Catalyst 6500 Series Software Configuration Guide, 6.3 and 6.4 - Configuring ASLB [Cisco Catalyst 6500 Series Switches]

Table Of Contents

Configuring ASLB

Hardware and Software Requirements

Understanding How ASLB Works

Layer 3 Operations for ASLB

Layer 2 Operations for ASLB

Client-to-Server Data Forwarding

Path 1

Path 2

Path 3—N

Path N + 1, N + 2...

Server-to-Client Data Forwarding

Cabling Guidelines

Configuring ASLB

Configuring the LocalDirector Interfaces

ASLB Configuration Guidelines

Routers

Servers

IP Addresses

Supervisor Engine

Backup LocalDirector Configuration (Optional)

MSFC and Multilayer Switching

NetFlow Data Export

VLANs

Switch Port Configuration

Configuring ASLB from the CLI

Configuring the Switch Ports Connected to the LocalDirector

Enabling and Disabling ASLB

Specifying Server Virtual-IP Addresses and TCP Ports for Acceleration

Specifying MAC Addresses for Participating Routers

Specifying a MAC Address for the LocalDirector

Specifying the Router VLAN and the LocalDirector Port on the VLAN

Specifying the Server VLAN and the LocalDirector Port on the VLAN

Configuring UDP Aging

Committing the ASLB Configuration

Displaying the ASLB Configuration

Displaying the ASLB MLS Entries

Displaying the ASLB MLS Statistics

Clearing the ASLB Configuration

ASLB Configuration Example

ASLB Redundant Configuration Example

IP Addresses

MAC Addresses

Catalyst 6000 Family Switch 1 Configuration

Catalyst 6000 Family Switch 2 Configuration

Router 1 Configuration

Router 2 Configuration

LocalDirector Configuration

Troubleshooting the ASLB Configuration

Configuring ASLB

This chapter describes how to configure accelerated server load balancing (ASLB) on the Catalyst 6000 family switches.

Note For complete syntax and usage information for hte commands used in this chapter, refer to the Catalyst 6000 Family Command Reference publication.

Note The information and procedures in this chapter apply only to the Supervisor Engine 1 with Layer 3 switching engine (Policy Feature Card or PFC). ASLB is not supported on Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2).

This chapter consists of these sections:

•Hardware and Software Requirements

•Understanding How ASLB Works

•Cabling Guidelines

•Configuring ASLB

•ASLB Configuration Example

•ASLB Redundant Configuration Example

•Troubleshooting the ASLB Configuration

Hardware and Software Requirements

The hardware and software requirements for your ASLB configuration are as follows:

•The LocalDirector requirements are as follows:

–Hardware platforms—LocalDirector models 410, 415, 416, 420, or 430

–Interface Modules—ASLB configuration requires two 10/100BASE-X Ethernet interfaces or two 1000BASE-X Gigabit Ethernet interfaces

Note 1000BASE-X interfaces are only supported on the LocalDirector 420 and 430. They are not supported on the LocalDirector 410, 415, or 416.

–Software—Cisco configuration version 3.2.x

•The Catalyst 6000 family switch requirements are as follows:

–Supervisor engine with the Policy Feature Card (PFC)

–Supervisor engine software release 5.3(1)CSX or later releases

•The participating routers are as follows:

–MSFC—With supervisor engine software release 5.4(1)CSX or later releases, an MSFC in the Catalyst 6000 family switch can be used as a participating router for ASLB. With earlier supervisor engine software releases, an internal MSFC cannot be a participating router.

–External MSFC—An MSFC in an externally attached Catalyst 6000 family switch can be used as a participating router.

–Multilayer Switch Module (MSM)—If the Catalyst 6000 family switch that you are using for ASLB has an MSM, it can be used as a participating router for ASLB. The MSM in an externally attached Catalyst 6000 family switch can also be used as a participating router.

–Other Cisco routers can also be used as participating routers for ASLB.

Understanding How ASLB Works

Note Refer to the Cisco LocalDirector Installation and Configuration Guide, Version 3.2, for an overview on load balancing TCP/IP traffic.

These sections describe ASLB:

•Layer 3 Operations for ASLB

•Layer 2 Operations for ASLB

•Client-to-Server Data Forwarding

•Server-to-Client Data Forwarding

The LocalDirector is a secure, real-time, embedded operating system that intelligently load balances TCP/IP traffic across multiple servers. ASLB enables Catalyst 6000 family switches to cache Cisco LocalDirector load-balancing flows, accelerating the performance of the LocalDirector.

Note The accelerated performance of the LocalDirector is achieved through the Catalyst 6000 family Layer 3 switching technology.

Figure 42-1 shows a network using the ASLB feature. You must connect the LocalDirector to the switch with two links; one link connects to the same VLAN that the router is on and the other link connects to the VLAN that the servers are on. In Figure 42-1, one LocalDirector link is connected to VLAN 10, the router VLAN; the other link is connected to VLAN 20, the server VLAN.

The LocalDirector supports directed mode and dispatched mode. Only the dispatched mode can be supported for ASLB feature implementation on Catalyst 6000 family switches.

Figure 42-1 ASLB Functional Description

Layer 3 Operations for ASLB

You can specify up to 1024 server virtual-IP addresses and TCP port pairs for acceleration by the switch. All traffic for the virtual-IP/port pairs specified is accelerated except for the SYN, FIN, RST, and fragment packets with a non-zero offset. These packets are redirected to both the active and standby LocalDirectors (if a backup LocalDirector is configured).

