Section 10-1. SLB

10-1. SLB

• SLB provides a virtual server IP address to which clients can connect, representing a group of real physical servers in a server farm. Figure 10-1 shows the basic SLB concept. A client accesses a logical "virtual" server (IP address v.v.v.v), which only exists within the Catalyst 6000 SLB configuration. A group of physical "real" servers (IP addresses x.x.x.x, y.y.y.y, and z.z.z.z) is configured as a server farm. Traffic flows between clients and the virtual server are load balanced across the set of real servers, transparent to the clients.

  Figure 10-1. SLB Concept

  

  
  

• As clients open new connections to the virtual server, SLB decides which real server to use based on a load-balancing algorithm.

• Server load balancing is performed by one of these methods:

  - Weighted round-robin Each real server is assigned a weight that gives its ability to handle connections, relative to the other servers. For a weight n, a server is assigned n new connections before SLB moves on to the next server.
  
  

  - Weighted least connections SLB assigns new connections to the real server with the least number of active connections. Each real server is assigned a weight m, where its capacity for active connections is m divided by the sum of all server weights. SLB assigns new connections to the real server with the number of active connections farthest below its capacity.
  
  

• With weighted least connections, SLB controls the access to a new real server, providing a slow start function. New connections are rate limited and allowed to increase gradually to keep the server from becoming overloaded.

• The virtual server can masquerade as the IP address for all TCP and UDP ports of the real server farm. As well, the virtual server can appear as the IP address of a single port or service of a server farm.

• Sticky connections allow SLB to assign new connections from a client to the last real server the client used.

• SLB can detect a real server failure by monitoring failed TCP connections. SLB can take the failed server out of service and return it to service as soon as it is working again.

• SLB can use server Network Address Translation (NAT) to translate between the real and virtual server addresses if they reside on different Layer 3 subnets.

• SLB can use client NAT to translate the source addresses of client requests into addresses on the server side of the SLB device. This is used when several SLB devices are operating so that return traffic can be sent to the correct SLB device.

• SLB provides a control mechanism over incoming TCP SYN floods to the real servers. This can prevent certain types of denial-of-service attacks.

• SLB can coexist with Hot Standby Router Protocol (HSRP) to provide a "stateless backup." If one SLB router fails, a redundant router can take over the SLB function. However, existing SLB connections will be lost and will have to be reestablished from the client side.

• IOS SLB can also operate as a Dynamic Feedback Protocol (DFP) load-balancing manager. The DFP manager collects capacity information from DFP agents running on the real servers.

Configuration

NOTE

This chapter presents SLB commands as "IOS" for Catalyst 6000 native IOS and "CSM" for Catalyst 6000 Content Switching Module. SLB is not available on any COS platform, so that type of command format has been omitted.

The CSM commands are actually used from the native IOS command-line interface (CLI), in the CSM configuration mode. The IOS and CSM commands are presented side-by-side here for comparison purposes. The CSM commands are based on the CSM 2.1 software image.

1.

(CSM only) Define client-side and server-side virtual LANs (VLANs).

a. Start configuring a CSM module:

IOS	N/A
CSM	(global) module csm slot-number

The native IOS CLI begins CSM configuration mode for the CSM located at slot-number in the switch chassis. To end this mode, use the exit command. To find the appropriate slot number, use the show module all command.

b. Define the VLAN type:

IOS	N/A
CSM	(csm) vlan vlan-id {client | server}

The VLAN number is given as vlan-id (2 to 4095; VLAN 1 cannot be used). This VLAN must already be defined on the switch in the VLAN database. The VLAN type, client or server, defines where the clients or servers (server farms of real servers) are located as seen by the CSM. You must define both client-side and server-side VLANs before the CSM can be used properly. Clients and servers must be located in different VLANs.

c. (Optional) Assign a primary IP address:

IOS	N/A
CSM	(csm-vlan) ip address ip-address netmask

One IP address can be defined per VLAN on the CSM. This address is used for management traffic (probes, for example) and ARP requests.

d. (Optional) Assign an additional secondary IP address:

IOS	N/A
CSM	(csm-vlan) alias ip-address netmask

Additional IP addresses allow the CSM to communicate with servers on a different IP network without using a router.

e. (Optional) Select a default gateway:

IOS	N/A
CSM	(csm-vlan) gateway ip-address

A next-hop default gateway or router address is given by ip-address. This command can be repeated to define up to 7 gateways per VLAN, or 255 gateways per CSM. Gateways are usually used on the client-side VLAN, although they can be used on the server-side if needed.

f. (Optional) Define static routes to reach distant networks:

IOS	N/A
CSM	[View full width] (csm-vlan) route ip-address netmask gateway gw-ip-address

A static route can be defined when the CSM needs to know how to reach servers that are more than one router hop away. Define the route by the network ip-address and netmask, using gateway address gw-ip-address. The gateway must reside on the same local network as the CSM VLAN.

g. Repeat Steps 1b to 2f for each client-side and server-side VLAN.

h. (Optional) Define a fault-tolerant VLAN for redundant CSMs.

- Identify the fault-tolerant VLAN:

IOS	N/A
CSM	(csm) vlan vlan-number ft

This VLAN should be defined on both redundant CSMs. It should be a private VLAN that connects the two modules so that they can share connection and redundancy traffic. Each pair of redundant CSMs must use a different private fault-tolerant VLAN number.

