ans Single VIP LLB and SLB config

ans Single VIP LLB and SLB config

配置命令：

# 配置设备工作模式和开启的功能
> enable ans mode FR MBF Edge USNIP L3 PMTUD
 Done
> enable ans feature WL LB CS SSL IPv6PT CH
 Done
> 

# 设置设备的管理IP ( 需要重启系统才可生效, 重启系统前请先保存配置. save ansconfig )
> set ans config -IPAddress 192.168.11.11 -netmask 255.255.255.0
 Done
> 

# 设置用于连通内网的SNIP地址 ( enable ans mode usnip )
> add ans ip 192.168.11.1 255.255.255.0 -mgmtAccess ENABLED -restrictAccess ENABLED
 Done
> 

# 设置设备主机名
> set ans hostName SURFILTER
 Done
> 

# 设置时区
> set ans param -cookieversion  -timezone "GMT+08:00-CST-Asia/Shanghai"
 Done
> set audit syslogparams -timeZone LOCAL_TIME
 Done
> set audit anslogParams -timeZone LoCAL_TIME
 Done
> 

# 设置时间, 格式为: YYYYmmddHHMM 注意时区是否正确
> shell date
Mon Dec  :: CST
 Done
> shell date +'%Y-%m-%d %H:%M:%S'
-- ::
 Done
> 

# 添加NTP服务器 ( 非常规操作方式, 直接修改NTP配置文件 )
> shell vi /etc/ntp.conf
# Common elements of NTP configuration
#
# Do not edit: changes will be lost following reboot.
# For site-specific NTP configuration, see the instructions in /etc/ntp.conf
#

# We won't allow *anything* from hosts not listed in the configuration
# This means you need a restrict line for each server
restrict default ignore
restrict - default ignore

# Allow just about anything from localhost, IPv4.
restrict 127.0.0.1 mask 255.255.255.255

driftfile /var/db/ntp.drift
logfile /var/log/ntpd.log

# Log everything, even from ntpd (which otherwise defaults to "all =sync")
logconfig =all +all

#######################

server 218.75.4.130 minpoll  maxpoll
restrict 218.75.4.130 nomodify notrap nopeer noquery

~
~
~
:wq!
 Done
> 
> shell cp /etc/ntp.conf /flash/anscfg/ntp.conf
 Done
> 

# 设置DNS服务器解析配置文件
> shell vi /etc/resolv.conf
# Do not change this entry, use the 'add nameserver'
nameserver 127.0.0.2

~
~
~
:wq!
> shell cp /etc/resolv.conf /flash/anscfg/resolv.conf
 Done
>
# 启动NTP服务器
> enable ntp sync
 Done
>

# 添加DNS服务器
> add dns nameServer 8.8.4.4
 Done
> 

# 设置默认证书链接关系
> add ssl certKey hg-root-certificate -cert hg-root.cert -inform PEM
 Done
> add ssl certKey hg-server-certificate -cert hg-server.cert -key hg-server.key -inform PEM
 Done
> link ssl certKey hg-server-certificate hg-root-certificate
 Done
> 
# 添加用于连通ISP的VIP地址
> add ans ip 192.168.110.41 255.255.255.0 -type VIP
 Done
> add ans ip 192.168.120.45 255.255.255.0 -type VIP
 Done
> 

# 添加 VLAN
> add vlan
 Done
> add vlan
 Done
> bind vlan  -ifnum /
 Done
> bind vlan  -IPAddress 192.168.110.41 255.255.255.0
 Done
> bind vlan  -ifnum /
 Done
> bind vlan  -IPAddress 192.168.120.45 255.255.255.0
 Done
> 

# 设置针对内网的反向NAT
> set rnat 192.168.11.0 255.255.255.0 -natIP 192.168.110.41
 Done
> set rnat 192.168.11.0 255.255.255.0 -natIP 192.168.120.45
 Done
> 

# 添加 NetProfile , 绑定 SNIP
> add netProfile net_pf_internal -srcIP 192.168.11.1
 Done
> 

# 添加ISP网关服务器地址
> add server srv_isp_ct 192.168.110.1
 Done
> add server srv_isp_cnc 192.168.210.1
 Done
> 

# 添加ISP监视器
> add lb monitor mon_ping_net_pf PING -LRTM DISABLED -netProfile net_pf_internal
 Done
>
# 添加ISP服务并绑定对应监视器
> add service svc_isp_ct srv_isp_ct ANY *
 Done
> bind service svc_isp_ct -monitorName mon_ping_net_pf
 Done
>
> add service svc_isp_cnc srv_isp_cnc ANY *
 Done
> bind service svc_isp_cnc -monitorName mon_ping_net_pf
 Done
> 