Layer 2 Operations for ASLB

The Catalyst 6000 family switch content-addressable memory (CAM) table contains entries for the router VLAN and the server VLAN. In the CAM table, the router VLAN has an entry for the MAC address of the LocalDirector associated with a port index, and the server VLAN has entries for the router MAC addresses associated with port indexes. In these port indexes, the ports appear as 0/0. Display system CAM entries by entering the show cam system command.

Table 42-1 shows the entries in the CAM table (the ASLB configuration is shown in Figure 42-1). The first entry identifies the MAC address of the LocalDirector on VLAN 10. The CAM table shows that the MAC address has an Xtag value of 14. This value indicates that the MAC address requires a Layer 3 lookup. The second entry identifies the MAC address of the router and also requires a Layer 3 lookup.

Table 42-1 Layer 2 Table Entries

VLAN

MAC Address

Index

Xtag¹

10

LocalDirector MAC

0/0

14

20

Router MAC²

0/0

14

¹Xtag = The identifier field in the Layer 2 table that identifies the router to which the MAC address belongs.

²Note that the router MAC address is added on the server VLAN (VLAN 20), not on the router VLAN (VLAN 10).

Client-to-Server Data Forwarding

Figure 42-2 shows how data is forwarded from the router to the servers. Table 42-2 lists the sequence of events, and Table 42-3 lists the Layer 3 table entries.

These sections describe the client-to-server data-forwarding paths:

•Path 1

•Path 2

•Path 3—N

•Path N + 1, N + 2...

Path 1

The first packet from the router has a destination MAC address of the LocalDirector and is on VLAN 10. The MAC address has an Xtag value of 14 in the Layer 2 table. This value indicates that it requires a Layer 3 lookup, and the SYN flag is set so the frame goes to port PA.

In addition to forwarding the frame to port PA, the switch hardware creates a "candidate" entry in the Layer 3 forwarding table. This entry is updated later by an "enabler" frame to become a full ASLB Multilayer Switching (MLS) entry.

Path 2

After receiving the frame from port PA, the LocalDirector makes its standard load-balancing decision and forwards the frame to port PB. The LocalDirector changes the destination MAC address to that of the appropriate server. When this frame enters the switch, it is considered an "enabler" frame. The switch hardware does a lookup in the Layer 3 table and searches for the entry created by the previous candidate packet (the packet forwarded through the LocalDirector). If the search was successful, a "hit" occurs in the Layer 3 table.

Path 3—N

The ASLB MLS entry has been created and the next and subsequent frames from the router with a destination MAC address of the LocalDirector MAC will be Layer 3 switched unless the packet has SYN, FIN, or RST flags set or the packet is fragmented.

Path N + 1, N + 2...

On the last frame of a connection, either the FIN or RST flags will be set in the TCP header causing the packet to go to the LocalDirector. The LocalDirector must then forward the frame back to the switch after modifying the destination MAC address to be that of the appropriate server. This redirected frame takes the same path as the first frame of the flow. The FIN packet is used by the LocalDirector as an indication that the connection with the server has been terminated, and by the ASLB to purge the affected ASLB MLS entry.

Figure 42-2 Client to Server ASLB Packet Flow

Table 42-2 Client to Server ASLB Packet Flow

Path Number

VLAN

MAC Destination Address

MAC Source Address

IP Destination

Address

IP Source Address

Flags

Action

1

10

LocalDirector MAC¹

Router MAC

VIP²

CIP³

SYN

Candidate entry in Layer 3 table

2

20

Server MAC⁴

Router MAC1

VIP

CIP

-

Enabler frame

3—N

10

LocalDirector MAC1

Router MAC

VIP

CIP

-

Full ASLB MLS entry created

N + 1

10

LocalDirector MAC1

Router MAC

VIP

CIP

FIN/RST

Path 1 redirect

N + 2...

20

Server MAC

Router MAC1

VIP

CIP

FIN/RST

Path 2

¹This MAC address has an Xtag value of 14 in the Layer 2 table for this packet's VLAN.

²VIP = virtual-IP address.

³CIP = client's IP address.

⁴MAC address of the server that the LocalDirector selected.

Table 42-3 Client to Server ASLB Layer 3 Table Entries

IP Destination Address

IP Source Address

Protocol

Ports

VLAN

MAC Destination Address

MAC Source Address

VIP¹

CIP²

TCP

80/YZ

20

Server MAC³

Router MAC

¹VIP = virtual-IP address.

²CIP = client's IP address.

³MAC address of the server that the LocalDirector selected.

Server-to-Client Data Forwarding

Figure 42-3 shows how data is forwarded from the servers to the clients. Table 42-4 lists the sequence of events, and Table 42-5 lists the Layer 3 table entries.

The traffic from the servers to the router or client devices works in the same manner, but in the reverse direction, as the data forwarding described in the "Client-to-Server Data Forwarding" section with the exception that the LocalDirector put its own MAC address as the source of the packet for all packets going to the router. For the traffic in the client-to-server direction, the source MAC address of the packet was unmodified.

Figure 42-3 Server to Client ASLB Packet Flow

Table 42-4 Server to Client ASLB Packet Flow

Path Number

VLAN

MAC Destination Address

MAC Source Address

IP Destination

Address

IP Source Address

Flags

Action

1

20

Router MAC¹

Server MAC²

CIP³

VIP⁴

SYN

Candidate entry in Layer 3 table

2

10

Router MAC

LocalDirector MAC1

CIP

VIP

-

Enabler packet

3—N

20

Router MAC1

Server MAC

CIP

VIP

-

Full ASLB MLS entry created

N + 1

20

Router MAC1

Server MAC

CIP

VIP

FIN/RST

Path 1 redirect

N +2...

