Cisco IOS Server Load Balancing Configuration Guide

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

Adds a server farm definition to the IOS SLB configuration and enters server farm configuration mode.

Step 4 

access interface

Router(config-slb-sfarm)# access GigabitEthernet 0/1.1

(Optional) Configures an access interface or subinterface for a server farm.

Step 5 

bindid [bind-id]

Router(config-slb-sfarm)# bindid 309

(Optional) Specifies a bind ID on the server farm for use by Dynamic Feedback Protocol (DFP).

Note GPRS load balancing and Home Agent Director do not support this command.

Step 6 

nat {client pool | server}

Router(config-slb-sfarm)# nat server

(Optional) Configures Network Address Translation (NAT) client translation mode or NAT server address translation mode on the server farm.

All IPv4 or IPv6 server farms that are associated with the same virtual server must have the same NAT configuration.

Step 7 

predictor [roundrobin | leastconns | route-map mapname]

Router(config-slb-sfarm)# predictor leastconns

(Optional) Specifies the algorithm to be used to determine how a real server is selected.

Note RADIUS load balancing requires the default setting (the weighted round robin algorithm).

In GPRS load balancing without GTP cause code inspection enabled, you must accept the default setting (the weighted round robin algorithm).

The Home Agent Director requires the default setting (the weighted round robin algorithm).

When you specify the predictor route-map command in SLB server farm configuration mode, no further commands in SLB server farm configuration mode or real server configuration mode are allowed.

For more details, see the following sections:

•Weighted Round Robin Algorithm

•Weighted Least Connections Algorithm

•Route Map Algorithm

Step 8 

probe probe

Router(config-slb-sfarm)# probe PROBE1

(Optional) Associates a probe with the real server.

Step 9 

real ipv4-address [ipv6 ipv6-address] [port]

Router(config-slb-sfarm)# real 10.1.1.1

Identifies a real server by IPv4 address, and optional IPv6 address and port number, as a member of a server farm and enters real server configuration mode.

Note In GPRS load balancing, specify the IP addresses (virtual template addresses, for Cisco GGSNs) of the real servers performing the GGSN function.

In VPN server load balancing, specify the IP addresses of the real servers acting as VPN terminators.

For the Home Agent Director, specify the IP addresses of the real servers acting as home agents.

For dual-stack support for GTP load balancing, specify the real server's IPv4 and IPv6 address.

Step 10 

faildetect numconns number-of-conns 
[numclients number-of-clients]

Router(config-slb-real)# faildetect numconns 10 numclients 3

(Optional) Specifies the number of consecutive connection failures and, optionally, the number of unique client connection failures, that constitute failure of the real server.

•In GPRS load balancing, if only one SGSN is configured in your environment, specify the numclients keyword with a value of 1.

•In RADIUS load balancing, for automatic session-based failure detection, specify the numclients keyword with a value of 1.

Step 11 

maxclients number-of-conns

Router(config-slb-real)# maxclients 10

(Optional) Specifies the maximum number of IOS SLB RADIUS and GTP sticky subscribers that can be assigned to an individual virtual server.

Step 12 

(Optional) Specifies the maximum number of active connections allowed on the real server at one time.

Step 13 

(Optional) Specifies the threshold of consecutive unacknowledged SYNchronize sequence numbers (SYNs) or Create Packet Data Protocol (PDP) requests that, if exceeded, result in an attempted connection to a different real server.

Note In GPRS load balancing, you must specify a reassign threshold less than the SGSN's N3-REQUESTS counter value.

Step 14 

retry retry-value

Router(config-slb-real)# retry 120

(Optional) Specifies the time interval, in seconds, to wait between the detection of a server failure and the next attempt to connect to the failed server.

Step 15 

(Optional) Specifies the real server workload capacity relative to other servers in the server farm.

Note If you use Dynamic Feedback Protocol (DFP), the static weights you define using the weight command in server farm configuration mode are overridden by the weights calculated by DFP. If DFP is removed from the network, IOS SLB reverts to the static weights.

Step 16 

inservice

Router(config-slb-real)# inservice

Enables the real server for use by IOS SLB.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password if prompted.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb vserver virtual-server

Router(config)# ip slb vserver PUBLIC_HTTP

Identifies a virtual server and enters virtual server configuration mode.

Step 4 

virtual ipv4-address [ipv4-netmask [group]] 
{esp | gre | protocol}

or

virtual ipv4-address [ipv4-netmask [group]] [ipv6 ipv6-address [prefix ipv6-prefix]] {tcp | udp} [port | any] [service service]

Router(config-slb-vserver)# virtual 10.0.0.1 tcp www

Specifies the virtual server IP address, type of connection, and optional TCP or User Datagram Protocol (UDP) port number, Internet Key Exchange (IKE) or Wireless Session Protocol (WSP) setting, and service coupling.

Note For RADIUS load balancing, specify the service radius keyword option.

Note For ASN load balancing, specify the service asn keyword option.

Note For GPRS load balancing:

–Specify a virtual GGSN IP address as the virtual server, and specify the udp keyword option.

–To load-balance GTP v1 and GTP v2 sessions, specify port number 2123, if the GGSNs and SGSNs are in compliance with the ETSI standard, or specify port number 0 or any to configure an all-port virtual server (that is, a virtual server that accepts flows destined for all ports).

–To load-balance GTP v0 sessions, specify port number 3386, if the GGSNs and SGSNs are in compliance with the ETSI standard, or specify port number 0 or any to configure an all-port virtual server.

–To enable GPRS load balancing without GTP cause code inspection, specify the service gtp keyword option.

–To enable GPRS load balancing with GTP cause code inspection, specify the service gtp-inspect keyword option.

–For dual-stack support for GTP load balancing, specify the virtual server's IPv4 and IPv6 addresses and optional IPv6 prefix.

Step 5 

serverfarm primary-farm [backup backup-farm [sticky]] [ipv6-primary ipv6-primary-farm [ipv6-backup ipv6-backup-farm]] [map map-id priority priority]

Router(config-slb-vserver)# serverfarm SF1 backup SF2 
map 1 priority 1

Associates a real server farm with a virtual server, and optionally configures a backup server farm and specifies that sticky connections are to be used in the backup server farm.

Note RADIUS load balancing and the Home Agent Director do not support the sticky keyword.

You can associate more than one server farm with a given RADIUS virtual server by configuring more than one serverfarm command, each with a unique map ID and a unique priority. (That is, each map ID and each map priority must be unique across all server farms associated with the virtual server.)

For GPRS load balancing, if a real server is defined in two or more server farms, each server farm must be associated with a different virtual server.

For dual-stack support for GTP load balancing, specify the primary IPv6 server farm and optional backup IPv6 server farm.

