F5_负载均衡关键技术.ppt

单击此处编辑母版标题样式,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,*,单击此处编辑母版标题样式,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,*,信诺瑞得信息技术有限公司,销售经理,技术工程师 隆真,F5,负载均衡关键技术,负载均衡关键技术,负载均衡算法,服务器健康检查,会话保持技术,HTTP,流量压缩,连接优化技术,带宽管理,BIG-IP,工作原理,Clients,BIG-IP Controller,Servers,Internet,192.168.0.1:80,192.168.0.2:8080,192.168.0.3:8100,192.168.0.4:8000,10.10.10.10,：,80,BIG-IP,负载均衡算法,Round Robin(,轮巡,),Ratio(,比率,),Priority(,优先权,),Least Connections(,最小连接数,),Fastest(,最快响应速度,),Observed(,观察模式,),Predictive(,预测模式,),智能算法,UIE+Irules,静态,动态,Round Robin,Clients,Router,BIG-IP Controller,Servers,Client requests are distributed evenly,1,2,3,4,5,6,7,8,Internet,Ratio,Clients,Router,BIG-IP Controller,Servers,Administrator sets ratio for distributing Client requests 3:1:1:1,1,2,3,4,7,8,9,10,Internet,5,6,11,12,Fastest,Clients,Router,BIG-IP Controller,Servers,Next requests go to Node with shortest response time,1,2,Internet,10ms,5ms,20ms,17ms,Current Response Times,Fastest some time later,Clients,Router,BIG-IP Controller,Servers,Next requests go to Node with shortest response time,101,102,Internet,14ms,15ms,20ms,11ms,Current Response Times,Least,Clients,Router,BIG-IP Controller,Servers,1,2,Internet,Next requests goes to Node with fewest number of connections,462,460,455,465,Current Connections,Least some time later,Clients,Router,BIG-IP Controller,Servers,Internet,Next requests goes to Node with fewest number of connections,61,62,342,330,338,335,Current Connections,Observed,Clients,Router,BIG-IP Controller,Servers,Next requests goes to Node with combination of fewest connections and best response,1,2,Internet,Predictive,Clients,Router,BIG-IP Controller,Servers,1,2,Internet,Next requests goes to Node with combination of fewest connections and best response,over time,Minimum Active Members,Clients,Router,BIG-IP Controller,Servers,1,3,5,2,4,6,Internet,Priority 1,Priority 2,If Minimum Active Members is 2,and 3 of the highest priority nodes are available,then lower priority nodes will not be used.,Minimum Active Members,Clients,Router,BIG-IP Controller,Servers,1,5,Internet,Priority 1,Priority 2,3,2,4,6,7,8,If number of nodes falls below the Minimum Active Members(2),then the next highest priority nodes are used also.,Fallback Host,Clients,Router,BIG-IP Controller,Servers,Internet,If all nodes fail,then client is sent an http redirect to the“fallback”server.,Apologize Server,服务器负载均衡关键技术,负载均衡算法,服务器健康检查,会话保持技术,HTTP,流量压缩,连接优化技术,带宽管理,服务器健康检查,Internet,172.16.20.3:80,BIG-IP,服务器健康检查,ICMP,TCP Service,ECV(Extend Content Verify),EAV(Extend Application Verify),External,主机检查,Steps,Packets sent to IP Addresses,If no