10

Router MAC

LocalDirector MAC1

CIP

VIP

FIN/RST

Path 2

¹This MAC address has an Xtag value of 14 in the Layer 2 table for this packet's VLAN.

²MAC address of the server that the LocalDirector selected.

³CIP = client's IP address.

⁴VIP = virtual-IP address.

Table 42-5 Server to Client ASLB Layer 3 Table Entries

IP Destination Address

IP Source Address

Protocol

Ports

VLAN

MAC Destination Address

MAC Source Address

VIP¹

CIP²

TCP

80/YZ

20

Server MAC³

Router MAC

CIP

VIP

TCP

YZ/80

10

Router MAC

LocalDirector MAC

¹VIP = virtual-IP address.

²CIP = client's IP address.

³MAC address of the server that the LocalDirector selected.

Cabling Guidelines

Follow these cabling guidelines for your ASLB configuration:

•Check your connections to the servers attached to the switch. The servers must be either directly attached to the switch or within the same bridging domain as the LocalDirector port in the server VLAN.

•Use two Category 5 unshielded twisted-pair cables to connect two 10/100 or two 1000BASE-X switch ports to two comparable LocalDirector interfaces.

Caution Connect the LocalDirector directly to the Catalyst 6000 family switch.

See the "Configuring the LocalDirector Interfaces" section to configure the LocalDirector interfaces. See the "Configuring ASLB from the CLI" section to configure the switch.

Configuring ASLB

This section lists the tasks necessary to configure ASLB:

•Configuring the LocalDirector Interfaces

•ASLB Configuration Guidelines

To implement these tasks, follow the guidelines and use the detailed configuration procedures in the sections that follow.

Configuring the LocalDirector Interfaces

Refer to the Cisco LocalDirector Installation and Configuration Guide, Version 3.2, for detailed information on configuring the LocalDirector interfaces for ASLB.

ASLB Configuration Guidelines

This section lists the usage guidelines and restrictions for configuring ASLB:

•Routers

•Servers

•IP Addresses

•Supervisor Engine

•Backup LocalDirector Configuration (Optional)

•MSFC and Multilayer Switching

•NetFlow Data Export

•VLANs

•Switch Port Configuration

For configuration examples, see the "ASLB Configuration Example" section. If you run into problems during your configuration, see the "Troubleshooting the ASLB Configuration" section.

Routers

Follow these router configuration guidelines:

•The router must be the default gateway for the servers being load balanced and its MAC address must be known.

•Multiple routers must be on the same router VLAN. Specify all the participating router MAC addresses using the set lda mac router command.

•When ASLB is configured, a VACL is created to redirect TCP traffic on the two VLANs that the LocalDirector is connected to; no security IOS ACLs or VACLs can be configured on these VLANs.

Servers

Follow these server configuration guidelines:

•The servers must be either directly attached to the switch or within the same bridging domain as the LocalDirector port in the server VLAN.

•Configure the servers to ignore ARP requests for the virtual-IP address.

•Configure the server default route as the aliased address of the router that is on the same subnet as the real IP address of the server.

Caution To accelerate traffic in the client to server direction, you must configure the servers to ignore ARP requests for the virtual-IP address. If you fail to do this step, traffic acceleration will not start, and fully redundant topologies in your network will take a long time to recover from a LocalDirector failure.

•On some server operating systems you cannot disable responses to ARP requests on alias (secondary) IP addresses. Use static ARP entries at the routers as a workaround for the servers that respond to ARP requests for the virtual-IP address.

IP Addresses

Follow these IP address configuration guidelines:

Note You can specify an IP address for the virtual-IP address other than server IP network addresses.

•Ensure that the LocalDirectors and servers are on the same subnet to allow the LocalDirector to ARP the real IP address of each server.

•Ensure that the routers are on the same subnet as the virtual-IP address to allow the router to ARP the virtual-IP address.

Configure the network for ASLB is as follows (the virtual-IP address in this example is 171.1.1.200):

Router

LocalDirector

Servers¹

171.1.1.1

171.1.1.2

171.1.1.x

¹The default router on each server is 171.1.1.1.

If the servers in your ASLB configuration need to follow RFC 1918 for privacy, use the following as a guideline (the virtual-IP address in this example is 171.1.1.200):

Routers

LocalDirector

Servers¹

171.1.1.1

171.1.1.2

10.1.1.x (real IP address)

Alias 10.1.1.1

Alias 10.1.1.2

Loopback alias to 171.1.1.200

¹The default router on each server is 10.1.1.1.

Supervisor Engine

Follow these supervisor engine configuration guidelines:

•Up to 32 router MAC addresses are supported.

•Up to 1024 virtual-IP/TCP port pairs are supported.

Backup LocalDirector Configuration (Optional)

Connect the ports on the backup LocalDirector to the switch and specify the server and router configuration using the set lda server and set lda router commands. Connect the active and backup LocalDirectors to their specified ports or the ASLB feature will not work.

MSFC and Multilayer Switching

Follow these Multilayer Switch Feature Card (MSFC) and Multilayer Switching (MLS) configuration guidelines:

•With supervisor engine software release 5.4(1)CSX or later releases, an MSFC can be the participating router for ASLB.