- Define the fault-tolerant group:

IOS	N/A
CSM	(csm) ft group group-id vlan vlan-id

Each of the redundant CSMs must be given a common fault-tolerance group-id (1 to 254). The fault-tolerance VLAN is vlan-id (2 to 4095).

- (Optional) Set the CSM priority:

IOS	N/A
CSM	(csm-ft) priority value

The CSM with the highest priority value (1 to 254; default 10) becomes the primary CSM.

- (Optional) Allow a restored CSM to become primary again:

IOS	N/A
CSM	(csm-ft) preempt

By default, a primary CSM that fails cannot become the primary again when it is restored to service. Use the preempt command to allow a restored CSM to take over as the primary. This command must be entered on both of the redundant CSMs so that they agree on the preempt strategy.

- (Optional) Set the heartbeat interval:

IOS	N/A
CSM	(csm-ft) heartbeat-time heartbeat-time

- Heartbeat messages are exchanged between redundant CSMs over the fault-tolerant VLAN at regular heartbeat-time intervals (1 to 65,535 seconds; default 1 second).

- (Optional) Set the failover time:

IOS	N/A
CSM	(csm-ft) failover failover-time

The standby CSM will wait for failover-time (1 to 65,535 seconds; default 3 seconds) after the last heartbeat message was received before taking over as the primary CSM.

2.

Define a server farm.

a. Assign a name to the server farm:

IOS	(global) ip slb serverfarm serverfarm-name
CSM	(csm) serverfarm serverfarm-name

The server farm is identified by serverfarm-name (text string up to 15 characters).

b. (Optional) Select a load-balancing algorithm for the server farm:

IOS	(server-farm) predictor {roundrobin | leastconns}
CSM	[View full width] (server-farm) predictor {roundrobin | leastconns | hash url | hash address [source | destination] [ip-netmask] | forward}]

SLB selects a real server using roundrobin (weighted round-robin the default) or leastconns (weighted least connections).

A CSM can also load balance based on hash url (hash value from the URL; used along with the url-hash command in Step 5, substep l), hash address (hash value from the source address or destination address; ip-netmask can specify the address bits used for hashing; 255.255.255.255 or "all bits" is the default), or forward (forward traffic according to CSM routing tables).

c. (Optional) Use server NAT:

IOS	(server-farm) nat server
CSM	(server-farm) nat server

By default, the virtual server and real server addresses must be Layer 2-adjacent. In other words, SLB forwards packets between the virtual server and a real server by substituting the correct MAC addresses. Server NAT can be used instead, allowing the virtual and real servers to have addresses from separate IP subnets. SLB then substitutes the Layer 3 IP addresses to forward packets between the virtual and real servers, allowing the servers to be separated by multiple routing hops.

d. (Optional) Use client NAT.

- Define a NAT pool of addresses:

IOS	[View full width] (global) ip slb natpool pool-name start-ip end-ip {netmask netmask | prefix-length leading-1-bits} [entries init-addr [max-addr]]
CSM	[View full width] (global) natpool pool-name start-ip end-ip {netmask netmask | prefix-length leading-1-bits}

A pool of IP addresses is given the name pool-name (text string up to 15 characters), consisting of addresses bounded by start-ip and end-ip. The subnet mask associated with the pool can be given as a regular subnet mask, netmask (x.x.x.x format), or as the number of leading 1 bits in the mask, leading-1-bits (1 to 32).

For IOS SLB, client NAT allocates a number of entries as IP addresses and port numbers, init-addr (1 to 1,000,000; default 8000) as an initial set to use. When the number of dynamically allocated entries reaches half of the initial number, more entries are allocated. The maximum number of NAT entries can be defined as max-addr (1 to 8,000,000; default is the pool size times the number of ports available, or 65,535 11,000, or 54,535). Port numbers for translation begin at 11,000.

- Enable client NAT with a pool:

IOS	(server-farm) nat client pool-name
CSM	(server-farm) nat client pool-name

The SLB NAT pool is identified by pool-name (up to 15 characters).

e. (Optional) Assign a unique identifier for DFP:

IOS	(server-farm) bindid [bind-id]
CSM	(server-farm) bindid [bind-id]

Sometimes, a real server is assigned to multiple server farms. The bind-id (0 to 65533; default 0) is an arbitrary identification value given to a server farm. Each instance of a real server references this value, allowing DFP to assign a unique weight to it.

f. (Optional) Test the server with a probe:

IOS	(server-farm) probe name
CSM	(server-farm) probe name

The probe defined as name (text string, up to 15 characters) periodically tests for server connectivity and operation. IOS SLB offers ping, HTTP, and Wireless Session Protocol (WSP) probes. The CSM also offers TCP, FTP, SMTP, Telnet, and DNS probes. See section "10-3: SLB Probes" for more information about configuring probes.

g. (Optional; CSM only) Purge connections to a failed server:

IOS	N/A
CSM	(server-farm) failaction purge

By default, connections are not purged when a server fails (no failaction purge). When a CSM is used to load balance VPN connections, this command must be used so that existing tunnel connections to a failed server will be torn down automatically. Otherwise, the connections must time out before the remote end will become aware of a failure.

h. (Optional; CSM only) Define a redirect virtual server that will receive redirected traffic.

- Name the redirect virtual server:

IOS	N/A
CSM	(server-farm) redirect-vserver name

The redirect virtual server is named name (text string, up to 15 characters).