All IPv4 or IPv6 server farms that are associated with the same virtual server must have the same NAT configuration.

Step 6 

access interface [route framed-ip]

Router(config-slb-vserver)# access Vlan20 route 
framed-ip

(Optional) Enables framed-IP routing to inspect the ingress interface.

Step 7 

(Optional) Controls the installation of a static route to the Null0 interface for a virtual server address.

Step 8 

client {ipv4-address netmask [exclude] | gtp carrier-code [code]}

Router(config-slb-vserver)# client 10.4.4.0 
255.255.255.0

(Optional) Specifies which clients are allowed to use the virtual server.

Note GPRS load balancing supports only the gtp carrier-code option, and only if GTP cause code inspection is enabled.

Dual-stack support for GTP load balancing does not support this command.

Step 9 

delay {duration | radius framed-ip duration}

Router(config-slb-vserver)# delay 30

(Optional) Specifies the time IOS SLB maintains TCP connection context after a connection has ended.

Step 10 

gtp notification cac [reassign-count]

Router(config-slb-vserver)# gtp notification cac 5

(Optional) Limits the number of times IOS SLB can reassign a session to a new real server for GGSN-IOS SLB messaging.

Step 11 

gtp session

Router(config-slb-vserver)# no gtp session

(Optional) Enables IOS SLB to create GTP load-balancing sessions. This is the default setting.

To enable sticky-only load balancing for GTP, use the no form of this command:

no gtp session

If you enable sticky-only load balancing, you must also enable sticky connections for the virtual server using the sticky (virtual server) command.

Step 12 

gw port port

Router(config-slb-vserver)# gw port 63082

(Optional) Specifies the port that the Cisco Broadband Wireless Gateway (BWG) is to use to communicate with IOS SLB.

Step 13 

hand-off radius duration

Router(config-slb-vserver)# hand-off radius 30

(Optional) Changes the amount of time IOS SLB waits for an ACCT-START message from a new Mobile IP foreign agent in the event of a foreign agent hand-off.

Step 14 

(Optional) Specifies the minimum time IOS SLB maintains connection context in the absence of packet activity.

Note In GPRS load balancing without GTP cause code inspection enabled, specify an idle timer greater than the longest possible interval between PDP context requests on the SGSN.

Step 15 

purge radius framed-ip acct on-off

Router(config-slb-vserver)# purge radius framed-ip acct 
on-off

(Optional) Enables IOS SLB to purge entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting On or Off message.

Step 16 

purge radius framed-ip acct stop {attribute-number | {26 | vsa} {vendor-ID | 3gpp | 3gpp2} sub-attribute-number}

Router(config-slb-vserver)# purge radius framed-ip acct 
stop 44

(Optional) Enables IOS SLB to purge entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting-Stop message.

Step 17 

radius acct local-ack key [encrypt] secret-string

Router(config-slb-vserver)# radius acct local-ack key 
SECRET_PASSWORD

(Optional) Enables a RADIUS virtual server to acknowledge RADIUS accounting messages.

Step 18 

radius inject auth group-number {calling-station-id | username}

Router(config-slb-vserver)# radius inject auth 1 
calling-station-id

(Optional) Configures a vendor-specific attribute (VSA) correlation group for an IOS SLB RADIUS load balancing accelerated data plane forwarding authentication virtual server, and specifies whether IOS SLB is to create VSA correlation entries based on RADIUS calling station IDs or RADIUS usernames.

Step 19 

(Optional) Configures a timer for VSA correlation for an IOS SLB RADIUS load balancing accelerated data plane forwarding authentication virtual server.

Step 20 

radius inject auth vsa vendor-id

Router(config-slb-vserver)# radius inject auth vsa 
vendor1

(Optional) Buffers VSAs for VSA correlation for an IOS SLB RADIUS load balancing accelerated data plane forwarding authentication virtual server.

Step 21 

(Optional) Configures a stateful backup of IOS SLB decision tables to a backup switch.

Note The Home Agent Director does not support this command.

If you specify the service gtp keyword on the virtual command, and you do not specify the sticky command with the gtp imsi keyword, the replicate casa command is not supported (because sessions are not persistent, and there is nothing to replicate).

Step 22 

(Optional) Sets the replication delivery interval for an IOS SLB virtual server.

Note The Home Agent Director does not support this command.

If you specify the service gtp keyword on the virtual command, and you do not specify the sticky command with the gtp imsi keyword, the replicate casa command is not supported (because sessions are not persistent, and there is nothing to replicate).

Step 23 

replicate slave

Router(config-slb-vserver)# replicate slave

(Optional) Enables stateful backup of redundant route processors for an IOS SLB virtual server.

Note The Home Agent Director does not support this command.

If you specify the service gtp keyword on the virtual command, and you do not specify the sticky command with the gtp imsi keyword, the replicate casa command is not supported (because sessions are not persistent, and there is nothing to replicate).

If you are using one Supervisor Engine with replicate slave configured, you might receive out-of-sync messages on the Supervisor.

Step 24 

sticky {duration [group group-id] [netmask netmask] | asn msid [group group-id] | gtp imsi [group group-id] | radius calling-station-id  | radius framed-ip [group group-id] | radius username [msid-cisco] [group group-id]}

Router(config-slb-vserver)# sticky 60 group 10

(Optional) Specifies that connections from the same client use the same real server, as long as the interval between client connections does not exceed the specified duration.

Note In VPN server load balancing, specify a duration of at least 15 seconds.

GPRS load balancing and the Home Agent Director do not support this command.

Step 25 

synguard syn-count interval

Router(config-slb-vserver)# synguard 50

(Optional) Specifies the rate of TCP SYNchronize sequence numbers (SYNs) managed by a virtual server in order to prevent a SYN flood denial-of-service attack.

Note GPRS load balancing and the Home Agent Director do not support this command.

Step 26 

inservice [standby group-name] [active]

Router(config-slb-vserver)# inservice

Enables the virtual server for use by IOS SLB.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb firewallfarm firewall-farm

Router(config)# ip slb firewallfarm FIRE1

Adds a firewall farm definition to the IOS SLB configuration and enters firewall farm configuration mode.

Step 4 

real ip-address

Router(config-slb-fw)# real 10.1.1.1

Identifies a firewall by IP address as a member of a firewall farm and enters real server configuration mode.

Step 5 

probe probe

Router(config-slb-fw-real)# probe FireProbe

Associates a probe with the firewall.

Step 6 

weight setting

Router(config-slb-fw-real)# weight 24

(Optional) Specifies the firewall's workload capacity relative to other firewalls in the firewall farm.

Step 7 

inservice

Router(config-slb-fw-real)# inservice

Enables the firewall for use by the firewall farm and by IOS SLB.