Note Traffic is Layer 3 switched when an MSFC routes traffic from clients. This process creates MLS entries that exist separately from the ASLB MLS entries for the same traffic.

•The aging task that removes terminated ASLB flows also purges MLS terminated flows. ASLB MLS entries share the Layer 3 MLS cache with the MLS shortcut entries.

The MLS commands (set mls, clear mls, and show mls) do not interoperate with ASLB (set lda, clear lda, show lda, and commit lda) commands. ASLB uses separate commands to view the LocalDirector MLS entries.

•When you enable ASLB, ASLB MLS entries are established using one flow mask, full-flow mode (ip-flow).

NetFlow Data Export

You cannot use NetFlow Data Export (NDE) if you enable ASLB, and you cannot use ASLB if you enable NDE.

VLANs

Follow these VLAN configuration guidelines:

•When you configure ASLB, a VACL is created to redirect TCP traffic on the two VLANs to which the LocalDirector is connected (router VLAN and server VLAN). You cannot configure any security IOS access control lists (ACLs) or VLAN access control lists (VACLs) on these VLANs.

•Dedicate the router VLAN and server VLAN for ASLB use only. Do not connect other network devices (such as end stations and clients) to these two VLANs.

•The VLANs created for ASLB propagate to other switches through VLAN Trunking Protocol (VTP) when VTP is in the server mode. Spanning Tree Protocol runs over these ASLB VLANs on all VTP switches in the network, introducing additional overhead over the entire network. To avoid spanning tree propagation delays, do the following:

–Configure the switch as VTP transparent so it does not populate the VLANs.

–Remove the ASLB VLANs from all trunks on all switches (enter the clear trunk command).

Switch Port Configuration

Follow these switch port configuration guidelines:

•Disable CDP on ports connected to the LocalDirectors (both active and standby LocalDirectors if a backup is configured).

•If you specify a port that is part of an EtherChannel, traffic is automatically redirected among all ports in the EtherChannel.

Configuring ASLB from the CLI

This section describes how to configure ASLB using the Catalyst 6000 family switch lda command set and includes the following descriptions:

•Configuring the Switch Ports Connected to the LocalDirector

•Enabling and Disabling ASLB

•Specifying Server Virtual-IP Addresses and TCP Ports for Acceleration

•Specifying MAC Addresses for Participating Routers

•Specifying a MAC Address for the LocalDirector

•Specifying the Router VLAN and the LocalDirector Port on the VLAN

•Specifying the Server VLAN and the LocalDirector Port on the VLAN

•Configuring UDP Aging

•Committing the ASLB Configuration

•Displaying the ASLB Configuration

•Displaying the ASLB MLS Entries

•Displaying the ASLB MLS Statistics

•Clearing the ASLB Configuration

Configuring the Switch Ports Connected to the LocalDirector

To configure the 10/100 Ethernet switch ports connected to the LocalDirector, perform these steps:

Step 1 Enter the set vlan vlan_num mod_ports command to add the switch ports to the correct VLANs (router VLAN and server VLAN).

Step 2 Note that the port speed and duplex type for the switch ports should not need setting as all 10/100 switch ports are set to autonegotiate as the default. If you have a problem with autonegotiation, configure the port speed and duplex type as follows:

Enter the set port speed mod/port {10 | 100 | auto} command to set the port speed.

Enter the set port duplex mod/port {full | half | auto} command to set the type of duplex.

Enabling and Disabling ASLB

Note ASLB is disabled by default. When ASLB is disabled, you cannot enter the set lda commands to perform configuration tasks; to enter the set lda commands, you must enable ASLB.

To enable or disable ASLB, perform these tasks in privileged mode:

Task

Command

Enable or disable ASLB.

set lda enable | disable

This example shows how to enable ASLB on the switch:
Console> (enable) set lda enable
Successfully enabled Local Director Accelerator.
Console> (enable)
This example shows how to disable ASLB on the switch:
Console> (enable) set lda disable
Successfully disabled Local Director Accelerator.
Console> (enable)
Specifying Server Virtual-IP Addresses and TCP Ports for Acceleration

Note You can specify up to 1024 virtual-IP addresses and TCP port pairs for acceleration by the Catalyst 6000 family switch. Newly specified pairs do not replace previously specified pairs. To cancel a previously entered pair, enter the clear lda vip command.

Note You can use a zero (0) as a wildcard (don't care) digit for the destination_tcp_port.

To specify server virtual-IP addresses and TCP ports for acceleration, perform this task in privileged mode:

Task

Command

Specify server virtual-IP addresses and TCP ports for acceleration.

set lda vip {server_virtual_ip} {destination_tcp_port} [{server_virtual_ip} {destination_tcp_port}...]

This example shows how to specify a server virtual-IP address and TCP port for acceleration:
Console> (enable) set lda vip 10.0.0.8 8
Successfully set server virtual ip and port information.
Use commit lda command to save settings to hardware.
Console> (enable)
Specifying MAC Addresses for Participating Routers

Note You can specify up to 32 router MAC addresses.

To specify MAC addresses for participating routers, perform this task in privileged mode:

Task

Command

Specify MAC addresses for participating routers.

set lda mac router {mac-address}...