- Specify the address and port for the virtual server:

IOS	N/A
CSM	(redirect-virtual) virtual ip-address tcp port

The redirect virtual server is bound to ip-address (default 0.0.0.0, or no packet forwarding) and the TCP port number.

- (Optional) Restrict access by client:

IOS	N/A
CSM	[View full width] (redirect-virtual) client ip-address [network-mask] [exclude]

Clients having IP addresses within the range given by ip-address (default 0.0.0.0, or all addresses) and network-mask (default 255.255.255.255, or all networks) will be allowed to connect to the virtual server. The network-mask in this case resembles the mask of an access list, where a 1 bit ignores and a 0 bit matches. On a CSM, you can use the exclude keyword to exclude clients with matching IP addresses instead.

- (Optional) Restrict access by VLAN:

IOS	N/A
CSM	(redirect-virtual) vlan {vlan-number | all}

If desired, only hosts from vlan-number (2 to 4095) or all VLANs (the default) can access the virtual server.

- (Optional) Advertise the virtual server:

IOS	N/A
CSM	(redirect-virtual) advertise [active]

By default, SLB creates a static host route (netmask 255.255.255.255) for the virtual server address to the Null0 logical interface. This static route can then be redistributed and advertised by a routing protocol. The active keyword causes the route to be advertised only when at least one real server is available. You can disable the advertisement with no advertise, preventing the static route from being created.

- (Optional) Enable connection redundancy between multiple CSMs:

IOS	N/A
CSM	(redirect-virtual) replicate csrp

Connection information is replicated to other CSMs that are configured for redundancy.

- (Optional) Hold connections open after no activity:

IOS	N/A
CSM	(redirect-virtual) idle duration

When SLB detects an absence of packets for a connection, it keeps the connection open for duration (4 to 65,535 seconds, default 3600 seconds or 1 hour) before sending a TCP Reset (RST).

- (Optional) Redirect and forward SSL:

IOS	N/A
CSM	(redirect-virtual) ssl {https | ftp | ssl-port-number}

- By default, HTTP requests are not forwarded to SSL servers. You can forward these as https (port 443), ftp, or as an ssl-port-number (1 to 65535).

- (Optional) Send a relocation string to redirected HTTP requests:

IOS	N/A
CSM	[View full width] (redirect-virtual) webhost relocation relocation-string [301 | 302]

The relocation-string (text string up to 127 characters) is sent in response when an HTTP request is redirected. The original URL path can be appended to the relocation-string by ending the string with %p. The status code that is returned can be 301 ("The requested resource has been assigned a new permanent URL.") or 302 (the default; "The requested resource resides temporarily under a different URL.").

- (Optional) Send a relocation string when the redirect server is not in service:

IOS	N/A
CSM	[View full width] (redirect-virtual) webhost backup backup-string [301 | 302]

The backup-string is sent in response when an HTTP request is redirected, but no real servers are available. The original URL path can be appended to the relocation-string by ending the string with %p. The status code that is returned can be 301 ("The requested resource has been assigned a new permanent URL.") or 302 (the default; "The requested resource resides temporarily under a different URL.").

- Enable the redirect virtual server for use:

IOS	N/A
CSM	(redirect-virtual) inservice

3.

Specify one or more real servers in the server farm.

a. Identify the real server:

IOS	(server-farm) real ip-address
CSM	(server-farm) real ip-address [port]

The real server has the IP address given by ip-address. The CSM allows port translation for the server by specifying the port number (1 to 65,535; default no port translation).

b. (Optional) Specify a connection threshold.

- Set the maximum number of connections:

IOS	(real-server) maxconns number
CSM	(real-server) maxconns number

At any given time, the real server will be limited to number (1 to 4,294,967,295 connections; default 4,294,967,295) active connections.

- (Optional; CSM only) Set the minimum connection threshold:

IOS	N/A
CSM	(real-server) minconns number

If used, the minconns number (1 to 4,294,967,295 connections) is the threshold that the number of active connections must fall to before new connections are allowed again.

c. (Optional) Assign a relative capacity weight:

IOS	(real-server) weight weighting-value
CSM	(real-server) weight weighting-value

The real server is assigned a weighting-value (1 to 255 for IOS, 1 to 100 for CSM; default 8) that indicates its capacity relative to other real servers in the server farm. For weighted round-robin, weighting-value defines the number of consecutive connections the server will receive before SLB moves to the next server. For weighted least connections, the next connection is given to the server whose number of active connections is furthest below its capacity. The capacity is computed as the weighting-value divided by the sum of all real server weighting values in the server farm.

d. (Optional; IOS SLB only) Reassign connections when a server doesn't answer:

IOS	(real-server) reassign threshold
CSM	N/A

SLB attempts to assign a new connection to a real server by forwarding the client's initial SYN. If the server doesn't answer with a SYN handshake before the client retransmits its SYN, an unanswered SYN is recorded. After threshold (1 to 4, default 3) unanswered SYNs occur, SLB reassigns the connection to the next server.

e. (Optional; IOS SLB only) Define a failed server threshold:

IOS	[View full width] (real-server) faildetect numconns number-conns [numclients number-clients]
CSM	N/A

A server is determined to have failed if number-conns (1 to 255, default 8 connections) TCP connections have been reassigned to another server. You can also use the numclients keyword to specify the number-clients (1 to 8, default 2) of unique clients that have had connection failures.

f. (Optional; IOS SLB only) Specify the amount of time before retrying a failed server:

IOS	(real-server) retry retry-value
CSM	N/A

After a real server has been declared "failed," SLB attempts to assign a new connection to it after retry-value (1 to 3600 seconds, default 60 seconds) time has elapsed. You can also use a value of 0 to indicate that new connections should not be attempted.

g. (Optional; CSM only) Accept redirected HTTP traffic:

IOS	N/A
CSM	(real-server) redirect-vserver name

The real server can receive traffic that has been redirected to the redirect virtual server name (text string, up to 15 characters). The virtual server is configured in Step 2.

h. Allow SLB to begin using the real server:

IOS	(real-server) inservice
CSM	(real-server) inservice

By default, the real server is not used by SLB unless it is placed in service. To remove a server from service, use no inservice.

