F5三角传输-nPath路由配置步骤-孟祥坤

如何配置nPath路由

（v110422）

作者 孟祥坤 审核

分类 F5 子类F5 BIG‐IP Family

更新时间 2011‐4‐22

关键字 配置 nPath 路由 步骤

摘要 详解介绍配置nPath路由的步骤，保留配置Fast L4 Profile、pool、virtual Server、网等内容，并且最后列举各种系统的loopback地址设置方法。

主要适用环境 BIG-IP LTM

?10.0.1, 10.0.0 BIG-IP ASM

?10.0.1, 10.0.0 BIG-IP PSM

?10.0.1, 10.0.0 BIG-IP WAN Optimization

?10.0.1, 10.0.0

《如何配置nPath路由》 第 1页 共18页

版本说明

版本号拟制/修改责任人拟制/修改日期修改内容/理由

V110422 孟祥坤 2011‐4‐22 新建

版权声明

文档名称：nPath路由配置

作者意图：用作技术交流

版权所有，保留一切权利

非经作者授权，任何单位和个人不得擅自摘抄、复制本文的部分或全部用来作为商业目的；作者保留追究责任的权利。

《如何配置nPath路由》 第 2页 共18页

目 录

1 nPath路由介绍 (4)

2 配置nPath路由过程 (5)

2.1 创建Fast L4 profile (6)

2.2 创建一个Pool (7)

2.3创建一个Virtual Server (7)

3 为后台Server配置loopback地址 (9)

4 为入向流量配置路由 (9)

5 启用connection.autolasthop key (10)

6 为nPath配置设置连接超时计时器 (10)

6.1 UDP流量的连接超时计时器配置原则 (10)

6.2 TCP流量的连接超时计时器配置原则 (10)

附录 各种常用系统的loopback地址设置方法 (11)

《如何配置nPath路由》 第 3页 共18页

1 nPath路由介绍

设置nPath路由配置以后，内部服务器流量返回的时候绕过BIG-IP直接路由到外面，也就是说通过BIG-IP的流量到达后台Server之后，返回的流量无需经过BIG-IP而是直接返回至下一跳路由。这种流量管理方法由于无需将返回流量传输到BIG-IP，进而增加了出向的吞吐量。其示意图如下（图1）：

图 1 nPath路由图示

___________________________________________________________________________

备注：入向流量的Virtual Server必须是transparent类型，而不能translation类型。

____________________________________________________________________________________

nPath路由配置中，流量的返回路径绕过了BIG-IP，这个和典型的load-balancing配置有本质的区别；在典型的load-balancing配置中，入向的流量到达某个virtual Server之后被分发到后台的Server上去，而这台Server的IP返回时将作为源地址经过BIG-IP设备之后被转换成virtual Server 地址，然后返给真正的客户端。

____________________________________________________________________________________

备注：对于Layer 7流量来说，不要尝试使用nPath路由，否则特定的返回流量绕过BIG-IP之后将不正常。比如，HTTP相应压缩特征。

____________________________________________________________________________________ 《如何配置nPath路由》 第 4页 共18页

2 配置nPath路由过程

nPath路由配置和标准的BIG-IP负载均衡配置是不一样的，区别如下：

■后台服务器的网关指向10.1.1.1，而不是BIG-IP的地址10.1.1.10，保证返回的流量绕过BIG-IP；

■如果打算为TCP流量配置nPath路由，那么必须配置一个满足下面参数条件的Fast L4 profile。

◆启用Loose Close设置：看到Fin信号之后，更快的释放TCP协议流。

◆设置TCP Close Timeout：期望half closes的话，设置成和profile中idle timeout一样

的数值，否则保持默认数值5秒。

■ 由于Virtual Server中关闭了address translation和port translation功能，入向的数据包抵达pool member之后被发到了Virtual Server地址（172.16.1.1）而不是到达后台服务器地址（10.1.1.11或者10.1.1.12），那么Virtual Server地址必须配置在后台服务器的loopback接口以便正常回应客户端。