This example shows how to specify MAC addresses for participating routers:
Console> (enable) set lda mac router 00-23-45-67-ee-7f
Successfully set mac address.
Use commit lda command to save settings to hardware.
Console> (enable)
Specifying a MAC Address for the LocalDirector

To specify a MAC address for the LocalDirector, perform this task in privileged mode:

Task

Command

Specify a MAC address for the LocalDirector.

set lda mac ld {ld_mac-address}

This example shows how to specify a MAC address for the LocalDirector:
Console> (enable) set lda mac ld 00-11-22-33-55-66
Successfully set mac address.
Use commit lda command to save settings to hardware.
Console> (enable)
Specifying the Router VLAN and the LocalDirector Port on the VLAN

Note After entering the set lda router command, if you change the switch port(s) that the LocalDirector is connected to, you must enter the set lda router command again to specify the new configuration.

Note Specifying a backup LocalDirector port is optional unless you are setting up a failover configuration of LocalDirectors. If you are setting up a failover configuration, you must specify the ports for the backup LocalDirector. If this is not done, failover will not work because the supervisor engine will not send any traffic to the intended backup LocalDirector.

To specify the VLAN the router is on and the LocalDirector port on the VLAN, perform this task in privileged mode:

Task

Command

Specify the router VLAN and the LocalDirector port on the VLAN.

set lda router {router_vlan} {ld_mod/port} [backup_ld_mod/port]

This example shows how to specify the router VLAN and the LocalDirector port on the VLAN:
Console> (enable) set lda router 110 4/26
Successfully set router vlan and LD port.
Use commit lda command to save settings to hardware.
Console> (enable)
Specifying the Server VLAN and the LocalDirector Port on the VLAN

Note After entering the set lda server command, if you change the switch port(s) that the LocalDirector is connected to, you must enter the set lda server command again to specify the new configuration.

Note Specifying a backup LocalDirector port is optional unless you are setting up a failover configuration of LocalDirectors. If you are setting up a failover configuration, you must specify the ports for the backup LocalDirector. If this is not done, failover will not work because the supervisor engine will not send any traffic to the intended backup LocalDirector.

To specify the VLAN the server is on and the LocalDirector port on the VLAN, perform this task in privileged mode:

Task

Command

Specify the server VLAN and the LocalDirector port on the VLAN.

set lda server {server_vlan} {ld_mod/port} [backup_ld_mod/port]

This example shows how to specify the server VLAN and the LocalDirector port on the VLAN:
Console> (enable) set lda server 105 4/40
Successfully set server vlan and LD port.
Use commit lda command to save settings to hardware.
Console> (enable)
Configuring UDP Aging

To configure User Datagram Protocol (UDP) aging, perform this task in privileged mode:

Task

Command

Configure UDP aging.

set lda udpage time_in_ms

You can set aging from 1 to 2024000 milliseconds (ms). Enter a value of zero to disable UDP aging.

This example shows how to configure UDP aging to 500 ms:
Console> (enable) set lda udpage 500 
Successfully set LDA UDP aging time to 500ms.
Console> (enable)
Committing the ASLB Configuration

Note ASLB configuration settings are temporarily stored in an edit buffer. The settings are saved in NVRAM, but for the settings to take effect, you must enter the commit lda command. This command verifies your configuration settings and if the information is entered correctly and passes a consistency check, the settings are programmed into hardware. Once the ASLB configuration is successfully committed, the mapping is saved in NVRAM and restored at system bootup.

To commit your ASLB configuration settings, perform this task in privileged mode:

Task

Command

Commit your ASLB configuration settings.

commit lda

This example shows how to commit the ASLB configuration settings:
Console> (enable) commit lda
Commit operation in progress...
Successfully committed Local Director Accelerator.
Console> (enable)
Displaying the ASLB Configuration

Note Entering show lda without a keyword (committed | uncommitted) displays committed configuration settings.

To display committed or uncommitted ASLB configuration settings, perform this task in privileged mode:

Task

Command

Display committed or uncommitted ASLB configuration settings.

show lda [committed | uncommitted]

This example shows how to display committed ASLB configuration settings:
Console> (enable) show lda committed
Status:Committed
Virtual IP addresses:
Local Director Flow:10.0.0.8/ (TCP port 8)
Router MAC:  
00-23-45-67-ee-7f
LD MAC:00-11-22-33-55-66
LD Router Side:
---------------
Router and LD are on VLAN 110
LD is connected to switch port 4/26 on VLAN 110
LD Server Side:
---------------
Server(s) and LD are on VLAN 105
LD is connected to switch port 4/40 on VLAN 105
Console> (enable)
If the configuration is then modified and the changes are not committed, entering the show lda command again gives an indication that the configuration has been modified since the last commit but the new modifications are not shown, only the committed modifications are displayed. To view the new modifications, enter the show lda uncommitted command.

Displaying the ASLB MLS Entries

Note The short | long options give the flexibility to display the output in regular (80 characters in width) or wide-screen format.

To display the ASLB MLS entries, perform this task in privileged mode:

Task

Command

Display ASLB MLS entries.

show lda mls entry

show lda mls entry [destination ip_addr_spec] [source ip_addr_spec] [protocol protocol] [src-port port] [dst-port port] [short | long]