4.

(CSM only) Match specific traffic with load-balancing policies.

a. (Optional) Define a map to match URLs.

- Name the map:

IOS	N/A
CSM	(csm) map url-map-name url

The map named url-map-name (text string up to 15 characters) contains matching conditions for URL contents.

- Match URLs based on a regular expression:

IOS	N/A
CSM	(map-url) match protocol http url urln

The regular expression urln (up to 255 characters) matches against URL contents. You can enter up to 1023 match statements in a single map.

Regular expressions can contain the following symbols for matching: * (zero or more characters), ? (exactly one character), \ (an escaped character), [ ] (a bracketed range of characters separated by a dash), ^ (don't match any in the range, when followed by a range), .\a (alert or ASCII 7), .\b (backspace or ASCII 8), .\f (form-feed or ASCII 12), .\n (newline or ASCII 10), .\r (carriage return or ASCII 13), .\t (tab or ASCII 9), .\v (vertical tab or ASCII 11), .\0 (null or ASCII 0), .\\ (a backslash), and .\x## (any character denoted by two hex digits for ASCII value).

b. (Optional) Define a map to match cookies.

- Name the map:

IOS	N/A
CSM	(csm) map cookie-map-name cookie

The map named cookie-map-name (text string up to 15 characters) contains one or more matching conditions for cookies.

- Match a cookie:

IOS	N/A
CSM	[View full width] (map-cookie) match protocol http cookie cookie-name cookie-value cookie-value-expression

Cookies are matched by name cookie-name (text string, up to 63 characters) and a regular expression cookie-value-expression (text string, up to 255 characters). Regular expression symbols are defined in Step 4a. Multiple match commands can appear in a cookie map, but they all must be met before the cookie can be matched.

c. (Optional) Define a map to match header strings.

- Name the map:

IOS	N/A
CSM	(csm) map header-map-name header

The map named header-map-name (text string up to 15 characters) contains one or more matching conditions for HTTP headers.

- Match an HTTP header:

IOS	N/A
CSM	[View full width] (map-header) match protocol http header field header-value expression

HTTP headers are matched by literal field name field (text string up to 63 characters) and a regular expression (text string, up to 127 characters). Regular expression symbols are defined in Step 4a. Multiple match commands can appear in a header map, but they all must be met before the header can be matched.

d. (Optional) Match successive connections from a client:

IOS	N/A
CSM	[View full width] (csm) sticky sticky-group-id {netmask netmask | cookie name | ssl} [timeout sticky-time]

Connections from a client that match a policy can be made "sticky," so that they all use the same real server. Group common sticky commands into a sticky group instance, sticky-group-id (1 to 255). You can permit sticky connections based on the masked client IP address (netmask netmask, a standard subnet mask), a cookie name (cookie name), or SSL (ssl). The connection stickiness allows the last used real server to be remembered for a time period sticky-time (0 to 65,535 minutes; default 1440 minutes or 24 hours; 0 disables stickiness).

e. (Optional) Match client source addresses.

- Create a named standard IP access list:

IOS	N/A
CSM	(csm) ip access-list standard access-list-name

The access list is named access-list-name (text string).

- Permit or deny source addresses:

IOS	N/A
CSM	[View full width] (access-list) {permit | deny} source-address [source-wildcard]

You can permit or deny client source addresses based on the source-address (IP address format) and an address mask source-wildcard (subnet mask format, but 1 bits are used as wildcards). One or more permit and deny commands can be listed in an access list. They are evaluated in the order that they are entered.

f. Create one or more load-balancing policies.

- Name the policy:

IOS	N/A
CSM	(csm) policy policy-name

The policy is named policy-name (text string up to 15 characters). You can configure up to 12,287 different policies on a CSM.

TIP

A policy can consist of one or more of the map and group commands that follow. If multiple policy maps and groups are used in a single policy, matching traffic must match all of them.

- (Optional) Use a URL map:

IOS	N/A
CSM	(policy) url-map url-map-name

URLs matched by the URL map url-map-name are handled by the policy. URL maps are created in Step 4a.

- (Optional) Use a cookie map:

IOS	N/A
CSM	(policy) cookie-map cookie-map-name

Cookies matched by the cookie map cookie-map-name are handled by the policy. Cookie maps are created in Step 4b.

- (Optional) Use a header map:

IOS	N/A
CSM	(policy) header-map header-map-name

Headers matched by the header map header-map-name are handled by the policy. Header maps are created in Step 4c.

- (Optional) Use a sticky group:

IOS	N/A
CSM	(policy) sticky-group group-id

Connections matching the sticky group number group-id (1 to 255; default 0 or no sticky connections) in this policy are sent to the same real server. Sticky groups are created in Step 4d.