# 添加ISP负载均衡虚拟服务器并绑定对应服务
> add lb vserver lb_vsrv_isp_llb_all ANY 0.0.0.0  -lbMethod ROUNDROBIN -persistenceType DESTIP
 Done
> bind lb vserver lb_vsrv_isp_llb_all svc_isp_ct
 Done
> bind lb vserver lb_vsrv_isp_llb_all svc_isp_cnc
 Done
>
> add lb vserver lb_vsrv_isp_llb_ct ANY 0.0.0.0  -lbMethod ROUNDROBIN -persistenceType DESTIP
 Done
> bind lb vserver lb_vsrv_isp_llb_ct svc_isp_ct
 Done
> set lb vserver lb_vsrv_isp_llb_ct -backupVServer lb_vsrv_isp_llb_all
 Done
>
> add lb vserver lb_vsrv_isp_llb_cnc ANY 0.0.0.0  -lbMethod ROUNDROBIN -persistenceType DESTIP
 Done
> bind lb vserver lb_vsrv_isp_llb_cnc svc_isp_cnc
 Done
> set lb vserver lb_vsrv_isp_llb_cnc -backupVServer lb_vsrv_isp_llb_all
 Done
> 

# 添加默认的LB路由项
> add lb route 0.0.0.0 0.0.0.0 lb_vsrv_isp_llb_all
 Done
> 

# 添加并应用 PBR
> add ans pbr pbr_isp_ct_internel ALLOW -srcIP = 192.168.11.1 -destIP = 192.168.110.1 -nextHop 127.0.0.1 -priority  -msr ENABLED
 Done
> add ans pbr pbr_isp_cnc_internel ALLOW -srcIP = 192.168.11.1 -destIP = 192.168.120.1 -nextHop 127.0.0.1 -priority  -msr ENABLED
 Done
> apply ans pbrs
 Done
> 

# 发布本地ssh服务
> add server srv_local_loopback 127.0.0.1
 Done
> add service svc_local_ssh srv_local_loopback TCP
 Done
>
> add lb vserver lb_vsrv_isp_ct_ssh TCP 192.168.110.41  -lbMethod ROUNDROBIN -persistenceType SOURCEIP
 Done
> bind lb vserver lb_vsrv_isp_ct_ssh svc_local_ssh
 Done
> add lb vserver lb_vsrv_isp_cnc_ssh TCP 192.168.120.45  -lbMethod ROUNDROBIN -persistenceType SOURCEIP
 Done
> bind lb vserver lb_vsrv_isp_cnc_ssh svc_local_ssh
 Done
> 

# 发布本地webgui服务
> add server srv_local_loopback 127.0.0.1
 Done
> add service svc_local_webgui srv_local_loopback HTTP
 Done
>
> add lb vserver lb_vsrv_isp_ct_webgui HTTP 192.168.110.41  -lbMethod ROUNDROBIN -persistenceType COOKIEINSERT
 Done
> bind lb vserver lb_vsrv_isp_ct_webgui svc_local_webgui
 Done
> add lb vserver lb_vsrv_isp_cnc_webgui HTTP 192.168.120.45  -lbMethod ROUNDROBIN -persistenceType COOKIEINSERT
 Done
> bind lb vserver lb_vsrv_isp_cnc_webgui svc_local_webgui
 Done
> 

# 发布内网web服务
> add server srv_web_hfs 192.168.11.249
 Done
> add service svc_web_hfs srv_web_hfs HTTP
 Done
>
> add lb vserver lb_vsrv_web_hfs_ct HTTP 192.168.110.41 80 -lbmethod ROUNDROBIN -persistenceType COOKIEINSERT
 Done
> bind lb vserver lb_vsrv_web_hfs_ct svc_web_hfs
 Done
> add lb vserver lb_vsrv_web_hfs_cnc HTTP 192.168.120.45 80 -lbmethod ROUNDROBIN -persistenceType COOKIEINSERT
 Done
> bind lb vserver lb_vsrv_web_hfs_cnc svc_web_hfs
 Done
> 