要想使用BIG-IP nPath路由功能，需要完成下面任务：

■创建Fast L4 profile；

■创建一个Pool；

■创建一个Virtual Server，并且引用Fast L4 profile；

■配置后台服务器的loopback接口地址；

■配置后台服务器的默认网关；

■启用connection.autolasthop。

_____________________________________________________________________________

备注：下面的配置都是通过Web界面配置完成，配置时请首先登录Web界面

________________________________________________________________________________

《如何配置nPath路由》 第 5页 共18页

2.1 创建Fast L4 profile

登录Web界面，依次点击Local Traffic->Profiles，然后点击页面上方的“Protocol”按钮并且选择“Fast L4”，接着点击右上角的“Create”按钮，按照下面配置：

其中，“Loose Close”参数必须打勾；TCP Close Timeout的默认数值是5，具体怎么改请看本文最后一部分。

《如何配置nPath路由》 第 6页 共18页

2.2 创建一个Pool

在主导航菜单，依次点击Local Traffic->Pools，然后点击页面右上角的“Create”按钮，配置如下：

2.3创建一个Virtual Server

完成Fast L4 profile和pool的配置之后，我们开始配置Virtual Server。

依次点击Local Traffic->Virtual Servers，然后点击页面右上角的“Create”按钮，参考配置如下：

《如何配置nPath路由》 第 7页 共18页

《如何配置nPath路由》 第 8页 共18页

其中，Type必须选择Performance （Layer 4）；Protocol选择TCP、UDP或者“All Protocol”；Protocol profile （client）选择定制的my_fastL4;Address Translation和Port Translation的对勾必须清掉。

3 为后台Server配置loopback地址

必须将上面配置的virtual Server地址作为后台服务器的loopback接口地址。

UNIX系统一般还有一个lo0的loopback接口，而Microsoft也有一个MS loopback接口地址。

Loopback接口地址是必须配置的，因为它参与ARP广播协议。

各种常用系统的loopback地址设置办法，请参考附录内容。

4 为入向流量配置路由

对入向的流量来说，必须配置一条路由使之通过BIG-IP系统的self IP抵达Virtual Server。在上面的案例中，172.16.1.1必须通过10.1.1.10这个下一跳地址到达BIG-IP。

____________________________________________________________________________________

备注：只有当Virtual Server和self IP处在不同网段时，才需要添加路由。

____________________________________________________________________________________《如何配置nPath路由》 第 9页 共18页

5 启用connection.autolasthop key

为了保证nPath路由正常工作，必须保证connection.autolasthop被设置成enable状态，不管是IPV4还是IPV6,比如：

6 为nPath配置设置连接超时计时器

一旦配置了nPath路由，BIG-IP只能看到来自客户端的请求。因此BIG-IP的连接超时计时器只能对客户端发起的连接起到作用，而对后台服务器的回应无能为力。这意味着对于一个nPath连接来说，timeout至少应该是客户端请求时间和服务器回应时间的两者之和。

下面详细介绍对于UDP和TCP流量的超时计时器设置原则。

6. 6.1 UDP流量的连接超时计时器配置原则

如果对UDP流量配置了nPath路由，那么BIG-IP将跟踪来自同一客户端、到达同一个目的地址和目的端口的数据，并且作为一个“连接”。也就是说，必须保证一个会话的所有连接都要发送到同一台服务器上去。由于UDP是一种无连接的协议，那么我们可以将这种情形下的UDP连接看作一种会话的保持。为了确定一个精确的连接timeout，可以参考BIG-IP发送之前客户端发送的请求的最长时间。在一些情况下，可能在几分钟之内，客户端回应之前，后台服务器发出几百个数据包。

2 TCP流量的连接超时计时器配置原则

如果对TCP流量配置了nPath路由，BIG-IP只能看到来自客户端的请求。例如，在三次握手过程中，BIG-IP只能看到来自客户端到服务器的SYN和ACK，而不能看到SYN-ACK。那么，连接的timeout 应该尽量接近客户端和服务器端的TCP 重传（RTO）时间之和，确保所有的连接都是成功的。在UNIX和Windows系统上，最大的初始RTO时间大约25秒，因此，timeout设置为51秒可以面对最糟糕的情况。一旦一个TCP连接建立，其连接timeout是动态刷新的，那么客户端和服务器端的timeout将小于这个数值。客户端只有处在缓慢、丢包的网络环境中，才有必要设置一个更大数值的TCP timeout时间。

《如何配置nPath路由》 第 10页 共18页

附录 各种常用系统的loopback地址设置方法

1、AIX系统

For loopback on the AIX operating system, the command syntax is:

ifconfig lo0 alias < Virtual IP> netmask

This command sets the first alias of the loopback interface “lo0” to have

the same IP address as the IP address of the Virtual IP (VIP).