This example shows how to display all ASLB MLS entries in short format:
Console> (enable) show lda mls entry short
Destination-IP  Source-IP       Prot  DstPrt SrcPrt Destination-Mac   Vlan
--------------- --------------- ----- ------ ------ ----------------- ----
EDst ESrc DPort  SPort  Stat-Pkts  Stat-Bytes  Uptime   Age
---- ---- ------ ------ ---------- ----------- -------- --------
10.0.0.8        172.20.20.10    TCP  8      64     00-33-66-99-22-44 105 
ARPA ARPA -      4/25   0          0           00:00:02 00:00:05
10.0.0.8        172.20.20.11    TCP  8      64     00-33-66-99-22-44 105 
ARPA ARPA -      4/25   0          0           00:00:05 00:00:08
Console> (enable)
This example shows how to display ASLB information for the source IP address in short format:
Console> (enable) show lda mls entry source 172.20.20.11 short
Destination-IP  Source-IP       Prot  DstPrt SrcPrt Destination-Mac   Vlan
--------------- --------------- ----- ------ ------ ----------------- ----
EDst ESrc DPort  SPort  Stat-Pkts  Stat-Bytes  Uptime   Age
---- ---- ------ ------ ---------- ----------- -------- --------
10.0.0.8        172.20.20.11    TCP  8      64     00-33-66-99-22-44 105
ARPA ARPA -      4/25   0          0           00:00:05 00:00:08
Console> (enable) 
Displaying the ASLB MLS Statistics

To display the ASLB MLS statistics, perform this task in privileged mode:

Task

Command

Display ASLB MLS entry statistics.

show lda mls statistics entry

show lda mls statistics count

show lda mls statistics entry [destination ip_addr_spec]
[source ip_addr_spec] [protocol protocol]
[src-port port] [dst-port port]

This example shows how to display all ASLB MLS entry statistics:
Console> (enable) show lda mls statistics entry
                                  Last    Used
Destination IP  Source IP       Prot DstPrt SrcPrt Stat-Pkts  Stat-Bytes
--------------- --------------- ---- ------ ------ ---------- ---------------
10.0.0.8        172.20.20.10    TCP  WWW    64     636        29256       
10.0.0.8        172.20.22.10    TCP  WWW    64     0          0    
Console> (enable) 
This example shows how to display the number of ASLB active MLS entries:
Console> (enable) show lda mls statistics count
LDA active shortcuts: 20
Console> (enable) 
This example shows how to display the statistics for a specific destination IP address:
Console> (enable) show lda mls statistics entry destination 172.20.22.14
                Last Used         Last    Used
Destination IP  Source IP       Prot DstPrt SrcPrt Stat-Pkts  Stat-Bytes
--------------- --------------- ---- ------ ------ ---------- ---------------
172.20.22.14    172.20.25.10    6    50648  80     3152       347854
Console> (enable) 
Clearing the ASLB Configuration

Caution If you do not enter any keywords with the clear lda command, the entire ASLB configuration is removed from the hardware and NVRAM along with the MLS entries. If you do not enter any keywords with the clear lda mls command, all MLS entries are cleared.

To clear ASLB entries or router MAC addresses, perform this task in privileged mode:

Task

Command

Clear ASLB configuration settings.

clear lda mls

clear lda mls [destination ip_addr_spec] [source ip_addr_spec] [protocol protocol src-port src_port dst-port dst_port]

clear lda vip {all | vip | vip tcp_port}

clear lda mac {all | router_mac_address}

This example shows how to clear the MLS entry at a specific destination address:
Console> (enable) clear lda mls destination 172.20.26.22
MLS IP entry cleared.
Console> (enable)
This example shows how to delete a virtual-IP address and port pair (10.0.0.8, port 8):
Console> (enable) clear lda vip 10.0.0.8 8
Successfully deleted vip/port pairs.
Console> (enable)
This example shows how to clear all ASLB router MAC addresses:
Console> (enable) clear lda mac all
Successfully cleared Router MAC address.
Console> (enable)
This example shows how to clear a specific ASLB router MAC address:
Console> (enable) clear lda mac 1-2-3-4-5-6
Successfully cleared Router MAC address.
Console> (enable)
ASLB Configuration Example

This section provides an example of a typical ASLB network configuration. Figure 42-4 shows the example network; the configuration specifications are as follows:

•The virtual-IP address is 192.255.201.55.

•The router interface MAC address is 00-d0-bc-e9-fb-47 and its IP address is 192.255.201.1.

•The LocalDirector IP address is 192.255.201.2.

•The LocalDirector MAC address is 00-e0-b6-00-4b-04.

•The server farm IP addresses are 192.255.201.3 through 192.255.201.11.

•The servers have been configured to ignore ARP requests for the virtual-IP address 192.255.201.55.

The example in Figure 42-4 shows how to do the following:

•Load balance HTTP connections in a round-robin fashion among servers 192.255.201.3 through 192.255.201.10.

•Forward connections to port 8001 to server 192.255.201.11.

•Load balance FTP connections to servers 192.255.201.3 through 192.255.201.8 in a "leastconns" fashion (which is the default for the LocalDirector).