查看状态：

> stat interface

Interface Summary
ID             IntfState    IntfAlias Rx Bytes Tx Bytes  Rx Pkts  Tx Pkts
/                 DOWN
/                   UP
/                   UP
/                 DOWN
/                   UP
/                 DOWN
/                   UP
/                 DOWN
/                DOWN
/                DOWN
/                DOWN
/                DOWN
/                 DOWN
LO/                  UP               403220k  527085k
 Done
>
> show ip
      Ipaddress        TD    Type             Mode     Arp      Icmp     Vserver  State
      ---------        --    ----             ----     ---      ----     -------  ------
)    192.168.11.11         HGANS IP         Active   Enabled  Enabled  NA       Enabled
)    192.168.11.1          SNIP             Active   Enabled  Enabled  NA       Enabled
)    192.168.110.41        VIP              Active   Enabled  Enabled  Enabled  Enabled
)    192.168.120.45        VIP              Active   Enabled  Enabled  Enabled  Enabled
 Done
>
> show route
    Network          Netmask          Gateway/OwnedIP  State   TD     Type
    -------          -------          ---------------  -----   --     ----
)    0.0.0.0          0.0.0.0          lb_vsrv_isp_llb_ UP           |LBROUTE
                                      all
)    127.0.0.0        255.0.0.0        127.0.0.1        UP           PERMANENT
)    192.168.11.0     255.255.255.0    192.168.11.11    UP           DIRECT
)    192.168.110.0    255.255.255.0    192.168.110.41   UP           DIRECT
)    192.168.120.0    255.255.255.0    192.168.120.45   UP           DIRECT
 Done
>
> show vlan

)    VLAN ID:
    Link-local IPv6 addr: fe80::20b:abff:fef3:87bf/
    Interfaces : / / / / / / / / / / / / LO/

)    VLAN ID:     VLAN Alias Name:
    Interfaces : /
    IPs :
         192.168.110.41     Mask: 255.255.255.0

)    VLAN ID:     VLAN Alias Name:
    Interfaces : /
    IPs :
         192.168.120.45     Mask: 255.255.255.0
 Done
>
> show rnat
)    Network: 192.168.11.0     Netmask: 255.255.255.0
    NatIP: 192.168.110.41      Td:     

)    Network: 192.168.11.0     Netmask: 255.255.255.0
    NatIP: 192.168.120.45      Td:     

 Done
>
> show ans pbr
)    Name: pbr_isp_ct_internel
    Action: ALLOW                          Hits:
    srcIP = 192.168.11.1
    destIP = 192.168.110.1
    srcMac:                                Protocol:
    Vlan:                                  Interface:
    Active Status: ENABLED                 Applied Status: APPLIED
    Priority:
    NextHop: 127.0.0.1
    MSR: ENABLED  STATE: UP  

)    Name: pbr_isp_cnc_internel
    Action: ALLOW                          Hits:
    srcIP = 192.168.11.1
    destIP = 192.168.120.1
    srcMac:                                Protocol:
    Vlan:                                  Interface:
    Active Status: ENABLED                 Applied Status: APPLIED
    Priority:
    NextHop: 127.0.0.1
    MSR: ENABLED  STATE: UP  

 Done
>
> show server
)    Name:        srv_isp_ct      State:ENABLED
    IPAddress:   192.168.110.1
)    Name:       srv_isp_cnc      State:ENABLED
    IPAddress:   192.168.120.1
)    Name:   srv_local_loopback      State:ENABLED
    IPAddress:       127.0.0.1
)    Name:       srv_web_hfs      State:ENABLED
    IPAddress:  192.168.11.249
 Done
>
> show service -summary
---------------------------------------------------------------------------------------------
      Name        State           IP Addr           Port  Protocol   MaxClients  MaxReqs
---------------------------------------------------------------------------------------------
     svc_isp_ct  UP              srv_isp_ct        *     ANY
     svc_isp_cnc UP              srv_isp_cnc       *     ANY
     svc_..._ssh UP              srv_loc...oopback     TCP
     svc_...bgui UP              srv_loc...oopback     HTTP
     svc_web_hfs UP              srv_web_hfs           HTTP
 Done
>
> show lb vserver -summary
--------------------------------------------------------------------------------------------------------------------------------------
      Name       State   Effec State    Td    IP Addr           Port  Prot    Method  TCPProfName HTTPProfName NetProfName DBProfName
--------------------------------------------------------------------------------------------------------------------------------------
     lb_..._all UP      UP                  0.0.0.0                ANY     RO...IN
     lb_...b_ct UP      UP                  0.0.0.0                ANY     RO...IN
     lb_..._cnc UP      UP                  0.0.0.0                ANY     RO...IN
     lb_..._ssh UP      UP                  192.168.110.41        TCP     RO...IN
     lb_..._ssh UP      UP                  192.168.120.45        TCP     RO...IN
     lb_...bgui UP      UP                  192.168.110.41      HTTP    RO...IN
     lb_...bgui UP      UP                  192.168.120.45      HTTP    RO...IN
     lb_...s_ct UP      UP                  192.168.110.41        HTTP    LE...ON
     lb_..._cnc UP      UP                  192.168.120.45        HTTP    LE...ON
 Done
> 

============= End