For the example network shown in 图1, the command is:

Ifconfig lo0 alias 172.16.1.1 netmask 255.25.255.0

This command should be executed on all Servers.

Note: Resetting the Server erases the configuration. Therefore, the

command should be inserted in a boot-up script, so that each time the

Server is reset, the loopback alias is automatically configured.

2、HP-UX系统

For loopback on the HP-UX operating system, the command syntax is:

Ifconfig lo0 < Virtual IP>

This command sets the alias of the loopback interface “lo0” to have the

same IP address as the IP address of the Virtual IP (VIP).

For the example network shown in 图1, the command is:

Ifconfig lo0 172.16.1.1

This command should be executed on all Servers.

《如何配置nPath路由》 第 11页 共18页

Note: Resetting the Server erases the configuration. Therefore, the

command should be inserted in a boot-up script, so that each time the

Server is reset, the loopback alias is automatically configured.

3、Linux系统

For loopback on the Linux operating system, the command syntax is:

Ifconfig lo:1 < Virtual IP> netmask up

This command sets the first alias of the loopback interface "lo" to have

the same IP address as the IP address of the Virtual IP (VIP).

The proper network mask is also included in the command.

For the example network shown in 图1, (assuming standard

class A masks), the command is:

Ifconfig lo:1 172.16.1.1 netmask 255.255.255.0 up

Various Linux operating systems, for example, RedHat Linux

Enterprise 3.0, may require that the network mask be 255.255.255.255.

This command should be executed on all Servers.The loopback

configuration is activated by the Server reset.

To configure loopback in RedHat Linux Enterprise 3.0 (kernel 2.1 and above): 1. To gain administrative access, the command is:

su to root

2. Edit /etc/rc.d/rc.local and add the following lines to the

end of the file:

/sbin/sysctl -w net.ipv4.conf.all.hidden=1

《如何配置nPath路由》 第 12页 共18页

This runs the kernel commands across reboots and enables the

kernel configuration of all hidden network devices needed to

configure the loopback interface properties.

/sbin/sysctl -w net.ipv4.conf.lo.hidden=1

This hides the loopback device, to stop the loopback from

answering ARP queries.

3. To access startup scripts, the command is:

Note: Resetting the Server erases the configuration. Therefore, the

command should be inserted in a boot-up script, so that each time the

Server is reset, the loopback alias is automatically configured.

cd /etc/sysconfig/network-scripts

This is where the network startup scripts are stored.

4. To copy the generic loopback interface configuration template to a

loopback interface instance lo:1, the command is:

cp ifcfg-lo ifcfg-lo:1

5. Edit the file: ifcfg-lo:1 and make the necessary changes to

the IP address, network mask, network and broadcast addresses.

6. To activate the changes to the kernel without rebooting, the

command is:

sysctl -p

A patch has to be installed on the Linux Server to prevent the loopback

interface from replying to ARP requests. For more information, see

http://www.ssi.bg/~ja/#hidden.

Note: The Network mask must be set to: /32 (255.255.255.255). The device must be set to lo:1 (lo:1 is 《如何配置nPath路由》 第 13页 共18页

used as an example, it could lo:x, x=1...n)

4、Solaris系统

For loopback on the Sun Solaris operating system, the command syntax is:

Ifconfig lo0:1 < Virtual IP> 127.0.0.1 up

This command sets the alias of the loopback interface “lo0” to have the

same IP address as the IP address of the Virtual IP (VIP).

For the example network shown in 图1, the command is:

Ifconfig lo0:1 172.16.1.1 127.0.0.1 up

This command should be executed on all Servers.

Note: Resetting the Server erases the configuration. Therefore, the

command should be inserted in a boot-up script, so that each time the

Server is reset, the loopback alias is automatically configured.

5、Windows NT系统

Loopback in Windows NT Configuration Guidelines

1. Add a new a loopback adapter.

2. Configure the loopback adapter with the appropriate IP address.

3. Reset the Server.

4. Check the Server’s routing table and make adjustments if necessary.

5. Create a batch file or service to ensure that the necessary adjustments are made after every Server reset.These steps are detailed in the procedure below.