Step 8 

access [source source-ip netmask | destination destination-ip netmask | inbound {inbound-interface | datagram connection} | outbound outbound-interface]

Router(config-slb-fw)# access destination 10.1.6.0 
255.255.255.0

(Optional) Routes specific flows to a firewall farm.

Step 9 

predictor hash address [port]

Router(config-slb-fw)# predictor hash address

(Optional) Specifies whether the source and destination TCP or User Datagram Protocol (UDP) port numbers, in addition to the source and destination IP addresses, are to be used when selecting a firewall.

Step 10 

purge connection

Router(config-slb-fw)# purge connection

(Optional) Enables IOS SLB firewall load balancing to send purge requests for connections.

Step 11 

purge sticky

Router(config-slb-fw)# purge sticky

(Optional) Enables IOS SLB firewall load balancing to send purge requests for sticky connections when the sticky timer expires.

Step 12 

replicate casa listen-ip remote-ip port [interval] [password [encrypt] secret-string [timeout]]

Router(config-slb-fw)# replicate casa 10.10.10.11 
10.10.11.12 4231 

(Optional) Configures a stateful backup of IOS SLB firewall load-balancing decision tables to a backup switch.

Note The Home Agent Director does not support this command.

If you specify the service gtp keyword on the virtual command, and you do not specify the sticky command with the gtp imsi keyword, the replicate casa command is not supported (because sessions are not persistent, and there is nothing to replicate).

Step 13 

replicate interval interval

Router(config-slb-fw)# replicate interval 20

(Optional) Sets the replication delivery interval for an IOS SLB firewall farm.

Note The Home Agent Director does not support this command.

If you specify the service gtp keyword on the virtual command, and you do not specify the sticky command with the gtp imsi keyword, the replicate interval command is not supported (because sessions are not persistent, and there is nothing to replicate).

Step 14 

replicate slave

Router(config-slb-fw)# replicate slave

(Optional) Enables stateful backup of redundant route processors for an IOS SLB firewall farm.

Note The Home Agent Director does not support this command.

If you specify the service gtp keyword on the virtual command, and you do not specify the sticky command with the gtp imsi keyword, the replicate slave command is not supported (because sessions are not persistent, and there is nothing to replicate).

If you are using one Supervisor Engine with replicate slave configured, you might receive out-of-sync messages on the Supervisor.

Step 15 

protocol tcp

Router(config-slb-fw)# protocol tcp

(Optional) Enters firewall farm TCP protocol configuration mode.

Step 16 

delay duration

Router(config-slb-fw-tcp)# delay 30

(Optional) In firewall farm TCP protocol configuration mode, specifies the time IOS SLB firewall load balancing maintains TCP connection context after a connection ends.

Step 17 

idle duration

Router(config-slb-fw-tcp)# idle 120

(Optional) In firewall farm TCP protocol configuration mode, specifies the minimum time IOS SLB firewall load balancing maintains connection context in the absence of packet activity.

Step 18 

maxconns maximum-number

Router(config-slb-fw-tcp)# maxconns 1000

(Optional) In firewall farm TCP protocol configuration mode, specifies the maximum number of active TCP connections allowed on the firewall farm at one time.

Step 19 

sticky duration [netmask netmask] [source | destination]

Router(config-slb-fw-tcp)# sticky 60

(Optional) In firewall farm TCP protocol configuration mode, specifies that connections from the same IP address use the same firewall if either of the following conditions is met:

•As long as any connection between the same pair of IP addresses exists (source and destination sticky).

•For a period, defined by duration, after the last connection is destroyed.

Step 20 

protocol datagram

Router(config-slb-fw)# protocol datagram

(Optional) Enters firewall farm datagram protocol configuration mode.

Step 21 

idle duration

Router(config-slb-fw-udp)# idle 120

(Optional) In firewall farm datagram protocol configuration mode, specifies the minimum time IOS SLB firewall load balancing maintains connection context in the absence of packet activity.

Step 22 

maxconns maximum-number

Router(config-slb-fw-udp)# maxconns 1000

(Optional) In firewall farm datagram protocol configuration mode, specifies the maximum number of active datagram connections allowed on the firewall farm at one time.

Step 23 

(Optional) In firewall farm datagram protocol configuration mode, specifies that connections from the same IP address use the same firewall if either of the following conditions is met:

•As long as any connection between the same pair of IP addresses exists (source and destination sticky).

•For a period, defined by duration, after the last connection is destroyed.

Step 24 

inservice

Router(config-slb-fw)# inservice

Enables the firewall farm for use by IOS SLB.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb probe probe custom udp

Router(config)# ip slb probe PROBE6 custom udp

Configures the IOS SLB probe name and enters custom User Datagram Protocol (UDP) probe configuration mode.

Step 4 

address [ip-address] [routed]

Router(config-slb-probe)# address 10.1.1.1

(Optional) Configures an IP address to which to send the custom UDP probe.

Step 5 

faildetect number-of-probes

Router(config-slb-probe)# faildetect 16

(Optional) Specifies the number of consecutive unacknowledged custom UDP probes that constitute failure of the real server.

Step 6 

interval seconds

Router(config-slb-probe)# interval 11

(Optional) Configures the custom UDP probe transmit timers.

Step 7 

port port

Router(config-slb-probe)# port 8

Configures the port to which the custom UDP probe is to connect.

Step 8 

request data {start-byte | continue} hex-data-string

Router(config-slb-probe)# request data 0 05 04 00 77 
18 2A D6 CD 0A AD 53 4D F1 29 29 CF C1 96 59 CB 

Defines the payload of the UDP request packet to be sent by a custom UDP probe.

Step 9 

Defines the data string to match against custom UDP probe response packets.

Step 10 

timeout seconds

Router(config-slb-probe)# timeout 20

(Optional) Sets a timeout for custom UDP probes.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb probe probe dns

Router(config)# ip slb probe PROBE4 dns 

Configures the IOS SLB probe name and enters Domain Name System (DNS) probe configuration mode.

Step 4 

address [ip-address [routed]]

Router(config-slb-probe)# address 10.1.10.1 

(Optional) Configures an IP address to which to send the DNS probe.

Step 5 

faildetect number-of-probes

Router(config-slb-probe)# faildetect 16

(Optional) Specifies the number of consecutive unacknowledged DNS probes that constitute failure of the real server or firewall.

Step 6 

interval seconds

Router(config-slb-probe)# interval 11

(Optional) Configures the DNS probe transmit timers.

Step 7 

lookup ip-address

Router(config-slb-probe)# lookup 10.1.10.1 

(Optional) Configures an IP address of a real server that a DNS server should supply in response to a domain name resolve request.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb probe probe http

Router(config)# ip slb probe PROBE2 http 

Configures the IOS SLB probe name and enters HTTP probe configuration mode.

