOS SLB firewall load balancing enables you to avoid certain conditions that can result in high CPU usage.
The following sections provide information about this feature:
•
•
•
•
The following commands are new for this feature:
purge connection, purge sticky
The following command was modified by this feature:
access (firewall farm)
Flow Persistence
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SFlow persistence provides intelligent return routing of load-balanced IP flows to the appropriate node, without the need for coordinated hash mechanisms on both sides of the load-balanced data path, and without using Network Address Translation (NAT) or proxies to change client or server IP addresses.
The following section provides information about this feature:
GPRS Load Balancing: Dual-Stack Support for GTP Load Balancing
15.0(1)S
IPv6 support enables IOS SLB to manage IPv6 addresses for GTP load balancing, for all versions of GTP (v0, v1, v2).
Dual-stack support enables IOS SLB to manage dual-stack implementations for GTP load balancing. A dual stack implementation is one that uses both IPv4 and IPv6 addresses.
The following sections provide information about this feature:
•
•
•
The following command is new for this feature:
show ip slb wildcard
The following commands were modified by this feature:
client (virtual server), real (server farm), serverfarm, show ip slb reals, show ip slb serverfarms, show ip slb sessions, show ip slb sticky, show ip slb vservers, show ip slb wildcard.
GPRS Load Balancing: GGSN-IOS SLB Messaging
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SThis feature enables a GGSN to notify IOS SLB when certain conditions occur. The notifications enable IOS SLB to make intelligent decisions, which in turn improves GPRS load balancing and failure detection.
The following sections provide information about this feature:
GPRS Load Balancing:
GTP Cause Code Inspection12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SGPRS load balancing with GTP cause code inspection enabled allows IOS SLB to monitor all PDP context signaling flows to and from GGSN server farms. This enables IOS SLB to monitor GTP failure cause codes, detecting system-level problems in both Cisco and non-Cisco GGSNs.
The following sections provide information about this feature:
•
•
•
GPRS Load Balancing:
GTP IMSI Sticky Database12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB can select a gateway general packet radio service (GPRS) support node (GGSN) for a given International Mobile Subscriber ID (IMSI), and forward all subsequent Packet Data Protocol (PDP) create requests from the same IMSI to the selected GGSN.
The following sections provide information about this feature:
•
GPRS Load Balancing:
GTP Sticky-Only Support12.2(33)SRE
15.0(1)SIOS SLB supports sticky-only for all versions of GTP (v0, v1, v2).
The following section provides information about this feature:
•
The following command is new for this feature:
gtp session (virtual server)
The following command was modified by this feature:
show ip slb sticky
GPRS Load Balancing: GTP v0 Support
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports GTP Version 0 (GTP v0). Support for GTP enables IOS SLB to become "GTP aware," extending IOS SLB knowledge into Layer 5.
The following sections provide information about this feature:
•
•
•
GPRS Load Balancing: GTP v1 Support
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports both GTP Version 0 (GTP v0) and GTP Version 1 (GTP v1). Support for GTP enables IOS SLB to become "GTP aware," extending IOS SLB knowledge into Layer 5.
The following sections provide information about this feature:
•
•
•
GPRS Load Balancing: GTP v2 Support
12.2(33)SRE
15.0(1)SIOS SLB supports GTP Version 2 (GTP v2).
The following sections provide information about this feature:
•
•
GPRS Load Balancing: Maps
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SGPRS load balancing maps enable IOS SLB to categorize and route user traffic based on access point names (APNs).
The following sections provide information about this feature:
•
•
Home Agent Director
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SThe Home Agent Director load balances Mobile IP Registration Requests (RRQs) among a set of home agents (configured as real servers in a server farm). Home agents are the anchoring points for mobile nodes. Home agents route flows for a mobile node to its current foreign agent (point of attachment).
The following sections provide information about this feature:
•
Hot ICE compliance
12.2(33)SRE
15.0(1)SAll IOS SLB commands are Hot ICE-compliant. Hot ICE is a set of Cisco IOS configuration enhancements designed to increase the operational robustness, scalability, and programmability of Cisco IOS configuration management.
