Cisco ACE （第二篇）

lqmartin

ACE 桥接模式部署
ACE的桥接模式部署方式是最简单的，简单的说，就是inside和outside地址一样。
1 几个重要概念
Server Side：就是真正的Real Server地址段；
Client Side：就是外部访问的Real Server的地址段；
2 目标
Configure basic load balancing (Layer 3) where client traffic enters on one VLAN and is bridged to servers residing on a second VLAN, while the VIP and server IPs reside in the same network.
3 设计
Clients will send application requests through the MFSC, which routes them to a virtual IP address (VIP) within ACE.  The VIP used in this example resides in an ACE context which is configured with a client VLAN, a server VLAN, and a BVI to tie the VLANs together in a bridge-group.  Client requests will hit the VIP, ACE will pick the appropriate server, and then destination NAT the client request to send to the server.  The server will respond using the interface VLAN of MSFC as its default gateway to the client.  As the response traffic is bridged from the server VLAN to the client VLAN, ACE will change the source IP to be the VIP.  The MSFC will forward the response to the client.
4 配置
4.1 配置策略
ACE-1/bridged(config)# access-list everyone extended permit ip any any
ACE-1/bridged(config)# access-list everyone extended permit icmp any any

4.2 配置Real Server
ACE-1/bridged(config)# rserver lnx1
ACE-1/bridged(config-rserver-host)# ip add 172.16.3.11
ACE-1/bridged(config-rserver-host)# inservice
ACE-1/bridged(config-rserver-host)# rserver lnx2
ACE-1/bridged(config-rserver-host)# ip add 172.16.3.12
ACE-1/bridged(config-rserver-host)# inservice
ACE-1/bridged(config-rserver-host)# rserver lnx3
ACE-1/bridged(config-rserver-host)# ip add 172.16.3.13
ACE-1/bridged(config-rserver-host)# inservice
ACE-1/bridged(config-rserver-host)# rserver lnx4
ACE-1/bridged(config-rserver-host)# ip add 172.16.3.14
ACE-1/bridged(config-rserver-host)# inservice
ACE-1/bridged(config-rserver-host)# rserver lnx5
ACE-1/bridged(config-rserver-host)# ip add 172.16.3.15
ACE-1/bridged(config-rserver-host)# inservice


4.3 配置ServerFrame
ACE-1/bridged(config-cmap)# serverfarm web
ACE-1/bridged(config-sfarm-host)# rserver lnx1
ACE-1/bridged(config-sfarm-host-rs)# inservice
ACE-1/bridged(config-sfarm-host-rs)# rserver lnx2
ACE-1/bridged(config-sfarm-host-rs)# inservice
ACE-1/bridged(config-sfarm-host-rs)# rserver lnx3
ACE-1/bridged(config-sfarm-host-rs)# inservice
ACE-1/bridged(config-sfarm-host-rs)# rserver lnx4
ACE-1/bridged(config-sfarm-host-rs)# inservice

4.4 配置Class-map
ACE-1/bridged(config)# class-map slb-vip
ACE-1/bridged(config-cmap)# match virtual-address 172.16.3.100 any

4.5 配置policy-map
ACE-1/bridged(config)# policy-map type loadbalance http first-match slb
ACE-1/bridged(config-pmap-lb)# class class-default
ACE-1/bridged(config-pmap-lb-c)# serverfarm web
ACE-1/bridged(config)# policy-map multi-match client-vips
ACE-1/bridged(config-pmap)# class slb-vip
ACE-1/bridged(config-pmap-c)# loadbalance policy slb
ACE-1/bridged(config-pmap-c)# loadbalance vip inservice


4.6配置vlan
ACE-1/bridged(config)# interface vlan 30
ACE-1/bridged(config-if)# description “Client Side”
ACE-1/bridged(config-if)# bridge-group 3
ACE-1/bridged(config-if)# no shutdown

ACE-1/bridged(config-if)# interface vlan 31
ACE-1/bridged(config-if)# description “Server Side”
ACE-1/bridged(config-if)# bridge-group 3
ACE-1/bridged(config-if)# no shutdown

ACE-1/bridged(config-if)# interface bvi 3
ACE-1/bridged(config-if)# description “client – server bridge group”
ACE-1/bridged(config-if)# ip address 172.16.3.5 255.255.255.0

4.7应用policy-map
ACE-1/bridged(config)# interface vlan 30
ACE-1/bridged(config-if)# access-group input everyone
ACE-1/bridged(config-if)# service-policy input client-vips




本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/24661/showart_2112522.html