Step 4 

address [ip-address [routed]]

Router(config-slb-probe)# address 10.1.10.1 

(Optional) Configures an IP address to which to send the HTTP probe.

Step 5 

credentials {username [password]}

Router(config-slb-probe)# credentials Username1 
password

(Optional) Configures header values for the HTTP probe.

Step 6 

expect [status status-code] [regex expression]

Router(config-slb-probe)# expect status 401 regex 
Copyright

(Optional) Configures the expected HTTP status code or regular expression.

Step 7 

header field-name [field-value]

Router(config-slb-probe)# header HeaderName 
HeaderValue 

(Optional) Configures header values for the HTTP probe.

Step 8 

interval seconds

Router(config-slb-probe)# interval 11

(Optional) Configures the HTTP probe transmit timers.

Step 9 

port port

Router(config-slb-probe)# port 8

(Optional) Configures the port to which the HTTP probe is to connect.

Step 10 

request [method {get | post | head | name name}] [url path]

Router(config-slb-probe)# request method post url 
/probe.cgi?all 

(Optional) Configures the URL path to request from the server, and the method used to perform the request to the server.

Step 11 

Configure a route to the virtual server.

HTTP probes require a route to the virtual server. The route is not used, but it must exist to enable the socket code to verify that the destination can be reached, which in turn is essential for HTTP probes to function correctly. The route can be either:

•Host route—Advertised by the virtual server

•Default route—Specified using the ip route 0.0.0.0 0.0.0.0 command, for example

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb probe probe ping

Router(config)# ip slb probe PROBE1 ping 

Configures the IOS SLB probe name and enters ping probe configuration mode.

Step 4 

address [ip-address [routed]]

Router(config-slb-probe)# address 10.1.10.1 

(Optional) Configures an IP address to which to send the ping probe.

Step 5 

faildetect number-of-pings

Router(config-slb-probe)# faildetect 16

(Optional) Specifies the number of consecutive unacknowledged pings that constitute failure of the real server or firewall.

Step 6 

interval seconds

Router(config-slb-probe)# interval 11

(Optional) Configures the ping probe transmit timers.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb probe probe tcp

Router(config)# ip slb probe PROBE5 tcp

Configures the IOS SLB probe name and enters TCP probe configuration mode.

Step 4 

address [ip-address [routed]]

Router(config-slb-probe)# address 10.1.10.1

(Optional) Configures an IP address to which to send the TCP probe.

Step 5 

interval seconds

Router(config-slb-probe)# interval 5

(Optional) Configures the TCP probe transmit timers.

Step 6 

port port

Router(config-slb-probe)# port 8

Configures the port to which the TCP probe is to connect.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb probe probe wsp

Router(config)# ip slb probe PROBE3 wsp 

Configures the IOS SLB probe name and enters Wireless Session Protocol (WSP) probe configuration mode.

Step 4 

address [ip-address [routed]]

Router(config-slb-probe)# address 10.1.10.1 

(Optional) Configures an IP address to which to send the WSP probe.

Step 5 

interval seconds

Router(config-slb-probe)# interval 11

(Optional) Configures the WSP probe transmit timers.

Step 6 

url [path]

Router(config-slb-probe)# url 
http://localhost/test.txt 

(Optional) Configures the WSP probe URL path.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb firewallfarm firewall-farm

or

ip slb serverfarm server-farm

Router(config)# ip slb serverfarm PUBLIC 

or

Router(config)# ip slb firewallfarm FIRE1 

Identifies a firewall farm and enters firewall farm configuration mode.

or

Identifies a server farm and enters SLB server farm configuration mode.

Step 4 

probe probe

Router(config-slb-sfarm)# probe PROBE1

or

Router(config-slb-fw-real)# probe FireProbe 

Associates a probe with a firewall farm or a server farm.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb dfp [password [[encrypt] secret-string [timeout]]

Router(config)# ip slb dfp password Password1 360 

Configures Dynamic Feedback Protocol (DFP), supplies an optional password, and enters DFP configuration mode.

Step 4 

agent ip-address port [timeout [retry-count [retry-interval]]]

Router(config-slb-dfp)# agent 10.1.1.1 2221 30 0 10

Identifies a DFP agent to which IOS SLB can connect.

Step 5 

Configure IOS SLB as a DFP agent.

To configure IOS SLB as a DFP agent, refer to the DFP Agent Subsystem feature document for Cisco IOS Release 12.2(18)SXB.

Step 1 

Configure a server farm and a real server.

See the "How to Configure a Server Farm and a Real Server" section.

When you configure the server farm and real server for GPRS load balancing, keep the following considerations in mind:

•If GTP cause code inspection:

–Is not enabled—Accept the default setting (the weighted round robin algorithm) for the predictor command.

–Is enabled—Specify either the weighted round robin (roundrobin) or the weighted least connections (leastconns) algorithm.

•Specify the IP addresses (virtual template addresses for Cisco GGSNs) of the real servers performing the GGSN function, using the real command.

•Specify a reassign threshold less than the SGSN's N3-REQUESTS counter value using the reassign command.

•To enable dual-stack support for GTP load balancing:

–Specify the real server's IPv6 address using the real command.

Step 2 

Configure a virtual server.

See the "How to Configure a Virtual Server" section.

When you configure the virtual command, keep the following considerations in mind:

•Specify a virtual GGSN IP address as the virtual server, and specify the udp keyword option.

•To load-balance GTP v1 and GTP v2 sessions, specify port number 2123, if the GGSNs and SGSNs are in compliance with the ETSI standard, or specify port number 0 or any to configure an all-port virtual server (that is, a virtual server that accepts flows destined for all ports).

•To load-balance GTP v0 sessions, specify port number 3386, if the GGSNs and SGSNs are in compliance with the ETSI standard, or specify port number 0 or any to configure an all-port virtual server.

•To enable GPRS load balancing:

–Without GTP cause code inspection—Specify the service gtp keyword option.

In GPRS load balancing without GTP cause code inspection enabled, when you configure the idle timer using the idle command, specify an idle timer greater than the longest possible interval between PDP context requests on the SGSN.

–With GTP cause code inspection—Specify the service gtp-inspect keyword option.

•To enable dual-stack support for GTP load balancing:

–Specify the virtual server's IPv6 address and optional IPv6 prefix, using the virtual command.

–Associate the primary IPv6 server farm and optional backup IPv6 server farm with the virtual server, using the serverfarm command.

–Remove the client command from the configuration.

Step 3 

Configure the virtual IP address as a loopback on each of the GGSNs in the servers.