To add and configure a loopback adapter in Windows NT:

1. Right-click Network Neighborhood and select Properties.

Alternatively, you can get to network properties by choosing

《如何配置nPath路由》 第 14页 共18页

Network from the Control Panel.

2. In the Network window, click Adapters.

3. In the Adapters pane, click Add. The list of available adapters appears.

4. From the Adapters list, select MS Loopback Adapter.

5. Click Ok. The MS Loopback Adapter Setup dialog box appears.

6. From the Frame Type dropdown list, select 802.3. You are

prompted to provide the NT disk or the NT source files.

7. Choose the location and continue.

8. After the loopback adapter has been properly installed, click

Close. The Network Properties window closes. The NT prompts

you to configure the loopback adapter with an IP address by

displaying the Microsoft TCP/IP Properties dialog box.

Note: Your NT Server may automatically know where the source

files are and skip this section.

9. In the Microsoft TCP/IP Properties dialog box, choose the

loopback adapter.

10. Configure the Loopback IP. This should be the same as the

Virtual IP Address. Configure an appropriate mask,

but do NOT configure a default gateway.

11. Click Ok. NT completes the configuration, and then prompts you

to reset the Server.

12. Reset the Server. Once it has rebooted, log in and go to a

command prompt (DOS prompt).

13. Adjust the IP Routing Table, as described on page B-11.

《如何配置nPath路由》 第 15页 共18页

Deleting Unnecessary Routes

After you add and configure the loopback adapter, it is likely that the

Server’s IP Routing Table contains one or more unnecessary routes

that must be deleted. These are the non-multicast/broadcast routes

that have the same gateway address as the IP address of the loopback

interface.

You can identify extraneous routes in the Server’s IP Routing Table,

which you can access using the route print command. These

routes usually appear in pairs (for the same destination network,

usually the Server’s local network). One route points to the Server’s

physical IP address, while the other route points to the loopback IP

address. These duplicate entries pointing to the loopback IP address

as the gateway must be removed, otherwise the Local Triangulation

mode may not function properly.

Note: The loopback configuration is activated by the Server reset.

To adjust the Routing Table following loopback configuration:

To remove the table entry for extraneous route, use this command:

route delete mask

where is the same as the loopback interface.

If the above command is unsuccessful, use this command:

Route delete

This removes both table entries. The appropriate entry must be readded

using the following command:

route add mask

《如何配置nPath路由》 第 16页 共18页

For further assistance, please contact the Radware Technical Support.

Note: Resetting the Server erases the Routing Table changes.

Therefore, a batch file or service should be installed to ensure these

changes are re-applied after a reset. To operate the batch file as a

service, use the NT resource kit.

6、Windows 2000系统

For loopback configurations on Window 2000, you need to install the

Microsoft Loopback Adaptor.

To install the Microsoft Loopback Adaptor:

1. From the Windows Start Menu, select Start > Settings > Control Panel. The Control Panel window appears.

2. In the Control Panel window, select Add/Remove Hardware. The Add/Remove Hardware Wizard appears.

3. In the Welcome to Add/Remove Hardware Wizard window, click

Next. The Choose a Hardware Task window appears.

4. In the Choose a Hardware Task window, select Add/

Troubleshoot a device and click Next. The New Hardware

Detection window appears.

5. Wait until Windows is searching for new hardware to install. The

Choose a Hardware Device window appears.

6. From the Add a new device list, select

Network Adapter > Microsoft > Microsoft Loopback Adapter.

7. In the Loopback IP address text box, type the Virtual IP address of

the farm and click Next. The Completing the Add/

Remove Hardware Wizard window appears.

《如何配置nPath路由》 第 17页 共18页

8. To complete the process, click Finish.

Note: You have to create a loopback interface with an Interface

Metric higher than the metric for the physical interfaces. To set this

metric click: Advanced TCP/IP Settings > IP Settings.

孟祥坤 【Dollar，豆捞儿】

QQ：94205648

MSN：xiangkunmeng@https://www.360docs.net/doc/6f16394211.html,

《如何配置nPath路由》 第 18页 共18页