Figure 42-4 ASLB Configuration Example

The router configuration is as follows (MSM is used in this example):
!
interface Port-channel1.7
encapsulation isl 7
ip address 192.255.201.1 255.255.255.0
no ip redirects
no ip directed-broadcast
!
The Catalyst 6000 family switch configuration is as follows:
Console (enable) show lda
Status:Committed
Virtual IP addresses:
Local Director Flow:192.255.201.55/www (TCP port 80)
Local Director Flow:192.255.201.55/ (TCP port 8001)
Local Director Flow:192.255.201.55/ftp (TCP port 21)
Router MAC:  
00-d0-bc-e9-fb-47
LD MAC:  00-e0-b6-00-4b-04
LD Router Side:
---------------
Router and LD are on VLAN 7
LD is connected to switch port 5/7 on VLAN 7
LD Server Side:
---------------
Server(s) and LD are on VLAN 5
LD is connected to switch port 5/5 on VLAN 5
Console (enable)
The LocalDirector configuration is as follows:
LD430# show configuration
:Saved
:LocalDirector 430 Version 3.1.3.105
syslog output 20.3
no syslog console
hostname LD430
no shutdown ethernet 0
no shutdown ethernet 1
shutdown ethernet 2
shutdown ethernet 3
interface ethernet 0 100full
interface ethernet 1 100full
interface ethernet 2 auto
interface ethernet 3 auto
mtu 0 1500
mtu 1 1500
mtu 2 1500
mtu 3 1500
no multiring all
no secure  0
no secure  1
no secure  2
no secure  3
ping-allow 0  
ping-allow 1  
no ping-allow 2
no ping-allow 3
ip address 192.255.201.2 255.255.255.0
route 0.0.0.0 0.0.0.0 192.255.201.1 1
no rip passive
rip version 1 
failover ip address 0.0.0.0
no failover   
snmp-server enable traps
no snmp-server contact
no snmp-server location
virtual 192.255.201.55:80:0:tcp is
virtual 192.255.201.55:8001:0:tcp is
virtual 192.255.201.55:21:0:tcp is
predictor 192.255.201.55:80:0:tcp roundrobin 
redirection 192.255.201.55:80:0:tcp dispatched assisted wildcard-ttl 60
fixed-ttl 60 igmp 224.0.1.2 port 1637
redirection 192.255.201.55:8001:0:tcp dispatched assisted wildcard-ttl 60
fixed-ttl 60 igmp 224.0.1.2 port 1637
redirection 192.255.201.55:21:0:tcp dispatched assisted wildcard-ttl 60
fixed-ttl 60 igmp 224.0.1.2 port 1637
real 192.255.201.5:80:0:tcp is
real 192.255.201.3:80:0:tcp is
real 192.255.201.4:80:0:tcp is
real 192.255.201.6:80:0:tcp is
real 192.255.201.7:80:0:tcp is
real 192.255.201.8:80:0:tcp is
real 192.255.201.9:80:0:tcp oos
real 192.255.201.10:80:0:tcp oos
real 192.255.201.11:8001:0:tcp oos
real 192.255.201.3:21:0:tcp is
real 192.255.201.4:21:0:tcp is
real 192.255.201.5:21:0:tcp is
real 192.255.201.6:21:0:tcp is
real 192.255.201.7:21:0:tcp is
real 192.255.201.8:21:0:tcp is
bind 192.255.201.55:80:0:tcp 192.255.201.3:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.4:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.5:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.6:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.7:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.8:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.9:80:0:tcp
bind 192.255.201.55:80:0:tcp 192.255.201.10:80:0:tcp
bind 192.255.201.55:8001:0:tcp 192.255.201.11:8001:0:tcp
bind 192.255.201.55:21:0:tcp 192.255.201.3:21:0:tcp
bind 192.255.201.55:21:0:tcp 192.255.201.4:21:0:tcp
bind 192.255.201.55:21:0:tcp 192.255.201.5:21:0:tcp
bind 192.255.201.55:21:0:tcp 192.255.201.6:21:0:tcp
bind 192.255.201.55:21:0:tcp 192.255.201.7:21:0:tcp
bind 192.255.201.55:21:0:tcp 192.255.201.8:21:0:tcp
ASLB Redundant Configuration Example

This section provides an example of a typical ASLB redundant network configuration. Figure 42-5 shows the example redundant network. The LocalDirectors and Catalyst 6000 family switches are configured to accelerate HTTP and Telnet for server VIP address 13.13.13.13.

Caution Router 1 and router 2 are running Hot Standby Routing Protocol (HSRP) on both interfaces, f1 and f2 in Figure 42-5. Interface f1 must be active on the same router where f2 is active; otherwise, traffic will reach interface f1 on one router and will not be forwarded to interface f2 which is active on the other router. Use the HSRP track command to track the opposite side interface of each router.

Figure 42-5 ASLB Redundant Configuration Example

IP Addresses

The IP addresses are as follows:

•Router 1, f1 IP address: 7.0.0.100 (network 7)

•Router 2, f1 IP address: 7.0.0.101 (network 7)

•HSRP IP address: 7.0.0.1 for network 7

•Router 1, f2 IP address: 5.0.0.100 (network 5)

•Router 2, f2 IP address: 5.0.0.101 (network 5)

•HSRP IP address: 5.0.0.2 for network 5

•LocalDirector IP address: 5.0.0.1

•Server IP address: 5.100.100.100

•VIP address for servers: 13.13.13.13

MAC Addresses

The MAC addresses are as follows:

•HSRP MAC address for network 7: 00-00-0c-07-ac-00

•HSRP MAC address for network 5: 00-00-0c-07-ac-01

•Router 1, f2 MAC address: 00-d0-79-7b-20-88

•Router 2, f2 MAC address: 00-d0-79-7b-18-88

•LocalDirector MAC address: 00-e0-b6-00-47-ec

Catalyst 6000 Family Switch 1 Configuration

The switch 1 configuration is as follows:
set trunk 3/23 on isl 1,5,9
set lda enable
clear lda vip all
set lda vip 13.13.13.13 80 13.13.13.13 23 
clear lda mac all
set lda mac router 00-00-0c-07-ac-01
set lda mac router 00-d0-79-7b-20-88 
set lda mac router 00-d0-79-7b-18-88 
set lda mac ld 00-e0-b6-00-47-ec
set lda router 9 3/7 3/23
set lda server 5 3/8 3/23
commit lda
Catalyst 6000 Family Switch 2 Configuration