(Required for dispatched mode) This step is required only if you are using dispatched mode without GTP cause code inspection enabled. Refer to the Cisco IOS Interface Configuration Guide "Configuring Virtual Interfaces" section for more information.

Step 4 

Route each GGSN to each associated SGSN.

The route can be static or dynamic, but the GGSN needs to be able to reach the SGSN. Refer to the Cisco IOS Mobile Wireless Configuration Guide "Configuring Network Access to the GGSN" section for more details.

Step 5 

Route each SGSN to the virtual templates on each associated Cisco GGSN, and to the GPRS load-balancing virtual server.

(Required) Refer to the configuration guide for your SGSN for more details.

Step 6 

Configure a GSN idle timer.

(Optional) This step is applicable only if GTP cause code inspection is enabled.

See the "How to Configure a GSN Idle Timer" section for more information.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb timers gtp gsn duration

Router(config)# ip slb timers gtp gsn 45

Change the amount of time IOS SLB maintains sessions to and from an idle gateway GPRS support node (GGSN) or serving GPRS support node (SGSN).

Step 1 

Configure the GGSN to support GGSN-IOS SLB messaging.

When you configure GGSN-IOS SLB messaging support, configure all IOS SLB virtual servers that share the same GGSN to use the same NAT mode, either dispatched mode or directed mode, using the gprs slb mode command. The virtual servers cannot use a mix of dispatched mode and directed mode, because you can configure only one NAT mode on a given GGSN.

For more information, refer to the Cisco IOS Mobile Wireless Configuration Guide for GGSN Release 5.0 for Cisco IOS Release 12.3(2)XU or later.

Step 2 

Configure a server farm and a real server.

See the "How to Configure a Server Farm and a Real Server" section.

When you configure the server farm and real server for GGSN-IOS SLB messaging, to prevent IOS SLB from failing the current real server when reassigning the session to a new real server, disable automatic server failure detection by specifying the no faildetect inband command.

Step 3 

Configure a virtual server.

See the "How to Configure a Virtual Server" section.

When you configure the virtual server for GGSN-IOS SLB messaging, specify the gtp notification cac command to limit the number of times IOS SLB can reassign a session to a new real server.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb map map-id gtp | radius}

Router(config)# ip slb map 1 radius 

Configures an IOS SLB GTP map and enters SLB GTP map configuration mode.

Step 4 

Configures an ASCII regular expression string to be matched against the access point name (APN) for general packet radio service (GPRS) load balancing.

Step 5 

exit

Router(config-slb-map-gtp)# exit

Exits SLB GTP map configuration mode.

Step 6 

ip slb vserver virtual-server

Router(config)# ip slb vserver GGSN_SERVER

Identifies a virtual server and enters virtual server configuration mode.

Step 7 

virtual ipv4-address [ipv4-netmask [group]] [ipv6 ipv6-address [prefix ipv6-prefix]] {tcp | udp} [port | any] [service service]

Router(config-slb-vserver)# virtual 10.10.10.10 udp 0 service gtp

Specifies the virtual server IP address, type of connection, and optional TCP or User Datagram Protocol (UDP) port number, Internet Key Exchange (IKE) or Wireless Session Protocol (WSP) setting, and service coupling.

Note For GPRS load balancing:

–Specify a virtual GGSN IP address as the virtual server, and specify the udp keyword option.

–To load-balance GTP v1 and GTP v2 sessions, specify port number 2123, if the GGSNs and SGSNs are in compliance with the ETSI standard, or specify port number 0 or any to configure an all-port virtual server (that is, a virtual server that accepts flows destined for all ports).

–To load-balance GTP v0 sessions, specify port number 3386, if the GGSNs and SGSNs are in compliance with the ETSI standard, or specify port number 0 or any to configure an all-port virtual server.

–To enable GPRS load balancing without GTP cause code inspection, specify the service gtp keyword option.

–To enable GPRS load balancing with GTP cause code inspection, specify the service gtp-inspect keyword option.

–For dual-stack support for GTP load balancing, specify the virtual server's IPv4 and IPv6 addresses and optional IPv6 prefix.

Step 8 

serverfarm primary-farm [backup backup-farm [sticky]] [ipv6-primary ipv6-primary-farm [ipv6-backup ipv6-backup-farm]] [map map-id priority priority]

Router(config-slb-vserver)# serverfarm farm1 backup 
farm2 map 1 priority 3 

Associates a GTP map with a server farm. Associates a real server farm with a virtual server, and optionally configures a backup server farm and specifies that sticky connections are to be used in the backup server farm.

Note For GPRS load balancing, if a real server is defined in two or more server farms, each server farm must be associated with a different virtual server.

You can associate more than one server farm with a virtual server by configuring more than one serverfarm command, each with a unique map ID and a unique priority. (That is, each map ID and each map priority must be unique across all server farms associated with the virtual server.)

If you are using GTP maps, and you have configured a real server in more than one server farm, you must associate a different virtual server with each server farm.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb capp udp

Router(config)# ip slb capp udp

Enables the KAL-AP agent and enters SLB Content Application Peering Protocol (CAPP) configuration mode.

Step 4 

peer [ip-address] port port

Router(config-slb-capp)# peer port 6000

(Optional) Specifies the port to which the KAL-AP agent is to connect.

Step 5 

peer [ip-address] secret [encrypt] secret-string

Router(config-slb-capp)# peer secret 
SECRET_STRING

(Optional) Enables Message Digest Algorithm Version 5 (MD5) authentication for the KAL-AP agent.

Step 6 

exit

Router(config-slb-map-gtp)# exit

Exits SLB CAPP configuration mode.

Step 7 

ip slb serverfarm server-farm

Router(config)# ip slb serverfarm PUBLIC 

Identifies a server farm and enters SLB server farm configuration mode.

Step 8 

kal-ap domain tag

Router(config-slb-sfarm)# kal-ap domain 
chicago-com

(Optional) Enables the KAL-AP agent to look for a domain tag when reporting the load for a virtual server.

Step 9 

farm-weight setting

Router(config-slb-sfarm)# farm-weight 16

(Optional) Specifies a weight to be used by the KAL-AP agent when calculating the load value for a server farm.

Step 1 

Configure a server farm and a real server.

See the "How to Configure a Server Farm and a Real Server" section.

When you configure the server farm and real server for RADIUS load balancing, keep the following considerations in mind:

•Accept the default setting (the weighted round robin algorithm) for the predictor command.

•(Optional) To enable session-based failure detection, specify a value of 1 for the numclients keyword on the faildetect numconns command.

•(Optional) To specify the maximum number of IOS SLB RADIUS and GTP sticky subscribers that can be assigned to an individual virtual server, use the maxclients command.