response,then no traffic sent to associated Nodes,Example-ICMP,Internet,192.168.20.1,192.168.20.2,192.168.20.3,ICMP,服务检查,Steps,Opens TCP connection(IP Address:service),Connection closed,If TCP connection fails,then no traffic sent to associated Nodes,Example TCP,Internet,192.168.20.1:80,192.168.20.2:80,192.168.20.3:80,TCP Connection,内容检查,Internet,192.168.20.1:80,192.168.20.2:80,192.168.20.3:80,Steps,Opens TCP connection(IP Address:service),Sends a request,Response returns data,Connection closed,If Receive Rule not found in data,then no traffic sent to associated Nodes,Example http,http GET/,交互的应用检查,Internet,192.168.20.1:80,192.168.20.2:80,192.168.20.3:80,Steps,Opens TCP connection(IP Address:service),Interactive conversation to simulate real-world,Connection closed,If expected results do not occur,then no traffic sent to associated Nodes,Example SQL request,conversation,健康检查模版,ICMP Monitor,FTP Monitor,WAP Monitor,POP3 Monitor,Gateway ICMP Monitor,SIP Monitor,IMAP Monitor,RADIUS Monitor,TCP Monitor,SMTP Monitor,LDAP Monitor,RDP Monitor,TCP Echo Monitor,SNMP Monitor,LDAP over SSL Monitor,RealN,Monitor,UDP Monitor,Soap Monitor,Microsoft SQL Monitor,Oracle Monitor,HTTP Monitors,HTTPS Monitor,NNTP Monitor,WMI Monitor,EAV Monitor,Reverse Keyword Monitor,Transparent Device Monitor,Monitor Scripting,Composite Monitors(this is an M of N monitor rule),External Service Check,#!/bin/,sh,#these arguments supplied automatically for all external,pingers,:,#$1=IP(,nnn.nnn.nnn.nnn,notation or hostname),#$2=port(decimal,host byte order),#$3 and higher=additional arguments,#,#In this sample script,$3 is the regular expression,#,pidfile,=/var/run/pinger.$1.$2.pid,if -f$,pidfile,then,kill-9 cat$,pidfile,/dev/null 2&1,fi,echo$pidfile,node_ip=echo$1|sed s/:ffff:/,#echo GET/|/usr/bin/nc$node_ip$2 2/dev/null|grep-E-i$3 /dev/null,/usr/bin/curl-m 3 $node_ip:$2$3 2/dev/null|grep$4 /dev/null,status=$?,if$status-,eq,0,then,echo up,fi,rm,-f$,pidfile,对于,BIG-IP,内置没有提供健康检查方法的应用，可以通过编写脚本的方式来定制相应的健康检查方法。例如对某一特定的中间件服务器可以通过编写以下的脚本来实现对应用的检查：,服务器负载均衡关键技术,负载均衡算法,服务器健康检查,会话保持技术,HTTP,流量压缩,连接优化技术,带宽管理,Persistence Concepts,Subsequent connections from a user sent to same server load balancing modes superceded,1,2,3,1,2,3,User name,Password,User name,Password,BIG-IP,会话保持,(Session Persistence),Simple Persistence,Destination Persistence,SSL Persistence,Cookie Persistence(Insert,Rewrite,Passive&Hash),MSRDP Persistence,SIP Persistence,Universal Persistence,Simple Persistence,Based on Source IP Address,Assumes no change in IP Address,Netmask,Address Range Treated as Single Source,SSL Persistence,Based on SSL Session ID,Remains Constant When Client IP