F5负载均衡设备组网架构,F5负载均衡设备组网架构,单臂接入模式,双臂接入模式,远程节点模式,加入独立SSL/WA/ASM设备,防火墙负载均衡,多链路接入,灾备站点静态路由注入,Agenda,单臂接入模式Agenda,LTM单臂接入模式,LTM单臂接入模式,单臂接入模式下的网络物理结构,核心三层交换,服务器,服务器,LTM,LTM,Vlan 1,串口心跳线,单臂接入模式下的网络物理结构核心三层交换服务器服务器LTML,LTM单臂源地址替换接入典型架构设计,Core Switch,Core Switch,Server,Server,网络同步-独立Vlan,串口心跳,Network,IP:192.168.0.1,GW:192.168.0.254,IP:192.168.0.2,GW:192.168.0.254,SelfIP:192.168.0.200,GW:192.168.0.254,VS:192.168.0.100,SNAT Automap,SelfIP:192.168.0.201,GW:192.168.0.254,VS:192.168.0.100,SNAT Automap,HSRP 192.168.0.254,Trunk,Trunk,Trunk,Active,Backup,LTM单臂源地址替换接入典型架构设计Core SwitchC,单臂接入-源地址替换模式数据访问流程,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.1.10,GW:192.168.1.254,192.168.1.11,GW:192.168.1.254,VS:192.168.1.1:80,SelfIP:192.168.1.253,GW:192.168.1.254,192.168.1.254,192.168.0.254,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.1,80,192.168.1.253,8888,192.168.1.11,80,192.168.1.11,80,192.168.1.253,8888,192.168.1.1,80,192.168.0.1,6787,单臂接入-源地址替换模式数据访问流程核心三层交换服务器服务器,源地址替换后的处理,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.1.10,GW:192.168.1.254,192.168.1.11,GW:192.168.1.254,VS:192.168.1.1：80,SelfIP:192.168.1.253,GW:192.168.1.254,192.168.1.254,192.168.0.254,HTTP Profile,when HTTP_REQUEST,HTTP:header insert Client_IP=IP:client_addr,iRules,只有HTTP协议的时候，可以通过将源地址插入到客户端请求的HTTP Header里，然后在服务器上通过读取这个Header，获得客户端的真实源IP地址,源地址替换后的处理核心三层交换服务器服务器LTMClient,单臂接入-npath模式数据访问流程,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.1.10,Lo:192.168.1.1,GW:192.168.1.254,192.168.1.11,Lo:192.168.1.1,GW:192.168.1.254,VS:192.168.1.1:80,SelfIP:192.168.1.253,GW:192.168.1.254,192.168.1.254,192.168.0.254,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,192.168.1.1,80,192.168.1.1,80,192.168.0.1,6787,npath模式的关键在于服务器上配置的loopback地址,在上能找到各种服务器的loopback地址如何配置的文档,单臂接入-npath模式数据访问流程核心三层交换服务器服务器,单臂接入-服务器非直连模式（无源地址替换）,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.2.10,GW:192.168.2.254,192.168.2.11,GW:192.168.2.254,VS:192.168.1.1:80,SelfIP:192.168.1.253,GW:192.168.1.254,192.168.2.254,192.168.0.254,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,192.168.2.11,80,192.168.2.11,80,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,无源地址替换的单臂接入模式使用比较少，通常用于对现网不能改造的情况,这种模式下需要在核心三层交换上启用源地址路由，将服务器的所有返回数据包转向LTM，这样才能保证进出的连接完整性,建议在这种结构下采用源地址替换以减小网络复杂程度,192.168.1.254,单臂接入-服务器非直连模式（无源地址替换）核心三层交换服务器,同网段访问处理-必须通过SNAT实现,核心三层交换,客户端,服务器,LTM,192.168.1.10,GW:192.168.1.254,192.168.1.11,GW:192.168.1.254,VS:192.168.1.1：80,IP:192.168.1.253,GW:192.168.1.254,192.168.1.254,SIP,Sport,DIP,Dport,192.168.0.10,6787,192.168.1.1,80,192.168.1.253,8888,192.168.1.11,80,192.168.1.11,80,192.168.1.253,8888,192.168.1.1,80,192.168.0.1,6787,同网段访问处理-必须通过SNAT实现核心三层交换客户端服务器,单臂接入-服务器更改网关数据访问流程,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.1.10,GW:192.168.1.253,192.168.1.11,GW:192.168.1.253,VS:192.168.1.1:80,SelfIP:192.168.1.253,GW:192.168.1.254,192.168.1.254,192.168.0.254,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,192.168.1.11,80,192.168.1.11,80,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,单臂接入-服务器更改网关数据访问流程核心三层交换服务器服务器,服务器更改网关后的直接访问服务器问题,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.1.10,GW:192.168.1.253,192.168.1.11,GW:192.168.1.253,VS:192.168.1.1：80,IP:192.168.1.253,GW:192.168.1.254,192.168.1.254,192.168.0.254,SYN,SYN,SYN-ACK,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.11,80,192.168.1.11,80,192.168.0.1,6787,FastL4 Profile,服务器更改网关后的直接访问服务器问题核心三层交换服务器服务器,双臂接入模式,双臂接入模式,LTM双臂接入模式典型架构设计,VLAN EXT,Server,Server,网络同步-独立Vlan,串口心跳,Network,IP:192.168.0.3,GW:192.168.0.254,IP:192.168.0.4,GW:192.168.0.254,SelfIP EXT:192.168.1.200,SelfIP INT:192.168.0.200,GW:192.168.1.254,VS:192.168.1.100,HSRP 192.168.0.254,Active,Backup,VLAN INT,VLAN EXT,VLAN INT,SelfIP EXT:192.168.1.200,SelfIP INT:192.168.0.200,GW:192.168.1.254,VS:192.168.1.100,FIP:192.168.0.254,LB Server,IP:192.168.0.1,GW:192.168.0.250,LB Server,IP:192.168.0.2,GW:192.168.0.250,FIP:192.168.0.254,HSRP 192.168.1.254,LTM双臂接入模式典型架构设计VLAN EXTServerS,双臂接入-服务器直连,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.2.10,GW:192.168.2.254,192.168.2.11,GW:192.168.2.254,VS:192.168.1.1,EXTIP:192.168.1.253/VLAN EXT,INTIP:192.168.2.254/VLAN INT,GW:192.168.1.254,192.168.1.254,192.168.0.254,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,192.168.2.11,80,192.168.2.11,80,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,双臂接入-服务器直连核心三层交换服务器服务器LTMClien,双臂接入-串联部署-扩展端口,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.2.10,GW:192.168.2.254,192.168.2.11,GW:192.168.2.254,VS:192.168.1.1,EXTIP:192.168.1.253/VLAN EXT,INTIP:192.168.2.254/VLAN INT,GW:192.168.1.254,192.168.1.254,192.168.0.254,服务器接入交换,SIP,Sport,DIP,Dport,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,192.168.2.11,80,192.168.2.11,80,192.168.0.1,6787,192.168.1.1,80,192.168.0.1,6787,双臂接入-串联部署-扩展端口核心三层交换服务器服务器LTMC,双臂接入-旁挂模式,核心三层交换,服务器,服务器,LTM,Client,192.168.0.1,192.168.2.10,GW:192.168.2.254,192.168.2.11,GW:192.168.2.254,VS:192.168.1.1:80,EXTIP:192.168.1.253/VLAN EXT,INTIP:192.168.2.254/VLAN INT,GW:192.168.1.254,192.168.1.254,192.168.0.254,SIP,Sport,DIP,Dport,192.168.0.1,6