Step 2 

Configure a virtual server.

See the "How to Configure a Virtual Server" section.

When you configure the virtual server for RADIUS load balancing, keep the following considerations in mind:

•Specify the service radius keyword option, using the virtual command.

•(Optional) To enable framed-IP routing to inspect the ingress interface, specify the access interface route framed-ip command.

If you configure the access interface route framed-ip command, you must also configure the virtual command with the service radius keywords specified.

•(Optional) To change the amount of time IOS SLB waits for an ACCT-START message from a new mobile IP foreign agent in the event of a foreign agent hand-off, configure a hand-off radius command.

•(Optional) To set a duration for RADIUS entries in the IOS SLB session database, configure an idle command with the radius request keywords specified.

•(Optional) To set a duration for entries in the IOS SLB RADIUS framed-IP sticky database, configure an idle command with the radius framed-ip keywords specified.

Configure a virtual server.
(continued)

•(Optional) To enable IOS SLB to create the IOS SLB RADIUS framed-IP sticky database and direct RADIUS requests and non-RADIUS flows from a subscriber to the same service gateway, specify the sticky command with the radius framed-ip keywords.

If you configure the sticky radius framed-ip command, you must also configure the virtual command with the service radius keywords specified.

•(Optional) To enable IOS SLB to purge entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting On or Off message, specify the purge radius framed-ip acct on-off virtual server configuration command.

To prevent IOS SLB from purging entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting On or Off message, specify the no purge radius framed-ip acct on-off virtual server configuration command.

•(Optional) To enable IOS SLB to purge entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting-Stop message, specify the purge radius framed-ip acct stop virtual server configuration command.

To prevent IOS SLB from purging entries in the IOS SLB RADIUS framed-IP sticky database upon receipt of an Accounting-Stop message, specify the no purge radius framed-ip acct stop virtual server configuration command.

•(Optional—For CDMA2000 networks only) To enable IOS SLB to create the IOS SLB RADIUS calling-station-ID sticky database and direct RADIUS requests from a subscriber to the same service gateway based on the calling station ID, specify the sticky command with the radius calling-station-id keywords.

To enable IOS SLB to create the IOS SLB RADIUS username sticky database and direct RADIUS requests from a subscriber to the same service gateway based on the username, specify the sticky command with the radius username keywords.

If you configure the sticky radius calling-station-id command or the sticky radius username command, you must also configure the virtual command with the service radius keywords specified, and you must configure the sticky radius framed-ip command.

You cannot configure both the sticky radius calling-station-id command and the sticky radius username command on the same virtual server.

•(Optional—For RADIUS load balancing accelerated data plane forwarding only) To configure a VSA correlation group for an authentication virtual server, and to specify whether IOS SLB is to create VSA correlation entries based on RADIUS calling station IDs or RADIUS usernames, configure the radius inject auth command.

To configure a timer for VSA correlation for an authentication virtual server, configure the radius inject auth timer command.

To buffer VSAs for VSA correlation for an authentication virtual server, configure the radius inject auth vsa command.

To configure a VSA correlation group for an accounting virtual server, and to enable Message Digest Algorithm Version 5 (MD5) authentication for VSA correlation, configure the radius inject acct command.

Step 3 

Enable IOS SLB to inspect packets for RADIUS framed-IP sticky routing.

(Optional) See the "How to Enable IOS SLB to Inspect Packets for RADIUS Framed-IP Sticky Routing" section.

Step 4 

Configure RADIUS load balancing maps.

(Optional) See the "How to Configure RADIUS Load Balancing Maps" section.

Step 5 

Configure RADIUS load balancing accelerated data plane forwarding.

(Optional) See the "How to Configure RADIUS Load Balancing Accelerated Data Plane Forwarding" section.

Step 6 

Increase the number of available MLS entries.

(Optional) If you are running IOS SLB in dispatched mode on a Cisco Catalyst 6500 series switch with Cisco Supervisor Engine 2, you can improve performance by configuring the no mls netflow command. This command increases the number of MLS entries available for hardware switching of end-user flows.

Note If you are using IOS features that use the hardware NetFlow table, such as microflow QoS, reflexive ACLs, TCP intercept, or Web Cache Redirect, do not configure the no mls netflow command.

For more information about configuring MLS NetFlow, refer to the Cisco Catalyst 6000 Family IOS Software Configuration Guide.

Step 7 

Configure a probe.

See the "How to Configure a Probe" section.

To verify the health of the server, configure a ping probe.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb route {framed-ip deny | ip-address netmask framed-ip | inter-firewall}

Router(config)# ip slb route 10.10.10.1 
255.255.255.255 framed-ip

Enables IOS SLB to route packets using the RADIUS framed-IP sticky database, or to route packets from one firewall real server back through another firewall real server.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb map map-id radius

Router(config)# ip slb map 1 radius

Configures an IOS SLB RADIUS map and enters SLB RADIUS map configuration mode.

Step 4 

calling-station-id string

Router(config-slb-radius-map)# 
calling-station-id .919*

Configures an ASCII regular expression string to be matched against the calling station ID attribute for RADIUS load balancing.

Step 5 

username string

Router(config-slb-map-radius)# )# username ...?525*

Configures an ASCII regular expression string to be matched against the username attribute for RADIUS load balancing.

Step 6 

exit

Router(config-slb-map-gtp)# exit

Exits SLB RADIUS map configuration mode.

Step 7 

ip slb vserver virtual-server

Router(config)# ip slb vserver GGSN_SERVER

Identifies a virtual server and enters virtual server configuration mode.

Step 8 

virtual ipv4-address [ipv4-netmask [group]] [ipv6 ipv6-address [prefix ipv6-prefix]] {tcp | udp} [port | any] [service service]

Router(config-slb-vserver)# virtual 10.0.0.1 udp 0 service radius

Specifies the virtual server IP address, type of connection, and optional TCP or User Datagram Protocol (UDP) port number, Internet Key Exchange (IKE) or Wireless Session Protocol (WSP) setting, and service coupling.

Note For RADIUS load balancing, specify the service radius keyword option.

Step 9 

serverfarm primary-farm [backup backup-farm [sticky]] [ipv6-primary ipv6-primary-farm [ipv6-backup ipv6-backup-farm ]] [map map-id priority priority]

Router(config-slb-vserver)# serverfarm SF1 backup SF2 
map 1 priority 1 

Associates a RADIUS map with a server farm. Associates a real server farm with a virtual server, and optionally configures a backup server farm and specifies that sticky connections are to be used in the backup server farm.

Note RADIUS load balancing does not support the sticky keyword.

You can associate more than one server farm with a virtual server by configuring more than one serverfarm command, each with a unique map ID and a unique priority. (That is, each map ID and each map priority must be unique across all server farms associated with the virtual server.)

