ace - comcore
TRANSCRIPT
Agenda• What is Load Balancing• Why and When to use Load Balancing?• The Use of Load Balancers• Load balancer Enhancement• Type of Load Balancers• Load Balancing Concepts • Application Traffic and Suggested Predictors• Layer 4 Versus Layer 7 Switching• Connection Management• Address Translation and Load Balancing• Offloading Servers
– SSL Offload– TCP Offload– HTTP Compression
Agenda
• Application Environment Independency • ACE Virtual Contexts• ACE Physical Connections• ACE VC Creation and Allocation• Integrating ACE VC in DC Environment • Allowing Management Traffic• LOAD BALANCING CONFIGURATION• Virtual Context Fault Tolerance
Training Prerequisites
• Understanding the Normal Network Design• Understanding of Virtualization• Understanding & Experience with Layer2 Switching• Understanding & Experience with Routing
Load Balancing
What is Load balancing• Load balancing is a method for distributing workloads across multiple
computing resources. • Load balancing aims to optimize resource use, maximize throughput, minimize
response time, and avoid overload of any one of the resources.• Load balancing is not meant to be sharing the load only but also to provide
redundancy.– Server Load Balancing– Network Load Balancing
• Never seen before? You did ;)– Look at you on two legs? One leg can be much loaded, other leg does load
balancing plus provides you redundancy ..kidding– When you open Google.com does it go to same server all the time No
because there is load balancing in a form (CDN)try –nslookup:
Why and When?• Why and When to use Load Balancing?
– Load balancing, by its very nature, is the solution for more than one problem. Today you might have application on a single server when the need begins to arise you might either need to upgrade server or Application on multiple servers, that’s where Load balancing comes in to the play- It offers below benefits:
• Limiting your points of failure Failover and redundancy• Load Distribution. Growing beyond a single server configuration:
The Use of Load Balancers• Dedicated network load balancers have been heavily used since second
half of the 1990s• They were created to scale the performance of websites, and their use has
increased in data centers as they incorporate new features and functions.• They were Originally created to improve Server load balancing for DNS to
provide better response to each client requesting for name resolution.
Load balancer Enhancement• DNS load balancing can be easily deployed but had lot of problems like:
– The DNS servers are not aware of the application state in the balanced servers. Clients may receive the IP address of a failed server
– The load-balancing service DNS servers can provide does not take into account any load information from the balanced servers. Can easily overload a server.
– A DNS request does not specify which type of traffic the client will use afterward or the type of device (tablet, phone, or desktop) the client is. Hence, the choice of the best server cannot be defined by these parameters.
• A complete load-balancing paradigm was made available with the creation of hardware-based load balancers- Layers 4 to 7 parameters– TCP destination port– UDP destination port– HTTP URL– HTTP session cookie– Strings recognized in the connection data
Type of Load Balancers• There are type of Load balancers based on the function they
have:
– Hardware Based• Local Load Balancers• Global Load Balancers
– Software Based• Local Load Balancers• Global Load Balancers
• Whereas a great variety of load-balancing devices exist in the market (and even inside Cisco), every load balancer deployment has common elements and definitions:– Real Servers: Represent the addresses from servers that will receive the sessions from
Load Balancer. Basically a Real Server e.g. a VM or a physical server
– A Server farm: Set of Real Servers that share the same application A real server can belong to multiple server farms.
• ****Server farm is not a Server cluster****. A cluster is defined as a set of servers with an additional layer of software that allows some kind of centralized administration and internal information sharing between its members. In contrast, a server farm simply characterizes a group of servers that have the same application, be they part of a cluster or not.
Load balancing Concepts
Load balancing Concepts (Cont.)• Probes: Are basically Synthetic requests the load balancer creates to check
whether an application is available on real server or serverfarm*. They can be ICMP echo requests or as sophisticated as a HTTP GET query
• THE Virtual IP or VIP: Is an address load balancer uses to receive Client connections. This IP address is provided by DNS servers as a Naming resolution to the application URL and advertised to clients. Is the Place all configuration of Load balancing is bound in single thread.
Load balancing Concepts (Cont.)• The Stickiness Table: which is an optional element that can store client
information during its first access. The load balancer can use this information to always forward the client subsequent connections to the first selected server, thus maintaining session states inside the same server. Examples of stored client information are source IP address, HTTP cookies, and special strings.
• Predictor: A Method used to distribute the traffic between Servers in Serverfarm, Wide options are available in predictors , Round Robin is Default in ACE:– Round Robin– Least Connection– Least Load– Hashing– Many Others URL basis etc.
Load balancing Concepts (Cont.)
Application Traffic and Suggested Predictors
Layer 4 versus Layer 7 Switching• When a LB receives a new connection on a VIP – It selects server farm based on
the client connection parameters e.g. IP address, IP protocol, TCP/UDP Protocol, Cookies etc.
– Layer 4 – When a LB is performing L4 switching, all the information it needs to select the best server for a new connection is contained in the TCP SYN (or UDP first data gram). The LB does not consider connections differently that have different parameter in data payload.