- (Optional) Use a client filter group:

IOS	N/A
CSM	(policy) client-group {acl-number | acl-name}

Traffic that matches the standard IP access list acl-number (1 to 99) or acl-name are handled by the policy. Client filter access lists are created in Step 4e.

- (Optional) Mark traffic with a DSCP value:

IOS	N/A
CSM	(policy) set ip dscp dscp-value

Packets matching the policy have their Differentiated Services Code Point (DSCP) values set to dscp-value (0 to 63; no default). For more information about the DSCP values, refer to section "13-1: QoS Theory."

- Associate a server farm to the policy:

IOS	N/A
CSM	(policy) serverfarm serverfarm-name

A policy is used by virtual servers, but it must first be associated with only one server farm. This allows the policy to control load balancing to the real servers in the server farm named serverfarm-name (text string).

5.

Define a virtual server for the server farm.

a. Name the virtual server:

IOS	(global) ip slb vserver virtual-server-name
CSM	(csm) vserver virtual-server-name

The virtual server is given the name virtual-server-name (text string up to 15 characters).

b. Assign the virtual server to a server farm:

IOS	(virtual-server) serverfarm serverfarm-name
CSM	(virtual-server) serverfarm serverfarm-name

SLB will use the virtual server as the front end for the server farm named serverfarm-name (text string up to 15 characters).

c. Define the virtual server capabilities:

IOS	[View full width] (virtual-server) virtual ip-address [network-mask] {tcp | udp} [port | wsp | wsp-wtp | wsp-wtls | wsp-wtp-wtls] [service service-name]
CSM	[View full width] (virtual-server) virtual ip-address [network-mask] {tcp | udp | any | protocol-number} port [service ftp]

The virtual server will appear as IP address ip-address (default 0.0.0.0 or "all networks") with network-mask (default 255.255.255.255).

With IOS SLB, it provides load balancing for the specified tcp or udp port: dns or 53 (Domain Name System), ftp or 21 (File Transfer Protocol), https or 443 (HTTP over Secure Socket Layer), www or 80 (HTTP), telnet or 23 (Telnet), smtp or 25 (SMTP), pop3 or 110 (POPv3), pop2 or 109 (POPv2), nntp or 119 (Network News Transport Protocol), or matip-a or 350 (Mapping of Airline Traffic over IP, type A). A port number of 0 can be given to indicate that the virtual server accepts connections on all ports.

Other alternatives to a port number are wsp (connectionless WSP, port 9200), wsp-wtp (connection-oriented WSP, port 9201 with WAP FSM), wsp-wtls (connectionless secure WSP, port 9202), and wsp-wtp-wtls (connection-oriented secure WSP, port 9203).

With a CSM, the protocol can be tcp, udp, any (any protocol, no port number is required; the default), or protocol-number (0 to 255). Any valid port number or name (0 to 65535) can be specified.

The service keyword can be given to force SLB to assign all connections associated with a given service-name (ftp or wsp-wtp) to the same real server. On a CSM, only ftp connections are allowed to be coupled to the originating control session.

d. (Optional) Control access to the virtual server.

- (Optional) Allow only specific clients to use the virtual server:

IOS	(virtual-server) client ip-address network-mask
CSM	[View full width] (virtual-server) client ip-address [network-mask] [exclude]

Clients having IP addresses within the range given by ip-address (default 0.0.0.0, or all addresses) and network-mask (default 255.255.255.255, or all networks) are allowed to connect to the virtual server. The network-mask in this case resembles the mask of an access list, where a 1 bit ignores and a 0 bit matches. On a CSM, you can use the exclude keyword to disallow the IP addresses specified.

- (Optional; CSM only) Allow only specific source VLANs to use the virtual server:

IOS	N/A
CSM	(virtual-server) vlan vlan-number

By default, a virtual server accepts connections coming from any VLAN. To restrict the access, specify a vlan-number (2 to 4095) that is to be allowed. After it has been defined, all other VLANs are restricted from accessing the virtual server.

e. (Optional) Assign connections from the same client to the same real server:

IOS	[View full width] (virtual-server) sticky duration [group group-id] [netmask netmask]
CSM	[View full width] (virtual-server) sticky duration [group group-id] [netmask netmask]

For a given client, connections are assigned to the last-used real server for duration in seconds (IOS: 0 to 65,535, and CSM: 1 to 65,535). Virtual servers can be assigned to a group-id (0 to 55; default 0), associating them as a single group. A netmask (default 255.255.255.255) can be given such that all client source addresses within the mask are assigned to the same real server.

f. (Optional; IOS SLB only) Hold connections open after they are terminated:

IOS	(virtual-server) delay duration
CSM	N/A

After a TCP connection is terminated, SLB can maintain the connection context for duration (1 to 600 seconds, default 10 seconds). This can be useful when packets arrive out of sequence, and the connection is reset before the last data packet arrives.

g. (Optional) Hold connections open after no activity:

IOS	(virtual-server) idle duration
CSM	(virtual-server) idle duration

When SLB detects an absence of packets for a connection, it keeps the connection open for duration in seconds (IOS: 10 to 65,535, and CSM: 4 to 65,535, default 3600 seconds or 1 hour) before sending an RST.

h. (Optional; IOS SLB only) Prevent a SYN flood to the real servers:

