Cisco ACE （第二篇）

ACE 桥接模式部署

ACE的桥接模式部署方式是最简单的，简单的说，就是inside和outside地址一样。

1 几个重要概念

Server Side：就是真正的Real Server地址段；

Client Side：就是外部访问的Real Server的地址段；

2 目标

Configure basic load balancing (Layer 3) where client traffic enters on one VLAN and is bridged to servers residing on a second VLAN, while the VIP and server IPs reside in the same network.

3 设计

Clients will send application requests through the MFSC, which routes them to a virtual IP address (VIP) within ACE.  The VIP used in this example resides in an ACE context which is configured with a client VLAN, a server VLAN, and a BVI to tie the VLANs together in a bridge-group.  Client requests will hit the VIP, ACE will pick the appropriate server, and then destination NAT the client request to send to the server.  The server will respond using the interface VLAN of MSFC as its default gateway to the client.  As the response traffic is bridged from the server VLAN to the client VLAN, ACE will change the source IP to be the VIP.  The MSFC will forward the response to the client.

4 配置

4.1 配置策略

ACE-1/bridged(config)# access-list everyone extended permit ip any any

ACE-1/bridged(config)# access-list everyone extended permit icmp any any

 

4.2 配置Real Server

ACE-1/bridged(config)# rserver lnx1

ACE-1/bridged(config-rserver-host)# ip add 172.16.3.11

ACE-1/bridged(config-rserver-host)# inservice

ACE-1/bridged(config-rserver-host)# rserver lnx2

ACE-1/bridged(config-rserver-host)# ip add 172.16.3.12

ACE-1/bridged(config-rserver-host)# inservice

ACE-1/bridged(config-rserver-host)# rserver lnx3

ACE-1/bridged(config-rserver-host)# ip add 172.16.3.13

ACE-1/bridged(config-rserver-host)# inservice

ACE-1/bridged(config-rserver-host)# rserver lnx4

ACE-1/bridged(config-rserver-host)# ip add 172.16.3.14

ACE-1/bridged(config-rserver-host)# inservice

ACE-1/bridged(config-rserver-host)# rserver lnx5

ACE-1/bridged(config-rserver-host)# ip add 172.16.3.15

ACE-1/bridged(config-rserver-host)# inservice

 

 

4.3 配置ServerFrame

ACE-1/bridged(config-cmap)# serverfarm web

ACE-1/bridged(config-sfarm-host)# rserver lnx1

ACE-1/bridged(config-sfarm-host-rs)# inservice

ACE-1/bridged(config-sfarm-host-rs)# rserver lnx2

ACE-1/bridged(config-sfarm-host-rs)# inservice

ACE-1/bridged(config-sfarm-host-rs)# rserver lnx3

ACE-1/bridged(config-sfarm-host-rs)# inservice

ACE-1/bridged(config-sfarm-host-rs)# rserver lnx4

ACE-1/bridged(config-sfarm-host-rs)# inservice

 

4.4 配置Class-map

ACE-1/bridged(config)# class-map slb-vip

ACE-1/bridged(config-cmap)# match virtual-address 172.16.3.100 any

 

4.5 配置policy-map

ACE-1/bridged(config)# policy-map type loadbalance http first-match slb

ACE-1/bridged(config-pmap-lb)# class class-default

ACE-1/bridged(config-pmap-lb-c)# serverfarm web

ACE-1/bridged(config)# policy-map multi-match client-vips

ACE-1/bridged(config-pmap)# class slb-vip

ACE-1/bridged(config-pmap-c)# loadbalance policy slb

ACE-1/bridged(config-pmap-c)# loadbalance vip inservice

 

 

4.6配置vlan

ACE-1/bridged(config)# interface vlan 30

ACE-1/bridged(config-if)# description “Client Side”

ACE-1/bridged(config-if)# no shutdown

 

ACE-1/bridged(config-if)# interface vlan 31

ACE-1/bridged(config-if)# description “Server Side”

ACE-1/bridged(config-if)# bridge-group 3

ACE-1/bridged(config-if)# no shutdown

 

ACE-1/bridged(config-if)# interface bvi 3

ACE-1/bridged(config-if)# description “client – server bridge group”

ACE-1/bridged(config-if)# ip address 172.16.3.5 255.255.255.0

 

4.7应用policy-map

ACE-1/bridged(config)# interface vlan 30

ACE-1/bridged(config-if)# access-group input everyone

ACE-1/bridged(config-if)# service-policy input client-vips