Layer 4 versus Layer 7 Switching
Layer 4 versus Layer 7 Switching• Layer 7 Switching: A LB must perform decision beyond the transport protocol. Server
selection must wait until the client sends relevant information from the session, presentation or application layer. The LB becomes a transparent TCP proxy, establishing the connection with the client on behalf of the real servers. The spoofing process is called “Delayed Binding” or “Proxy connection”.
• Layer 7 switching happens when the load balancer forwards a connection to a server using the information obtained from upper layer (5,6 and 7) of the OSI
Layer 4 versus Layer 7 Switching
Connection Management• Layer 4 – In this scenario the LB must co-ordinate rewrite on Ethernet, IP, and TCP/UDP
information from the original client connection to the communication with the selected server (After all, they all connect to VIP)
• Layer 7 – LB needs to control two completely different connections, with distinct parameters such as checksum and sequence calculation. The co-ordination between these called “Splicing”
• In some cases LB is required to do more connection management than this where LB is directly dispatching connection
• LB can do Symmetric and Asymmetric Connection management:– Symmetric – All Packets, be that from Client or Selected server always reach the LB. Because LB is aware of the entire
communication, it can deploy more advanced server load-balancing features such as Layer 7 switching, IP address translation, and header manipulation. This is MOST popular connection management mechanism.
– Asymmetric – When only part of connection traverse the LB, this method is advantage of not overloading LB from excessive return traffic from servers (such as video streaming etc) BUT LB can only see one side of traffic that is client Server, multiple load balance features cannot be deployed such as address and port translation. Timeout for TCP connections are usually configured in the LB because it will never receive FIN from server.
Connection Management
Connection Management
Address Translation and Load Balancing
• Deploying NAT and PAT is fairly easy for the devices can handle the upper layer parameters such as HTTP URLs: – Server NAT (Symmetric) - Good when you have Servers on Private IP Addressing – DUAL NAT – To Hide Source and Destination both– Port Redirection – Servers receiving connection on non standard ports– Transparent
• Explanation is on other slides –– Phase 1- Client to Load Balancer – Phase 2 – Load Balancer to Server– Phase 3 – Server to LB– Phase 4 – LB to Client
Address Translation and Load Balancing
Address Translation and Load Balancing
Address Translation and Load Balancing
Address Translation and Load Balancing
Offloading Servers• Load Balancers can also provide additional services to servers, offloading them
from hardware-comsuming operations. The most common offload service they provide are encryption, Authentication, connection processing and compression.
• It allows server resources to the main application enabling better response time and performance to the users
• Below are 3 advance offload services that a LB can provide:– SSL Offload– TCP offload– HTTP Compression
SSL Offload• SSL Offload: SSL is a protocol created by Netscape in 1990s, that provide security
for Internet connections. SSL ensures CAI (Confidentiality, Authentication and Integrity) – In 1999 IETF introduced standard version of SSL is called TLS
• Both SSL and TLS act between Transport and Session Layer • After TCP session is established between a client and server, the SSL connection
participates performing key exchanges, and negotiates appropriated encryption algorithm.
• When SSL connection is established, the upper layer protocol can now send data using SSL as its own security transport Layer. The Most protocol used over SSL is HTTP
• SSL offload relieves server from intensive encryption processing. The benefits would be:
– Total offload of encryption from servers– Layer 5 to 7 awareness for Layer 7 switching in SSL connection– Saving on public certificates as only LB would need it real servers would not
SSL Offload
SSL Offload• A LB can perform SSL offload can act as an SSL server to the client, an SSL client to
the server, or both. Three deployment options for SSL:
TCP Offload• When a server is performing TCP communication it must execute below:
– Connection Establishment (3 Way handshake)– Acknowledgements of the Segments– Checksum and sequence number calculation– Sliding window calculation– Congestion control– Connection termination
• Depending on number and characteristics of the connection server can spend great part of its CPU, Memory and other resources.
• A LB can use its Connection management feature to offload web servers from TCP excessive processing.
• Instead of dealing with the totality of the session sent by the users, a LB can send all the data from the connections inside one or two connections for this server. This is known as “TCP Reuse” or “TCP Multiplexing”
TCP Offload
HTTP Compression• The Majority of Webservers and browsers have the capability to, compress and
uncompressed transmitted objects in order to:– Better use the available B/W for both of them– Improve the Web Page response time
• The most common compression used by browsers are GZIP and Deflate. The compress operation usually consume considerable server resources like CPU, Memory.
• Amount of Compression object could seriously damage application performance of a Web server
• In this case LB could observe the which type of compression mechanism is used by the client browser on behalf of Web server, compresses all objects to this client.
Application Environment Independency
• Multi-tier applications are very common in most of the corporate DCs. The Client-Server popular Architecture separates functions among groups of the server to create flexible application, where a server tier can be easily be replaced or rewritten.
– Presentation Tier– This layer is responsible for front end communication with the clients, and generally uses Web technology – Web servers
– Application Tier – This is group of servers controls the Business logic– Data Tier – This is where information is stored and retrieved, DB servers are usually the components
of the Tier
Application Environment Independency
• When a DC houses lots of independent customers, the number of required LB can be even be bigger. These are called Multitenant Data Centers, and they can belong to Service provider or to the Parent corporation.
