06 SLB服务器虚拟化

d3interspace

06 SLB服务器虚拟化

1. 配置接口地址及加入安全区
   
2. <USG6000V1>system-view
   
3. [USG6000V1]sysname fw
   
4. [fw]interface gigabitethernet 1/0/0
   
5. [fw-GigabitEthernet1/0/0]ip address 172.16.10.1 24
   
6. [fw-GigabitEthernet1/0/0]interface gigabitethernet 1/0/1
   
7. [fw-GigabitEthernet1/0/1]ip address 1.1.1.2 29
   
8. [fw-GigabitEthernet1/0/1]quit
   
9. [fw]firewall zone dmz
   
10. [fw-zone-dmz]add interface gigabitethernet 1/0/0
    
11. [fw-zone-dmz]firewall zone untrust
    
12. [fw-zone-untrust]add interface gigabitethernet 1/0/1
    
13. [fw-zone-untrust]quit
    
14. 配置NAT-easyip
    
15. [fw]nat-policy
    
16. [fw-policy-nat]rule name dmz-untrust
    
17. [fw-policy-nat-rule-dmz-untrust]source-zone dmz
    
18. [fw-policy-nat-rule-dmz-untrust]destination-zone untrust
    
19. [fw-policy-nat-rule-dmz-untrust]source-address 172.16.10.0 24
    
20. [fw-policy-nat-rule-dmz-untrust]action source-nat easy-ip
    
21. [fw-policy-nat-rule-dmz-untrust]quit
    
22. [fw-policy-nat]quit
    
23. 配置安全策略
    
24. [fw]security-policy
    
25. [fw-policy-security]rule name untrust-dmz
    
26. [fw-policy-security-rule-untrust-dmz]source-zone untrust
    
27. [fw-policy-security-rule-untrust-dmz]destination-zone dmz
    
28. [fw-policy-security-rule-untrust-dmz]destination-address range 172.16.10.100 172.16.10.102
    
29. [fw-policy-security-rule-untrust-dmz]action permit
    
30. [fw-policy-security-rule-untrust-dmz]quit
    
31. [fw-policy-security]quit
    
32. [fw]security-policy
    
33. [fw-policy-security]rule name dmz-untrust
    
34. [fw-policy-security-rule-dmz-untrust]source-zone dmz
    
35. [fw-policy-security-rule-dmz-untrust]destination-zone untrust
    
36. [fw-policy-security-rule-dmz-untrust]source-address 172.16.10.0 24
    
37. [fw-policy-security-rule-dmz-untrust]action permit
    
38. [fw-policy-security-rule-dmz-untrust]quit
    
39. [fw-policy-security]quit
    
40. [fw]security-policy
    
41. [fw-policy-security]rule name local-dmz
    
42. [fw-policy-security-rule-local-dmz]source-zone local
    
43. [fw-policy-security-rule-local-dmz]destination-zone dmz
    
44. [fw-policy-security-rule-local-dmz]destination-address 1.1.1.2 32
    
45. [fw-policy-security-rule-local-dmz]destination-address range 172.16.10.100 172.16.10.102
    
46. [fw-policy-security-rule-local-dmz]action permit
    
47. [fw-policy-security-rule-local-dmz]quit
    
48. [fw-policy-security]quit
    
49. 配置默认路由
    
50. [fw]ip route-static 0.0.0.0 0.0.0.0 1.1.1.1
    
51. 
    
52. 配置SLB
    
53. [fw]slb enable  //开启服务器负载均衡功能
    
54. 配置会话保持
    
55. [fw]slb  //进入SLB视图
    
56. [fw-slb]persistence 0 zurkj  //配置会话保持
    
57. [fw-slb-persistence-0]type cookie-insert aging-time 600   //配置老化时间
    
58. [fw-slb-persistence-0]quit
    
59. 配置负载均衡算法
    
60. [fw-slb]group 0 zurkj  //创建组并命名
    
61. [fw-slb-group-0]metric weight-roundrobin  //配置为加权轮循算法
    
62. 配置实体服务器的IP地址端口及权重比
    
63. [fw-slb-group-0]rserver 0 rip 172.16.10.100 port 80 weight 3 description server1
    
64. [fw-slb-group-0]rserver 1 rip 172.16.10.101 port 80 weight 3 description server2
    
65. [fw-slb-group-0]rserver 2 rip 172.16.10.102 port 80 weight 1 description server3
    
66. 配置健康检查功能
    
67. [fw-slb-group-0]health-check type icmp tx-interval 5 times 3   //通过PING方式
    
68. [fw-slb-group-0]quit
    
69. 配置虚拟服务器
    
70. [fw-slb]vserver 0 zurkj  //创建虚拟服务器
    
71. [fw-slb-vserver-0]protocol http   //配置虚拟服务器协议类型为HTTP
    
72. [fw-slb-vserver-0]vip 0 1.1.1.2   //配置虚拟服务器IP
    
73. [fw-slb-vserver-0]vport 65535   //配置虚拟服务器端口号
    
74. [fw-slb-vserver-0]persistence zurkj  //虚拟服务器引用zurkj的会话保持
    
75. [fw-slb-vserver-0]group zurkj  //虚拟服务器引用实体服务器组zurkj
    
76. [fw-slb-vserver-0]quit
    
77. [fw-slb]quit
    
78. 查看会话
    
79. [fw1]display firewall server-map
    
80. [fw1]display firewall session table
    
81. [fw1]display firewall session table verbose
    
82. 清除会话表
    
83. [fw]diagnose   //诊断
    
84. [fw-diagnose]reset firewall server-map   //重置防火墙会话表
    
85. [fw-diagnose]quit

复制代码