INOP_REAL State for Virtual Servers
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SYou can configure a virtual server such that, if all of the real servers that are associated with the virtual server are inactive, the following actions occur:
•
•
•
The following sections provide information about this feature:
•
Interface Awareness
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SSome environments require IOS SLB on both sides of a farm of CSGs, SSGs, or firewalls. For example, you might want IOS SLB to perform RADIUS load balancing on one side of a farm and firewall load balancing on the other, or firewall load balancing on both sides of a firewall farm.
Such "sandwich" environments require IOS SLB to take into account the input interface when mapping packets to virtual servers, firewall farms, connections, and sessions. In IOS SLB, this function is called interface awareness. When interface awareness is configured, IOS SLB processes only traffic arriving on configured access interfaces. (An access interface is any Layer 3 interface.)
The following sections provide information about this feature:
•
•
KAL-AP Agent Support
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SKAL-AP agent support enables IOS SLB to perform load balancing in a global server load balancing (GSLB) environment. KAL-AP provides load information along with its keepalive response message to the KAL-AP manager or GSLB device, such as the Global Site Selector (GSS), and helps the GSLB device load-balance client requests to the least-loaded IOS SLB devices.
The following sections provide information about this feature:
•
•
Maximum Connections
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB allows you to configure maximum connections for server and firewall load balancing.The following sections provide information about this feature:
•
•
NAT: Client NAT
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIf you use more than one load-balancing device in your network, replacing the client IP address with an IP address associated with one of the devices results in proper routing of outbound flows to the correct device. Client NAT also requires that the ephemeral client port be modified since many clients can use the same ephemeral port. Even in cases where multiple load-balancing devices are not used, client NAT can be useful to ensure that packets from load-balanced connections are not routed around the device.
The following sections provide information about this feature:
NAT: Server NAT
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SServer NAT involves replacing the virtual server IP address with the real server IP address (and vice versa).
The following sections provide information about this feature:
NAT: Static NAT
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SWith static NAT, address translations exist in the NAT translation table as soon as you configure static NAT commands, and they remain in the translation table until you delete the static NAT commands.
The following sections provide information about this feature:
Port-Bound Servers
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SWhen you define a virtual server, you must specify the TCP or UDP port managed by that virtual server. However, if you configure NAT on the server farm, you can also configure port-bound servers. Port-bound servers allow one virtual server IP address to represent one set of real servers for one service, such as HTTP, and a different set of real servers for another service, such as Telnet.
The following sections provide information about this feature:
Probes: Custom UDP Probes
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB probes determine the status of each real server in a server farm and of each firewall in a firewall farm.
The following sections provide information about this feature:
Probes: DNS, Routed, and TCP Probes
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB probes determine the status of each real server in a server farm and of each firewall in a firewall farm.
The following sections provide information about this feature:
Probes: HTTP, Ping, and WSP Probes
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB probes determine the status of each real server in a server farm and of each firewall in a firewall farm.
The following sections provide information about this feature:
Protocol Support
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB supports a fixed set of protocols.
The following section provides information about this feature:
RADIUS Load Balancing: Accelerated Data Plane Forwarding
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SRADIUS load balancing accelerated data plane forwarding, also known as Turbo RADIUS load balancing, is a high-performance solution that uses basic policy-based routing (PBR) route maps to manage subscriber data-plane traffic in a CSG environment. When Turbo RADIUS load balancing receives a RADIUS payload, it inspects the payload, extracts the framed-IP attribute, applies a route map to the IP address, and then determines which CSG is to manage the subscriber.