• This requirement can mean the separate devices for different customer environments, especially if the deployed LB do not have any form of management isolation of configuration elements such as real servers, server farms, Probes, and VIP.
• However it might be possible that single customer requirement is way lesser than what a LB can handle basically using Same LB but separation of management plane to manage multiple customers.
ACE Virtual Contexts• Cisco created first hardware-based load balancer in 1996, it was called CLD (Cisco Local Director), in 2000
successor came called CSS (Cisco Service Switches) 11000 and CSM Module for CAT 6500 Switches.• To address challenge of low utilization explained in last sheet, Cisco created concept of Virtual Contexts
and applied it in ACE product series. • An ACE Virtual Context is an abstraction of an independent LB with its own interfaces, configuration and
policies and administrators. • ACE normally can handle 250 Virtual contexts • The Creation and configuration of Virtual contexts are done through management access built in Admin
Context• The “Admin“ context is automatically created when an ACE is configured for the first time. • It is NOT recommended to use “admin” context for LB• ACE 4710 can have 20 VC• ACE Module can have 250 VC
ACE Virtual Contexts
ACE Physical Connection• Each ACE form factor has different ways to connect to network:
– Connecting ACE Appliance: • ACE 4710 has four 1000BASE-T Gig Interfaces• These interfaces can be connected to a single switch or up to four different switches
ACE Physical Connection ACE 4710 Config
ACE Physical Connection Switch Side
ACE Physical Connection ACE Module:
ACE VC Creation and Allocation
ACE Basic Commands
• Moving between Contexts:
• Verifying Contexts:
Integrating ACE VC in DC Environment
• A LB is a Network Service device must exchange traffic with a Network to Function properly
• ACE VC has SVIs and BVIs as oppose to Physical LB• A VLAN manipulation is only required to insert a VC• Main Three designs:
– Routed Mode – Bridge Mode– One Arm Mode
Routed Mode LB• A LB VC performs the function of a router, connecting different IP subnets• When an SVI is configured (Using Interface Vlan command with an IP address) the context is
automatically enables routed mode.• VIP can belong to either of the subnet (or even to different one) but it is mandatory that VIP
is routable for client • The Server response back to client Forced via ACE using Routing Protocols• Since VC acts as a router in between it is possible to assign RFC 1918 IP address range to
internal servers where VIP can have public IP addresses• ACE VC supports only Static Routing (No Dynamic Routing Protocols)
Routed Mode LB
Routed Mode LB
Bridge Mode LB• A LB VC performs the function of a Transparent Bridge• Learns the MAC addresses from the devices directly connected through ARP• When BVI Interface is configured the context automatically becomes bridge context• Each Context can only bridge two VLANs• Bridge Design permits Two VLANs to be mapped to single IP subnet• This Configuration forces response server traffic traverse the VC without tweaking• The BVI is accessible from both VLANs and can be used for management purposes
Bridge Mode LB
Bridge Mode LB
Bridge Mode LB• A LB VC performs the function of a Transparent Bridge• Learns the MAC addresses from the devices directly connected through ARP• When BVI Interface is configured the context automatically becomes bridge context• Each Context can only bridge two VLANs
One ARM Mode • You configure the ACE with a single VLAN that handles both client requests and server
responsesIt does not detect Client-server traffic• This design is useful when the LB traffic is small compared to total traffic sent to server• For Symmetric load balancing one of two methods must be chosen:
– DUAL NAT– Policy Based Routing also known as PBR
• In this design server detects an IP address from ACE VC as the source so the responses are directed back to the ACE VC
• Problem with this design is Server cannot see the original IP address from the client• However for HTTP connections, An ACE can insert the original client IP address in the HTTP
header that makes it possible for servers to know the client IP
One ARM Mode (NAT)
One ARM Mode (PBR)
Allowing Management Traffic• Create a Management Class map that defines the Management Protocol• Create a Policy Map that will permit the class map• Apply the policy map to an interface, to a group of interfaces, or to entire context• An Admin context also needs a similar config
Allowing Management Traffic• When you turn router on it starts to route packets• When you turn a FW on it starts to drop packets• When you turn a LB (ACE) on it starts to drop packets unless you specify• LB is a stateful device it keeps the track of the connections rather packets• ACE treats UDP flow as a connection (exchanged between Client and server with same port), • ACE Treats ICMP flow as connection•
LOAD BALANCING CONFIGURATION
REAL SERVER CONIFG
PROBE/SREVER FARM CONFIG
Layer 7 Class Map/Mobile Server Farm
Layer 7 Policy Map/Layer 4 Class Map
Multi-Match Policy Map
Virtual Context Fault Tolerance
Extra Links
Extra Links:
ACE 4710 - http://www.cisco.com/c/en/us/products/collateral/application-networking-services/ace-4710-application-control-engine/Data_Sheet_Cisco_ACE_4710.html
ACE 30 - http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/ace-application-control-engine-module/data_sheet_c78_632383.html