The switch 2 configuration is as follows:
set trunk 3/23 on isl 1,5,9
set lda enable
clear lda vip all
set lda vip 13.13.13.13 80 13.13.13.13 23 
clear lda mac all
set lda mac router 00-00-0c-07-ac-01
set lda mac router 00-d0-79-7b-20-88 
set lda mac router 00-d0-79-7b-18-88 
set lda mac ld 00-e0-b6-00-47-ec
set lda router 9 3/27 3/23
set lda server 5 3/28 3/23
commit lda
Router 1 Configuration

The router 1 configuration is as follows:
interface FastEthernet1
 ip address 7.0.0.100 255.0.0.0
 no ip redirects
 no ip directed-broadcast
 no ip route-cache distributed
 load-interval 30
 no keepalive
 full-duplex
 standby 1 ip 7.0.0.1
 standby 1 track FastEthernet2
!
interface FastEthernet2
 ip address 5.0.0.100 255.0.0.0
 no ip redirects
 no ip directed-broadcast
 no ip route-cache distributed
 no keepalive
 full-duplex
 standby priority 250
 standby 2 ip 5.0.0.2
 standby 2 track FastEthernet1
!
ip route 13.13.13.13 255.255.255.255 5.0.0.1
Router 2 Configuration

The router 2 configuration is as follows:
interface FastEthernet1
 ip address 7.0.0.101 255.0.0.0
 no ip redirects
 no ip directed-broadcast
 no ip route-cache distributed
 load-interval 30
 no keepalive
 full-duplex
 standby 1 ip 7.0.0.1
 standby 1 track FastEthernet2
!
interface FastEthernet2
 ip address 5.0.0.101 255.0.0.0
 no ip redirects
 no ip directed-broadcast
 no ip route-cache distributed
 no keepalive
 full-duplex
 standby priority 250
 standby 2 ip 5.0.0.2
 standby 2 track FastEthernet1
!
ip route 13.13.13.13 255.255.255.255 5.0.0.1
LocalDirector Configuration

The LocalDirector 1 and LocalDirector 2 configuration is as follows (the configuration is the same for both LocalDirectors):
no shutdown ethernet 0
no shutdown ethernet 4
interface ethernet 0 100full
interface ethernet 4 100full
ip address 5.0.0.1 255.0.0.0
failover ip address 5.0.0.5
virtual 13.13.13.13:80:0:tcp is
virtual 13.13.13.13:23:0:tcp is
predictor 13.13.13.13:80:0:tcp roundrobin 
predictor 13.13.13.13:23:0:tcp roundrobin 
redirection 13.13.13.13:80:0:tcp dispatched assisted
redirection 13.13.13.13:23:0:tcp dispatched assisted
real 5.100.100.100:80:0:tcp is
real 5.100.100.100:23:0:tcp is
bind 13.13.13.13:80:0:tcp 5.100.100.100:80:0:tcp
bind 13.13.13.13:23:0:tcp 5.100.100.100:23:0:tcp
Troubleshooting the ASLB Configuration

Table 42-6 lists the possible problem symptoms and recommended actions to troubleshoot the ASLB configuration.

Table 42-6 Troubleshooting the ASLB Configuration

Symptom

Recommended Action

LocalDirector does not receive any traffic.

Ensure that the LocalDirector is connected to the ports you specified by entering the set lda server and set lda router commands.

LocalDirector connection entries are not purged.

Ensure that you configured all the virtual-IP/port pairs by entering the set lda vip command.

ASLB MLS entries are created in only one direction.

Ensure that you configured all the virtual-IP/port pairs on both the supervisor engine (set lda vip command) and the LocalDirector.

Ensure that the LocalDirector is in the "dispatched assisted" mode.

Ensure that you configured the IP addresses of the routers, LocalDirector, and servers following the guidelines in the "IP Addresses" section. Ensure that the router knows how to reach the LocalDirector when traffic goes to the virtual-IP address (if the virtual-IP address is on a different subnet than the router interface).

Ensure that the router MAC address is the same as specified by entering the set lda mac router command.

Ensure that the LocalDirector MAC address is the same as specified by entering the set lda mac ld command.

Backup LocalDirector does not receive any traffic.

Ensure that you configured the backup LocalDirector ports by entering the set lda router and set lda server commands; for example, enter set lda router {router_vlan} 3/7 3/9 and set lda server {server_vlan} 3/8 3/10.

You can ping servers from the router, but ASLB MLS entries are not created when you send data traffic.

Ensure that the servers were configured to ignore ARP requests for the virtual-IP address.

You see the message:

%CDP-4-NVLANMISMATCH: Native vlan mismatch detected on port ...

Disable CDP on ports connected to the LocalDirector (enter set cdp disable command).

LocalDirector set commands did not take effect.

The set lda commands will not take effect until you enter the commit lda command.

You can verify which set lda commands are in effect by entering the show lda commit command.

You can determine which set lda commands are set but not committed, or determine what changes will occur if the current set lda commands are committed by entering the show lda uncommitted command.

You see "collisions" or "port disabled" on the Catalyst 6000 port.

Ensure that the port speed and duplex settings are compatible on both ends of the link between the LocalDirector and the switch. For example, if port 3/7 on the switch is connected to interface ethernet 0 on the LocalDirector, make sure that port 3/7 is set to 100full and that interface ethernet 0 on the LocalDirector is also set to 100full.