The following sections provide information about this feature:
•
•
•
RADIUS Load Balancing: CDMA2000
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB provides RADIUS load balancing in mobile wireless networks that use service gateways, such as the Cisco Service Selection Gateway (SSG) or the Cisco Content Services Gateway (CSG). IOS SLB supports RADIUS load balancing for the following CDMA2000 mobile wireless networks:
•
•
The following sections provide information about this feature:
•
•
•
RADIUS Load Balancing: GPRS Networks
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB provides RADIUS load balancing in mobile wireless networks that use service gateways, such as the Cisco Service Selection Gateway (SSG) or the Cisco Content Services Gateway (CSG). IOS SLB supports RADIUS load balancing for GPRS networks. In a GPRS mobile wireless network, the RADIUS client is typically a GGSN.
The following sections provide information about this feature:
•
•
RADIUS Load Balancing: Maps
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SRADIUS load balancing maps enable IOS SLB to categorize and route user traffic based on RADIUS calling station IDs and usernames. RADIUS load balancing maps is mutually exclusive with Turbo RADIUS load balancing and RADIUS load balancing accounting local acknowledgement.
The following sections provide information about this feature:
•
•
RADIUS Load Balancing: Multiple Service Gateway Server Farms
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB provides RADIUS load balancing in mobile wireless networks that use service gateways, such as the Cisco Service Selection Gateway (SSG) or the Cisco Content Services Gateway (CSG). IOS SLB supports RADIUS load balancing for multiple service gateway server farms (for example, one farm of SSGs and another of CSGs).
The following sections provide information about this feature:
•
•
RADIUS Load Balancing: RADIUS IMSI Sticky Database
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SThe IOS SLB RADIUS International Mobile Subscriber ID (IMSI) sticky database maps the IMSI address for each user to the corresponding gateway. This enables IOS SLB to forward all subsequent flows for the same user to the same gateway.
The following sections provide information about this feature:
Route Health Injection
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SBy default, a virtual server's IP address is advertised (added to the routing table) when you bring the virtual server into service (using the inservice command). If you have a preferred host route to a website's virtual IP address, you can advertise that host route, but you have no guarantee that the IP address is available. However, you can use the advertise command to configure IOS SLB to advertise the host route only when IOS SLB has verified that the IP address is available. IOS SLB withdraws the advertisement when the IP address is no longer available. This function is known as route health injection.
The following sections provide information about this feature:
•
•
Slow Start
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIn an environment that uses weighted least connections load balancing, a real server that is placed in service initially has no connections, and could therefore be assigned so many new connections that it becomes overloaded. To prevent such an overload, slow start controls the number of new connections that are directed to a real server that has just been placed in service.
The following section provides information about this feature:
Stateful Backup
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SStateful backup enables IOS SLB to incrementally backup its load-balancing decisions, or "keep state," between primary and backup switches. The backup switch keeps its virtual servers in a dormant state until HSRP detects failover; then the backup (now primary) switch begins advertising virtual addresses and processing flows.
The following sections provide information about this feature:
•
•
•
Stateful Backup:
Redundant Route Processors12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SWhen used with RPR+, IOS SLB supports the stateful backup of redundant route processors for mSEF for Cisco 7600 series routers. This enables you to deploy Cisco Multiprocessor WAN Application Modules (MWAMs) in the same chassis as IOS SLB, while maintaining high availability of load-balancing assignments.
The following sections provide information about this feature:
•
•
•
Stateless Backup
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SStateless backup provides high network availability by routing IP flows from hosts on Ethernet networks without relying on the availability of one Layer 3 switch. Stateless backup is particularly useful for hosts that do not support a router discovery protocol (such as the Intermediate System-to-Intermediate System [IS-IS] Interdomain Routing Protocol [IDRP]) and do not have the functionality to shift to a new Layer 3 switch when their selected Layer 3 switch reloads or loses power.
The following sections provide information about this feature:
•
Sticky Connections
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SSometimes, a client transaction can require multiple consecutive connections, which means new connections from the same client IP address or subnet must be assigned to the same real server. You can use the optional sticky command to enable IOS SLB to force connections from the same client to the same load-balanced server within a server farm. For firewall load balancing, the connections between the same client-server pair are assigned to the same firewall.