IOS	(virtual-server) synguard syn-count [interval]
CSM	N/A

SLB monitors the number of SYNs that are received for the virtual server. If more than syn-count (0 to 4294967295, default 0 or no SYN monitoring) SYNs are received within the interval (50 to 5000 milliseconds, default 100 ms), any subsequent SYNs are dropped.

i. (Optional) Control the advertisement of the virtual server:

IOS	(virtual-server) advertise [active]
CSM	(virtual-server) advertise [active]

By default, SLB creates a static route for the virtual server address to the Null0 logical interface. This static route can then be redistributed and advertised by a routing protocol. The active keyword causes the route to be advertised only when at least one real server is available. You can disable the advertisement with no advertise, preventing the static route from being created.

j. (Optional; CSM only) Set the depth that URLs and cookies are parsed:

IOS	N/A
CSM	(virtual-server) parse-length bytes

The CSM parses up to bytes (1 to 4000 bytes; default 600 bytes) when looking for URL and cookie information.

k. (Optional; CSM only) Enable HTTP 1.1 connection persistence:

IOS	N/A
CSM	(virtual-server) persistent rebalance

By default, persistent connections for HTTP 1.1 are not maintained. Use this command to enable connection persistence.

l. (Optional; CSM only) Tune URL hashing for load balancing:

IOS	N/A
CSM	[View full width] (virtual-server) url-hash {begin-pattern | end-pattern} pattern

With the "predictor hash URL" load-balancing algorithm, the entire URL is hashed by default. To specify a portion of the URL to be hashed, define the bounding text: begin-pattern pattern (text string that starts the hashed portion) or end-pattern pattern (text string that ends the hashed portion). The hashed portion includes the beginning pattern and goes up to the ending pattern. To define both a beginning and ending pattern, use this command twice.

m. (Optional; CSM only) Use an SLB policy to control Layer 7 traffic:

IOS	N/A
CSM	(virtual-server) slb-policy policy-name

You can use one or more slb-policy commands to define policies that control how higher layer traffic is load balanced. The policy-name (text string) is the name of a policy that has been assigned in Step 4f. When multiple policies are listed, they are evaluated in sequential order. The highest-priority policy should be entered first.

n. Allow SLB to begin using the virtual server:

IOS	(virtual-server) inservice [standby group-name]
CSM	(virtual-server) inservice

By default, the virtual server is not used by SLB unless it is placed in service. To remove a virtual server from service, use no inservice.

TIP

You can use multiple IOS SLB devices to provide redundancy for virtual servers. IOS SLB stateless backup allows each SLB device to listen to HSRP messages from Layer 3 interfaces on redundant switches. When one switch (and its IOS SLB) fails, another HSRP interface becomes the primary gateway. When the other IOS SLB also detects the failure, the virtual servers that are associated with the HSRP group-name (defined above) become active. No SLB state information is kept, however, so existing connections are dropped and must be reestablished.

Stateless backup requires that HSRP be configured on all the redundant Layer 3 devices on the server-side VLAN. Be sure that the group-name matches between the HSRP and virtual server configurations. See section "8-6: Router Redundancy with HSRP" for further HSRP configuration information.

o. (Optional) Use SLB stateful backup:

IOS	[View full width] (virtual-server) replicate casa listening-ip remote-ip port-number [interval] [password [0|7] password [timeout]]
CSM	(virtual-server) replicate csrp {sticky | connection}

IOS SLB replicates and exchanges its load-sharing decision tables with other stateful backup devices using the Cisco Appliance Services Architecture (CASA) mechanism. When a failure occurs, the backup SLB device already has the current state information and can immediately take over.

This information is sent from the listening-ip address (an interface on the local device) to the remote-ip address (an interface on the backup device), using TCP port port-number (1 to 65,535). Replication messages are sent at interval seconds (1 to 300, default 10).

A password (text string; use 0 if unencrypted, the default, or 7 if encrypted) can be used for MD5 authentication with the backup device. The optional timeout (0 to 65,535 seconds; default 180 seconds) defines a time period when the password can be migrated from an old value to a new one. During this time, both old and new passwords are accepted.

CSM replicates its connection information using the Content Switching Replication Protocol (CSRP). The sticky connection database or the regular connection database can be replicated. To replicate both, choose each one in a separate replicate csrp command.

6.

(Optional) Use SLB Dynamic Feedback Protocol (DFP).

a. (Optional) Use the DFP manager to communicate with DFP agents on servers.

- Enable the DFP manager:

IOS	[View full width] (global) ip slb dfp [password [0|7] password [timeout]]
CSM	(csm) dfp [password password [timeout]]

The router can become a DFP load-balancing manager. DFP can be configured with a password (text string; use 0 if unencrypted, the default, or 7 if encrypted) for MD5 authentication with a host agent. The optional timeout (0 to 65,535 seconds; default 180 seconds) defines a time period when the password can be migrated from an old value to a new one. During this time, both old and new passwords are accepted.

- Specify a DFP agent:

IOS	[View full width] (slb-dfp) agent ip-address port-number [timeout [retry-count [retry-interval]]]
CSM	[View full width] (dfp) agent ip-address port-number [timeout [retry-count [retry-interval]]]

A DFP agent on a real server is identified by its ip-address and the port-number number used. The DFP agent (the server) must contact the DFP manager (the IOS SLB device) at timeout intervals (0 to 65,535 seconds; default 0 seconds or no timeout period). The DFP manager attempts to reconnect to the agent retry-count (0 to 65,535 retries; default 0 retries or an infinite number) times, at intervals of retry-interval (1 to 65,535 seconds; default 180 seconds).

b. (Optional) Use a DFP agent to provide DFP reports.