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb serverfarm server-farm

Router(config)# ip slb serverfarm PUBLIC

Identifies a server farm and enters SLB server farm configuration mode.

Step 4 

predictor [roundrobin | leastconns | route-map mapname]

Router(config-slb-sfarm)# predictor route-map map1

(Optional) Specifies the algorithm to be used to determine how a real server is selected.

Turbo RADIUS load balancing requires the route-map keyword and mapname argument.

When you specify the predictor route-map command, no further commands in SLB server farm configuration mode or real server configuration mode are allowed.

Step 5 

exit

Router(config-slb-sfarm)# exit

Exits SLB server farm configuration mode.

Step 6 

ip slb vserver virtual-server

Router(config)# ip slb vserver RADIUS_AUTH

Identifies a virtual server and enters virtual server configuration mode.

Step 7 

virtual ipv4-address [ipv4-netmask [group]] [ipv6 ipv6-address [prefix ipv6-prefix]] {tcp | udp} [port | any] [service service]

Router(config-slb-vserver)# virtual 10.10.10.10 udp 1813 service radius

Specifies the virtual server IP address, type of connection, and optional TCP or User Datagram Protocol (UDP) port number, Internet Key Exchange (IKE) or Wireless Session Protocol (WSP) setting, and service coupling and enters SLB virtual server configuration mode.

Note For RADIUS load balancing, specify the service radius keyword option.

Step 8 

serverfarm primary-farm [backup backup-farm [sticky]] [ipv6-primary ipv6-primary-farm [ipv6-backup ipv6-backup-farm ]] [map map-id priority priority]

Router(config-slb-vserver)# serverfarm AAAFARM 

Associates a RADIUS map with a server farm. Associates a real server farm with a virtual server, and optionally configures a backup server farm and specifies that sticky connections are to be used in the backup server farm.

Note RADIUS load balancing does not support the sticky keyword.

You can associate more than one server farm with a virtual server by configuring more than one serverfarm command, each with a unique map ID and a unique priority. (That is, each map ID and each map priority must be unique across all server farms associated with the virtual server.)

Step 9 

radius acct local-ack key [encrypt] secret-string

Router(config-slb-vserver)# radius acct local-ack key 
SECRET_PASSWORD

(Optional) Configures VSA correlation and enables a RADIUS virtual server to acknowledge RADIUS accounting messages

Note If vendor-specific attribute (VSA) correlation is configured, and if the Cisco VSA is buffered, then the Cisco VSA is injected into the RADIUS Accounting-Start packet. Turbo RADIUS load balancing does not require VSA correlation.

This command is valid only for VSA correlation accounting virtual servers.

Step 10 

radius inject auth group-number {calling-station-id | username}

Router(config-slb-vserver)# radius inject auth 1 
calling-station-id

(Optional) Configures a VSA correlation group for an IOS SLB RADIUS load balancing accelerated data plane forwarding authentication virtual server, and specifies whether IOS SLB is to create VSA correlation entries based on RADIUS calling station IDs or RADIUS usernames.

For a given authentication virtual server, you can configure one radius inject auth group-number calling-station-id command or one radius inject auth group-number username command, but not both.

This command is valid only for VSA correlation authentication virtual servers.

Step 11 

radius inject auth timer seconds

Router(config-slb-vserver)# radius inject auth timer 
45

(Optional) Configures a timer for VSA correlation for an IOS SLB RADIUS load balancing accelerated data plane forwarding authentication virtual server.

This command is valid only for VSA correlation authentication virtual servers.

Step 12 

radius inject auth vsa vendor-id

Router(config-slb-vserver)# radius inject auth vsa 
vendor1

(Optional) Buffers VSAs for VSA correlation for an IOS SLB RADIUS load balancing accelerated data plane forwarding authentication virtual server.

This command is valid only for VSA correlation authentication virtual servers.

Step 1 

Configure a server farm and a real server.

See the "How to Configure a Server Farm and a Real Server" section.

When you configure the server farm and real server for RADIUS for the Exchange Director, keep the following considerations in mind:

•(Optional) Specify a value of 1 for the numclients keyword on the faildetect numconns command, if you want to enable session-based failure detection.

•(Optional) To specify the maximum number of IOS SLB RADIUS and GTP sticky subscribers that can be assigned to an individual virtual server, use the maxclients command.

Step 2 

Configure a virtual server.

See the "How to Configure a Virtual Server" section.

When you configure the virtual server for RADIUS for the Exchange Director, keep the following considerations in mind:

•Specify the service radius keyword option, using the virtual command.

•(Optional) To enable framed-IP routing to inspect the ingress interface, specify the access interface route framed-ip command.

If you configure the access interface route framed-ip command, you must also configure the virtual command with the service radius keywords specified.

•(Optional) To change the amount of time IOS SLB waits for an ACCT-START message from a new Mobile IP foreign agent in the event of a foreign agent hand-off, configure a hand-off radius command.

•(Optional) To set a duration for RADIUS entries in the IOS SLB session database, configure an idle command with the radius request keywords specified.

•(Optional) To set a duration for entries in the IOS SLB RADIUS framed-IP sticky database, configure an idle command with the radius framed-ip keywords specified.

•(Optional) To enable IOS SLB to create the IOS SLB RADIUS framed-IP sticky database and direct RADIUS requests and non-RADIUS flows from a subscriber to the same service gateway, specify the sticky command with the radius framed-ip keywords.

If you configure the sticky radius framed-ip command, you must also configure the virtual command with the service radius keywords specified.

Configure a virtual server.
(continued)

•(Optional—for CDMA2000 networks only) To enable IOS SLB to create the IOS SLB RADIUS calling-station-ID sticky database and direct RADIUS requests from a subscriber to the same service gateway based on the calling station ID, specify the sticky command with the radius calling-station-id keywords.

To enable IOS SLB to create the IOS SLB RADIUS username sticky database and direct RADIUS requests from a subscriber to the same service gateway based on the username, specify the sticky command with the radius username keywords.

If you configure the sticky radius calling-station-id command or the sticky radius username command, you must also configure the virtual command with the service radius keywords specified, and you must configure the sticky radius framed-ip command.

You cannot configure both the sticky radius calling-station-id command and the sticky radius username command on the same virtual server.

Step 3 

Enable IOS SLB to inspect packets for RADIUS framed-IP sticky routing.

(Optional) See the "How to Enable IOS SLB to Inspect Packets for RADIUS Framed-IP Sticky Routing" section.

Step 4 

Configure RADIUS load balancing maps.

(Optional) See the "How to Configure RADIUS Load Balancing Maps" section.

Step 5 

Increase the number of available MLS entries.