The following sections provide information about this feature:
•
•
•
Sub-Interface Support
12.2(33)SRE
15.0(1)SIOS SLB provides subinterface support for access commands.
The following sections provide information about this feature:
•
•
•
The following commands were modified by this feature:
access (firewall farm), access (server farm), access (virtual server)
Supported Platforms for 12.2(1) and 12.2(14)S
12.2(1)
12.2(14)SIOS SLB for the listed releases included support for only the following platform:
•
Supported Platforms for 12.2(14)ZA2, 12.2(14)ZA2, 12.2(14)ZA4, 12.2(14)ZA5, 12.2(14)ZA6
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6IOS SLB for the listed releases included support for only the following platform:
•
•
•
•
•
•
Supported Platforms for 12.2(17d)SXB and 12.2(17d)SXB1
12.2(17d)SXB
12.2(17d)SXB1IOS SLB for the listed releases included support for only the following platform:
•
•
Supported Platforms for 12.2(17d)SXD, 12.2(17d)SXE, and 12.2(18)SXF
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXFIOS SLB for the listed releases included support for only the following platform:
•
•
•
•
Supported Platforms for 12.2(17d)SXF5 and 12.2(18)SXF7
12.2(18)SXF5
12.2(18)SXF7IOS SLB for the listed releases included support for only the following platform:
•
•
•
•
•
•
Supported Platforms for 12.2(33)SRB
12.2(33)SRB
IOS SLB for the listed release included support for only the following platform:
•
•
Supported Platforms for 12.2(33)SRC, 12.2(33)SRC1. 12.2(33)SRE, and 15.0(1)S
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB for the listed releases included support for only the following platform:
•
•
•
SynGuard
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SSynGuard limits the rate of TCP start-of-connection packets (SYNchronize sequence numbers, or SYNs) managed by a virtual server to prevent a type of network problem known as a SYN flood denial-of-service attack. A user might send a large number of SYNs to a server, which could overwhelm or crash the server, denying service to other users. SynGuard prevents such an attack from bringing down IOS SLB or a real server. SynGuard monitors the number of SYNs managed by a virtual server at specific intervals and does not allow the number to exceed a configured SYN threshold. If the threshold is reached, any new SYNs are dropped.
The following sections provide information about this feature:
•
TCP Session Reassignment
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB tracks each TCP SYN sent to a real server by a client attempting to open a new connection. If several consecutive SYNs are not answered, or if a SYN is replied to with an RST, the TCP session is reassigned to a new real server. The number of SYN attempts is controlled by a configurable reassign threshold.
The following sections provide information about this feature:
•
Transparent Web Cache Load Balancing
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB can load-balance HTTP flows across a cluster of transparent web caches. To set up this function, configure the subnet IP addresses served by the transparent web caches, or some common subset of them, as virtual servers. Virtual servers used for transparent web cache load balancing do not answer pings on behalf of the subnet IP addresses, and they do not affect traceroute.
The following sections provide information about this feature:
•
•
•
VPN Server Load Balancing
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SIOS SLB can balance Virtual Private Network (VPN) flows.
The following sections provide information about this feature:
•
•
WAP Load Balancing
12.2(1)
12.2(14)S
12.2(14)ZA2
12.2(14)ZA4
12.2(14)ZA5
12.2(14)ZA6
12.2(17d)SXB
12.2(17d)SXB1
12.2(17d)SXD
12.2(17d)SXE
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7
12.2(33)SRB
12.2(33)SRC
12.2(33)SRC1
12.2(33)SRE
15.0(1)SYou can use IOS SLB to load-balance Wireless Session Protocol (WSP) sessions among a group of WAP gateways or servers on an IP bearer network.
The following sections provide information about this feature:
•
•
—
12.2(14)ZA6
12.2(18)SXF
12.2(18)SXF5
12.2(18)SXF7These releases incorporated only minor corrections and clarifications. No new features were introduced in these releases.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2010 Cisco Systems, Inc. All rights reserved.