Address Changes,Persistence Lost if Browser Changes SSL Session ID,Cookie Persistence,Insert mode,BIG-IP Inserts a cookie into the stream,Rewrite mode,Host creates cookie and BIG-IP Controller changes it,Passive mode,Host creates cookie and BIG-IP Controller Reads it,Hash mode,Maps a cookie value to a specific node,Web server must generate a cookie,Client,Server,HTTP request(no cookie),TCP handshake,TCP handshake,HTTP request(no cookie),HTTP reply(no cookie),HTTP reply(with inserted cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(no cookie),HTTP reply(updated cookie),cookiespecifiesserver,First Hit,Second Hit,Cookie Insert Mode,Client,Server,HTTP request(no cookie),TCP handshake,TCP handshake,HTTP request(no cookie),HTTP reply(with blank cookie),HTTP reply(with rewritten cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(with blank cookie),HTTP reply(with updated cookie),cookiespecifiesserver,First Hit,Second Hit,Cookie Rewrite Mode,Client,Server,HTTP request(no cookie),TCP handshake,TCP handshake,HTTP request(no cookie),HTTP reply(with special cookie),HTTP reply(with special cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(with special cookie),HTTP reply(with special cookie),cookiespecifiesserver,First Hit,Second Hit,Cookie Passive Mode,Client,Server,HTTP request(no cookie),TCP handshake,TCP handshake,HTTP request(no cookie),HTTP reply(with cookie),HTTP reply(with cookie),pickserver,HTTP request(with same cookie),TCP handshake,TCP handshake,HTTP request(with same cookie),HTTP reply(with cookie),HTTP reply(with cookie),cookie hash,specifiesserver,First Hit,Second Hit,Third Hit,Server,TCP handshake,HTTP request(with same cookie),HTTP reply(with cookie),cookie hash,specifiesserver,TCP handshake,HTTP request(with same cookie),HTTP reply(with cookie),Cookie Hash Mode,MSRDP Persistence,微软远程桌面协议（,MSRDP,）会话保持跟踪那些运行,Microsoft,远程桌面协议（,RDP,）服务的客户机和服务器之间的对话。,Universal Persistence,对于,BIG-IP,没有提供会话保持方法的特定应用，可以通过脚本来进行定制会话保持方法。例如对于许多中间件服务器，,JSESSIONID,往往会被作为会话保持的依据，但对于用户的首次访问，用户请求中是没有,JSESSIONID,的，这样往往会现现第一次请求被按负载均衡分配到一台服务器上，而随后的访问却被,JSESSIONID,保持到别的服务器上的情况,when CLIENT_ACCEPTED,set,add_persist,1,when HTTP_RESPONSE,if ,HTTP:cookie,exists JSESSIONID and$,add_persist,log local0.response set cookie,HTTP:cookie,JSESSIONID,persist add,uie,HTTP:cookie,JSESSIONID,set,add_persist,0,when HTTP_REQUEST,if ,HTTP:cookie,exists JSESSIONID ,persist,uie,HTTP:cookie,JSESSIONID,else,set,jsess,findstr,HTTP:uri,jsessionid,11 32,if$,jsess,!=,log local0.request include$,jsess,persist,uie,$,jsess,服务器负载均衡关键技术,负载均衡算法,服务器健康检查,会话保持技术,HTTP,流量压缩,连接优化技术,带宽管理,HTTP,压缩处理,Uncompressed,Compressed,BIG-IP,HTTP,压缩技术,为什么要用压缩处理？