- Define the agent:

IOS	(global) ip dfp agent subsystem-name
CSM	N/A

The DFP agent sends periodic reports to its manager, a distributeddirector device. The subsystem-name (text string up to 15 characters) allows the manager to associate the server reports with a subsystem (controlled by the SLB device) for global load balancing. To see what subsystem-name values are available from the global manager, use the ip dfp agent ? command.

- (Optional) Set a DFP agent password:

IOS	(dfp) password [0|7] password [timeout]
CSM	N/A

A password (text string; use 0 if unencrypted, the default, or 7 if encrypted) can be used for MD5 authentication with a DFP manager. The optional timeout (0 to 65,535 seconds; default 180 seconds) defines a time period when the password can be migrated from an old value to a new one. During this time, both old and new passwords are accepted.

- Set the DFP port number:

IOS	(dfp) port port-number
CSM	(dfp) manager port-number

The DFP manager and agents communicate over a common port number, port-number (1 to 65535, no default). DFP managers discover their agents dynamically, requiring the port number to be identical between the manager (distributed director) and the agents (IOS SLB).

- (Optional) Set the interval for recalculating weights:

IOS	(dfp) interval seconds
CSM	N/A

DFP server weights are recalculated at an interval of seconds (5 to 65,535 seconds; default 10 seconds) before they are supplied to the DFP manager.

- Enable the DFP agent:

IOS	(dfp) inservice
CSM	N/A

By default, the DFP agent is disabled.

SLB Example

See Figure 10-2 for a network diagram. SLB is configured to provide load balancing for two server farms: FARM1 and FARM2.

Figure 10-2. Network Diagram for the SLB Example

FARM1 is a server farm of three real web servers having IP addresses 192.168.250.10, 192.168.250.11, and 192.168.250.12. The real servers are considered in a "failed" state if four consecutive TCP connections cannot be established with the server. SLB waits 30 seconds before attempting another connection to a failed server. (The number of failed TCP connections and the retry interval are only supported in the IOS command set.) An HTTP probe is configured to try a connection to each real server in the server farm every 120 seconds.

The virtual server VSERVER1 at 10.10.10.101 uses the weighted least connections algorithm for load balancing between the real servers. New connections are made sticky (passed to the real server last used by the same client) for 60 seconds.

The CSM version of this example also includes the client and server-side VLAN numbers (10 and 20) and IP addresses (10.10.10.2 and 192.168.250.1).

One server is given a weight of 32, one server has a weight of 16, and one server has a weight of 8. New connections are assigned to the server with the least number of active connections, as measured by the server capacities. For example, server 192.168.254.10 has a weight of 32, and a capacity of 32/(32+16+8) or 32/56. Server 192.168.254.11 has a weight of 16 and a capacity of 16/(32+16+8) or 16/56. Server 192.168.254.12 has a weight of 8 and a capacity of 8/(32+16+8) or 8/56. At any given time, the server with the number of active connections furthest below its capacity is given a new connection.

The configuration that follows shows the commands that are necessary for server farm FARM1 and virtual server VSERVER1. The same configuration is shown for an IOS-based switch and a CSM module.

IOS

(global) ip slb serverfarm FARM1 (server-farm) predictor leastconns (server-farm) nat server (server-farm) probe HTTP1 (server-farm) real 192.168.250.10 (real-server) weight 32 (real-server) faildetect numconns 4 (real-server) retry 30 (real-server) inservice (real-server) exit (server-farm) real 192.168.250.11 (real-server) weight 16 (real-server) faildetect numconns 4 (real-server) retry 30 (real-server) inservice (real-server) exit (server-farm) real 192.168.250.12 (real-server) weight 8 (real-server) faildetect numconns 4 (real-server) retry 30 (real-server) inservice (real-server) exit (global) ip slb vserver VSERVER1 (virtual-server) serverfarm FARM1 (virtual-server) virtual 10.10.10.101 tcp www (virtual-server) sticky 60 group 1 (virtual-server) advertise active (virtual-server) inservice (virtual-server) exit (global) ip slb dfp password 0 test123 (slb-dfp) agent 192.168.250.10 2000 (slb-dfp) agent 192.168.250.11 2000 (slb-dfp) agent 192.168.250.12 2000 (slb-dfp) exit (global) probe HTTP1 http (probe) interval 120 (probe) port 80 (probe) request method get (probe) exit

CSM

(global) module csm 3 (csm) vlan 10 client (csm-vlan) ip address 10.10.10.2 255.255.255.0 (csm-vlan) gateway 10.10.10.1 (csm-vlan) exit (csm) vlan 20 server (csm-vlan) ip address 192.168.250.1 255.255.255.0 (csm-vlan) exit (csm) serverfarm FARM1 (server-farm) predictor leastconns (server-farm) nat server (server-farm) probe HTTP1 (server-farm) real 192.168.250.10 (real-server) weight 32 (real-server) inservice (real-server) exit (server-farm) real 192.168.250.11 (real-server) weight 16 (real-server) inservice (real-server) exit (server-farm) real 192.168.250.12 (real-server) weight 8 (real-server) exit (csm) vserver VSERVER1 (virtual-server) serverfarm FARM1 (virtual-server) virtual 10.10.10.101 tcp www (virtual-server) sticky 60 group 1 (virtual-server) advertise active (virtual-server) inservice (virtual-server) exit (csm) dfp password test123 (dfp) agent 192.168.250.10 2000 (dfp) agent 192.168.250.11 2000 (dfp) agent 192.168.250.12 2000 (dfp) exit (csm) probe HTTP1 http (probe) interval 120 (probe) request method get (probe) exit