(Optional) If you are running IOS SLB in dispatched mode on a Cisco Catalyst 6500 series switch with Cisco Supervisor Engine 2, you can improve performance by configuring the no mls netflow command. This command increases the number of MLS entries available for hardware switching of end-user flows.

Note If you are using IOS features that use the hardware NetFlow table, such as microflow QoS, reflexive ACLs, TCP intercept, or Web Cache Redirect, do not configure the no mls netflow command.

For more information about configuring MLS NetFlow, refer to the Cisco Catalyst 6000 Family IOS Software Configuration Guide.

Step 6 

Configure a probe.

See the "How to Configure a Probe" section.

To verify the health of the server, configure a ping probe.

Step 1 

enable

Router> enable

Enables privileged EXEC mode. If prompted, enter your password.

Step 2 

configure terminal

Router# configure terminal

Enters global configuration mode.

Step 3 

ip slb firewallfarm firewall-farm

Router(config)# ip slb firewallfarm FIRE1

Adds a firewall farm definition to the IOS SLB configuration and enters firewall farm configuration mode.

Step 4 

real ip-address

Router(config-slb-fw)# real 10.1.1.1

Identifies a firewall by IP address as a member of a firewall farm and enters real server configuration mode.

Step 5 

probe probe

Router(config-slb-fw-real)# probe FireProbe 

Associates a probe with the firewall.

Step 6 

weight setting

Router(config-slb-fw-real)# weight 16

(Optional) Specifies the firewall's workload capacity relative to other firewalls in the firewall farm.

Step 7 

inservice

Router(config-slb-fw-real)# inservice

Enables the firewall for use by the firewall farm and by IOS SLB.

Step 8 

exit

Router(config-slb-fw-real)# exit

Exits real server configuration mode.

Step 9 

access [source source-ip netmask] [destination destination-ip netmask]| inbound inbound-interface | outbound outbound-interface]

Router(config-slb-fw)# access destination 10.1.6.0 
255.255.255.0 

(Optional) Routes specific flows to a firewall farm.

Step 10 

predictor hash address [port]

Router(config-slb-fw)# predictor hash address

(Optional) Specifies whether the source and destination TCP or User Datagram Protocol (UDP) port numbers, in addition to the source and destination IP addresses, are to be used when selecting a firewall.

Step 11 

purge connection

Router(config-slb-fw)# purge connection

(Optional) Enables IOS SLB firewall load balancing to send purge requests for connections.

Step 12 

purge sticky

Router(config-slb-fw)# purge sticky

(Optional) Enables IOS SLB firewall load balancing to send purge requests when the sticky idle timer expires.

Step 13 

replicate casa listen-ip remote-ip port [interval] [password [[encrypt] secret-string [timeout]]]

Router(config-slb-fw)# replicate casa 10.10.10.11 
10.10.11.12 4231 

(Optional) Configures a stateful backup of IOS SLB firewall load balancing decision tables to a backup switch.

Step 14 

protocol tcp

Router(config-slb-fw)# protocol tcp

(Optional) Enters firewall farm TCP protocol configuration mode.

Step 15 

delay duration

Router(config-slb-fw-tcp)# delay 30

(Optional) For firewall farm TCP protocol configuration mode, specifies the time IOS SLB firewall load balancing maintains TCP connection context after a connection has ended.

Step 16 

idle duration

Router(config-slb-fw-tcp)# idle 120

(Optional) For firewall farm TCP protocol configuration mode, specifies the minimum time IOS SLB firewall load balancing maintains connection context in the absence of packet activity.

Step 17 

(Optional) For firewall farm TCP protocol configuration mode, specifies the maximum number of active TCP connections allowed on the firewall farm at one time.

Step 18 

sticky seconds [netmask netmask] [source | destination]

Router(config-slb-fw-tcp)# sticky 60 

(Optional) For firewall farm TCP protocol configuration mode, specifies that connections from the same IP address use the same firewall if either of the following conditions is met:

•As long as any connection between the same pair of IP addresses exists (source and destination sticky).

•For a period, defined by duration, after the last connection is destroyed.

Step 19 

exit

Router(config-slb-fw-tcp)# exit

Exits firewall farm TCP protocol configuration mode.

Step 20 

protocol datagram

Router(config-slb-fw)# protocol datagram

(Optional) Enters firewall farm datagram protocol configuration mode.

Step 21 

idle duration

Router(config-slb-fw-udp)# idle 120

(Optional) For firewall farm datagram protocol configuration mode, specifies the minimum time IOS SLB firewall load balancing maintains connection context in the absence of packet activity.

Step 22 

(Optional) For firewall farm datagram protocol configuration mode, specifies the maximum number of active datagram connections allowed on the firewall farm at one time.

Step 23 

sticky seconds [netmask netmask] [source | destination]

Router(config-slb-fw-udp)# sticky 60

(Optional) For firewall farm datagram protocol configuration mode, specifies that connections from the same IP address use the same firewall if either of the following conditions is met:

•As long as any connection between the same pair of IP addresses exists (source and destination sticky).

•For a period, defined by duration, after the last connection is destroyed.

Step 24 

exit

Router(config-slb-fw-udp)# exit

Exits firewall farm datagram protocol configuration mode.

Step 25 

inservice

Router(config-slb-fw)# inservice

Enables the firewall farm for use by IOS SLB.

Step 1 

Configure a server farm and a real server.

See the "How to Configure a Server Farm and a Real Server" section.

When you configure the server farm and real server for VPN server load balancing, specify the IP addresses of the real servers acting as VPN terminators using the real command.

Step 2 

Configure a virtual server.

See the "How to Configure a Virtual Server" section.

When you configure the virtual server for VPN server load balancing of IPSec flows, keep the following considerations in mind:

•Configure a UDP virtual server using the virtual command with the protocol set to udp and the port set to isakmp. The isakmp keyword enables the cryptographic key exchange to occur through IKE (port 500).

•Configure an ESP virtual server using the virtual command with the protocol set to esp.

•Specify a sticky connection from the UDP virtual server to the ESP virtual server, and vice versa, using the sticky command with a duration of at least 15 seconds.

When you configure the virtual server for VPN server load balancing of Point-to-Point Tunneling Protocol (PPTP) flows, keep the following considerations in mind:

•Configure a TCP virtual server, using the virtual command with the tcp keyword and port number 1723 specified.

•Configure a GRE virtual server, using the virtual command with the gre keyword specified.

•Specify a sticky connection from the TCP virtual server to the GRE virtual server, and vice versa, using the sticky command with a duration of at least 15 seconds.

Step 3 

Configure a probe.

See the "How to Configure a Probe" section.

To verify the health of the server, configure a ping probe.