,访问用户可以更快得到回应,节约带宽,高,TCO,Less Data to Encrypt,HTTP,压缩处理,HTTP,压缩是一个,web browsers,和,web servers,常用的技术,.,用户的,browser,在,“,Accept-Encoding:”,header,中通知,server,采用哪种压缩模式,.,Server,就可以在可协商的范围内选择其中一种方式并压缩回应的包,.,Server,另外插入一个,“,Content-Encoding:”,header,显示采用的压缩方式,.,Company,(home page),Bytes Saved with Compression,Percentage Saved with Compression,Transfer Speed Improvement,Oracle,71,895,73%,3.7x,E*trade,46,772,70%,3.3x,Lubrizol,86,732,66%,2.9x,Xerox,73,044,64%,2.8x,Hilton Hotels,102,487,55%,2.2x,North Western Mutual,55,541,53%,2.1x,Best Buy,127,299,51%,2.1x,Bed Bath and Beyond,114,854,51%,2.1x,Insight Enterprise,53,777,50%,2.0 x,Progressive,47,701,52%,2.1x,HTTP,压缩处理,可以压缩哪些呢,?,压缩效果比较好的：,text,html,other white space rich data,压缩,“,white space”,的,rich data,经常可以得到,80%+,的压缩比,拨号用户、,TCP,延迟较大的用户,HTTP,压缩处理 选择性压缩,哪些不可以压缩？,压缩文件,(,rar,、,zip,etc,),image formats(jpeg,Gif,png,etc.),PDF files will not display at all if they are compressed.,Other file types that are already compressed,宽带用户,服务器负载均衡关键技术,负载均衡算法,服务器健康检查,会话保持技术,HTTP,流量压缩,连接优化技术,带宽管理,连接优化,可以提高服务器,30%,的服务能力,-,聚合大量的用户请求为很少的服务器连接,将,HTTP 1.0,的访问转换为,HTTP 1.1,对服务器进行访问,智能的负载均衡连接聚合到不同内容的服务器（,jpg,streaming,html,）,连接优化,OneConnect,With client aggregation:,OneConnect,HTTP transformations,index.htm,a.gif,b.gif,c.asp,index.htm,a.gif,b.gif,c.asp,Many,One,sales.htm,d.gif,e.gif,f.asp,index.htm,d.gif,a.gif,c.asp,HTML server pool,GIF server pool,ASP server pool,index.htm,a.gif,b.gif,c.asp,f.asp,sales.htm,e.gif,b.gif,index.htm,a.gif,b.gif,c.asp,index.htm,a.gif,b.gif,c.asp,OneConnect,Content Switching,HTML server pool,GIF server pool,ASP server pool,服务器负载均衡关键技术,负载均衡算法,服务器健康检查,会话保持技术,HTTP,流量压缩,连接优化技术,带宽管理,用户问题,:,市场现象,:,带宽管理,KaZaa,&Email,Video Conferencing,Oracle,HTTP Traffic,4x,3x,2x,1x,Client,较低优先级的,P2P,流量影响商业使用,如,Ocaled,Email,视频会议等需要高品质的专用带宽,允许非严格的,P2P,访问,推动他们增加安全性,防止攻击和风险,.,并不是所有,P2P,流量都是无用流量,.,42%,的用户在公司网上从,P2P,站点下载信息,ISPs,报告说,P2P,流量占所有流量的,30-70%,ISPs,报告,80-90%,最后一公里的流量是,P2P,去年,P2P,站点已经从,434,增加到刚超过,2,000,站点,商业利益,:,F5,解决方案,:,带宽管理,KaZaa,&Email,Video,Conferancing,Oracle,HTTP Traffic,4x,3x,2x,1x,Client,带宽管理,+,iRules,-,带宽管理可区分出,P2P,和其它较高优先级的应用，确保高优先级的应用有足够的带宽,包过滤,允许对基于协议,地址和端口的,P2P,站点进行选择性过滤,通过控制非优先级流量峰值,节省,20%,的带宽,在高峰流量加载时最小化对关键业务的影响,排除版权和法律诉讼的风险,带宽管理实际效果,External Slide,SSL,X-Control,应用安全防护,高可用性,解决方案合作伙伴,客户问题,:,SSL,引发系统扩展瓶颈,SSL,流量每年成倍增长,SSL,不再是只为电子商务所采用。主要的应用开发商,(Siebel,Peoplesoft,etc),都已经在其软件中集成了,SSL,企业内部安全机制业已经常关注,SSL,解决方案,当考虑系统成本时扩展,SSL,吞吐能力变得十分困难,现有的解决方案侧重包交换能力（,TPS,），却不注重处理大量并发用户连接和高数据流状况下的真实性能,随着应用安全的提升，,SSL,数据流量急剧上升,市场现象,:,服务器负载均衡设备,SSL,加速设备集群,应用服务器,无处不在的安全加密,商业利益,F5,解决方案,:,突破性的,SSL,解决方案,对,SSL,密匙交换和批加密加速,同时大大增加,SSL,的同时连接数,.,AES,加密,最高级的加密标准,使企业随时部署和扩展,SSL,加密,.,减少管理和降低,TCO.