FARM2, the second server farm, is made up of two real servers at 192.168.250.13 and 192.168.250.101. The IOS SLB device is configured for the default round-robin load balancing. The CSM, however, offers more options. The URL hash load-balancing algorithm is used instead. HTTP probe HTTP2 tests GET operations to the real servers every 60 seconds. A server is moved to the failed state if five probes fail.

The virtual server VSERVER2 is assigned to 10.10.10.102 for HTTP traffic. The CSM is configured to use two load-balancing policies for the virtual server. Policy1 uses URL map URL1 to match against URLs that have either /signup/* or /support/*. Sticky SSL connections are also matched. Policy2 uses cookie map Cart to match against the cookie name mystore containing the cookie value Shop*. Policy2 also matches against sticky connections that have cookies named test.

The configuration that follows shows the commands that are necessary for server farm FARM2 and virtual server VSERVER2.

IOS

(global) ip slb serverfarm FARM2 (server-farm) predictor roundrobin (server-farm) nat server (server-farm) probe HTTP2 (server-farm) real 192.168.250.13 (real-server) inservice (real-server) exit (server-farm) real 192.168.250.101 (real-server) inservice (real-server) exit (global) ip slb vserver VSERVER2 (virtual-server) serverfarm FARM2 (virtual-server) virtual 10.10.10.102 tcp 80 (virtual-server) inservice (virtual-server) exit (csm) probe HTTP2 http (probe) credentials testuser test123 (probe) request method get /home (probe) interval 60 (probe) faildetect 5

CSM

[View full width] (csm) serverfarm FARM2 (server-farm) predictor hash url (server-farm) nat server (server-farm) probe HTTP2 (server-farm) real 192.168.250.13 (real-server) inservice (real-server) exit (server-farm) real 192.168.250.101 (real-server) inservice real-server) exit (csm) vserver VSERVER2 (virtual-server) serverfarm FARM2 (virtual-server) virtual 10.10.10.102 tcp 80 (virtual-server) slb-policy Policy1 (virtual-server) slb-policy Policy2 (virtual-server) inservice (virtual-server) exit (csm) map Cart cookie (map-cookie) match protocol http cookie mystore cookie-value Shop* (map-cookie) exit (csm) map URL1 url (map-url) match protocol http url /signup/* (map-url) match protocol http url /support/* (map-url) exit (csm) sticky 1 ssl (csm) sticky 2 cookie test (csm) policy Policy1 (policy) url-map URL1 (policy) sticky-group 1 (policy) serverfarm FARM2 (policy) exit (csm) policy Policy2 (policy) cookie-map Cart (policy) sticky-group 2 (policy) serverfarm FARM2 (policy) exit (csm) probe HTTP2 http (probe) credentials testuser test123 (probe) request method get /home (probe) interval 60 (probe) retries 5 (probe) exit

Displaying Information About SLB

Table 10-1 lists some switch commands that you can use to display helpful information about SLB configuration and status.

Table 10-1. Commands to Display Server Load-Balancing Configuration and Status Information

Display Function	Switch OS	Command
VLAN assignment	IOS	N/A
	CSM	[View full width] (exec) show module csm slot vlan [client | server | ft] [id vlan-id] [detail]
Server farms	IOS	[View full width] (exec) show ip slb serverfarms [name serverfarm-name] [detail]
	CSM	[View full width] (exec) show module csm slot serverfarms [name serverfarm-name] [detail]
Real servers	IOS	[View full width] (exec) show ip slb reals [vserver virtual-server-name] [detail]
	CSM	[View full width] (exec) show module csm slot real [sfarm sfarm-name] [detail]
CSM policies	IOS	N/A
	CSM	(exec) show module csm slot policy [name policy-name]
Virtual servers	IOS	[View full width] (exec) show ip slb vserver [name virtual-server-name] [detail]
	CSM	(exec) show module csm slot vserver [detail]
Virtual redirect servers	IOS	N/A
	CSM	(exec) show module csm slot vserver redirect
SLB connections	IOS	[View full width] (exec) show ip slb conns [vserver virtual-server-name | client ip-address] [detail]
	CSM	[View full width] (exec) show module csm slot conns [vserver virtserver-name] [client ip-address] [detail]
DFP status	IOS	[View full width] (exec) show ip slb dfp [agent agent-ip-address port-number | manager manager-ip-address | detail | weights]
	CSM	[View full width] (exec) show module csm slot dfp [agent [detail | ip-address port] | manager [ip-addr] | detail | weights]
SLB redundancy	IOS	(exec) show ip slb replicate
	CSM	(exec) show module csm slot ft [detail]
Probes	IOS	(exec) show ip slb probe [name probe_name] [detail]
	CSM	[View full width] (exec) show module csm slot probe [http | icmp | telnet | tcp | ftp | smtp | dns] [name probe_name] [detail]
SLB statistics	IOS	(exec) show ip slb stats
	CSM	(exec) show module csm slot stats