(10,比,1,代理数,),全面部署,SSL,得以实现,Application,SSL,竞争伙伴,SSL BIG-IP v9,TPS(Key Ex.),最高,2,000 TPS,高达,15,000,批加密,最高,300 Mbps,高达,2Gbps,同时连接数,最高,10,000,高达,250,000,iControl,架构,通用的软件架构支持,F5,产品的互相通讯,:,收集信息,发送指令,免费的软件开发工具包,(SDK),让软件开发者开发应用使开发与,F5,产品通讯的模块,全自动化的应用控制网络功能,“个性化管理软件技术,F5,网络控制架构,通过将网络应用软件与,F5,网络硬件设备无缝集成使,F5,公司遥遥领先于竞争对手,.”,PC Magazine,January 2,2002,X,-Control,基于,iControl,的应用流量管理平台,iControl API/SDK-Oracle,API Control MS .Net,iControl API/SDK-Bea,WebLogic,iControl API/SDK-TOM,提高网络与应用安全性,防,DOS,攻击,BIG-IP,可全面防御拒绝服务（,DoS,）攻击、同步攻击（,SYN Flood,）、和其他基于网络的攻击，可安全地过滤海量攻击，同时为合法连接用户提供不间断的服务。,过滤非法的用户请求,rule,nwc_robot_routing_rule,when HTTP_REQUEST if ,HTTP:header,User-Agent=if ,matchclass,IP:remote_addr,equals$:,blacklisted_clients,pool,spider_HTTP:header,Host ,elseif,matchclass,HTTP:header,User-Agent contains$:,blacklisted_useragents,pool,spider_HTTP:header,Host ,elseif,string first-,nocase,bot,HTTP:header,User-Agent=0 pool,spider_HTTP:header,Host else pool,pool_HTTP:header,Host ,F5 BIG-IP,应用交换机提供了强大的应用过滤功能，可将非法的用户请求过滤掉。例如,Network,Computering,就是采用以下,iRule,将非法的用户请求（防止搜索爬虫的遍历操作导致服务器过于繁忙）导向到特定的服务器上：,隐藏服务器端敏感信息,为防止敏感信息外泄，,BIG-IP,可以将选定的信息屏蔽掉。如下例子，隐藏,HTTP Head,中的选定信息：,rule when HTTP_RESPONSE,#,#Remove all but the given headers.,#,HTTP:header,sanitize“,ETag,”“Connection”“Content-TYPE”,对应用数据选择性加密,BIG-IP,支持对应用关健数据进行先择性加密，提高安全性。以下是对,WEB,应用中的,Cookie,加密的例子,rule when HTTP_REQUEST,#,#Decrypt the cookie on its way to the server.,#,HTTP:cookie,decrypt“,cookie_name,”“password-key”,rule when HTTP_RESPONSE,#,#Encrypt the cookie on its way to the client.,#,HTTP:cookie,encrypt“,cookie_name,”“password-key”,高级客户端验证功能,BIG-IP,可作为各种流量类型的认证代理，使企业能够为,BIG-IP,系统上的应用提供最高级的认证。这种功能使各类应用又多了一道远离自身的网络安全防线，为其,eb,和应用层提供了进一步的保护。,允许,BIG-IP,提供到,LDAP,、,Radius,、,TACAS,和其它集中认证设备的顶级,HTTP,和其它流量类型的客户机认证。,BIG-IP,可作为各种流量类型的认证代理，使企业能够为,BIG-IP,系统上的应用提供最高级的认证。这种功能使各类应用又多了一道远离自身的网络安全防线，为其,Web,和应用层提供了进一步的保护。,网络包过滤和应用级防火墙,现在，,BIG-IP,集成了一个控制点来定义并执行基于第,4,层的过滤规则（基于,PCAP,，与网络防火墙类似），以提高网络保护能力。,BIG-IP,的完整检查能力及基于事件的规则提供了一项强大的能力，可搜索并应用各种规则来阻止,L7,层攻击,同时也可以定义策略来阻止特定访问或禁止某些命令的执行。此外，,BIG-IP,在为合法用户持续提供流量的同时，还可提供其它安全保护层，以防范黑客、病毒和蠕虫的攻击（如红色代码蠕虫）,packet filter,Test_Port,order 14action discard,vlan,externallog enablefilter(tcp2:2=0 x1f40),高可用性,双机采用专用的心跳线，支持毫秒级切换，,BIG-IP,应用交换机采用双机运行方式时，双机之间除了与其它厂商的产品一样支持网络心跳线之外，还支持专用非网络心跳线。专用的心跳线使双机的切换变得更加快速可靠。双机的的切换可以在,200,毫秒以内完成。,支持双机连接状态镜像,(Connection Mirroring),，,BIG-IP,应用交换机双机之间支持会话表有选择性状态同步，可以选择设定对哪些应用采用会话状态同步功能。这样即可减轻双机状态同步对系统带来的额外压力，又可以对要求不间断运行的应用，做到双机切换对应用没有影响。,专用的双机,“,HA,”,进程表实现对系统状态的全面监控，处于双机运行的设备，当处于,Active,的设备中某一进程发生故障，例如出现,“,进程挂死,”,现象时能否及时触发双机切换，将直接影响到应用的不间断运行。,F5 BIG-IP,应用交换机提供了专门的双机,“,HA,”,进程表，可以设定对系统关键进程的实时监控，处于监控表中的任一进程发生意外都可以及时触发双机的切换。,Thank You,！,