Posts Tagged ‘Foundry Networks’

Layer 4-7 Load Balancing using Foundry ServerIron XL

Tuesday, August 8th, 2006

If you’re like me, you use some sort of content switching device in your organization; whether it is a dedicated network appliance such as the Foundry ServerIron, or simply a module in a Cisco switch similar to the CSM. Often times, I find myself “firing and forgetting” about these units until it comes time to deploy a new one. Recently, I was charged with the task of implementing an 8 port Foundry ServerIron XL with Layer3 software, previous to this I had only worked with the older Layer2 models. This article attempts to explain the basic steps to achieve load balancing glory, using one of these devices.

Firstly, I noticed some fairly stark differences between the ServerIron XL, and the older model. One of the large changes is that it will no longer respond on its management port unless you have ip forwarding enabled. (From the router the loadbalancer is connected to, you can ping the load balancer, but from beyond that point, you cannot) This threw me for a slight loop as in the past all of my Foundry work has been Layer2 and worked perfectly.

The answer to this specific problem was the Virtual Interfaces command set, which assigns an IP address to the ‘default’ VLAN (usually VLAN 1) which then routes all IP addresses through that single point. This has the downside of utilizing an extra IP if you are working in public IP space (which I often do).

I will note that one of the nice things about the Foundry load balancer solutions is that you can have a Layer3 switch in between the load balancer and the servers you’re balancing, and my configuration is setup to do this.

Here is the entire configuration file:

ServerIron#sh run
Current configuration:
!
ver 07.3.05cT12
global-protocol-vlan
!
!
server predictor round-robin
!
!
!
!
!
!
!
!
!
!
!
!
!
server real app1 10.1.1.2
port http
port http url “HEAD /”
!
server real app2 10.1.2.2
port http
port http url “HEAD /”
!
server real app3 10.1.3.2
port http
port http url “HEAD /”
!
!
server virtual VIP 192.168.0.5
port http
bind http app1 http app2 http app3 http
!

!

!
vlan 1 name DEFAULT-VLAN by port
router-interface ve 1
!
enable telnet authentication
enable telnet password …..
enable super-user-password …..
ip forward
ip address 192.168.0.3 255.255.255.0
ip default-gateway 192.168.0.1
username admin privilege 5 password …..
password-change any
interface e 1
no cache-group
no spanning-tree
!
interface e 2
no cache-group
no spanning-tree
!
interface ve 1
ip address 192.168.0.4 255.255.255.0
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
end

As you can see, the ServerIron XL and all of the real servers actually exist on seperate networks; they are seperated by a Watch Guard X500 security appliance. On my router I have a vlan setup for 192.168.0.1 255.255.255.0 which is the gateway for the ServerIron XL, then I have static routes from the router, to the Firebox X500 and the ServerIron XL for 10.1.1.0/29, 10.1.2.0/29, and 10.1.3.0/29.

I will highlight certain parts of the configuration:

#server predictor round-robin

This command tells the load balancer to use round robin as the method of balancing connections.

#server real 10.1.x.x
#port http
#port http url “HEAD /”

These commands tell the load balancer which servers actually have the HTTP content on it.

#server virtual VIP 192.168.0.5
#port http
#bind http app1 http app2 http app3 http

This command creates a VIRTUAL server, which is where you would point your client browsers in order to access the round robin configured load balancing.

#vlan 1 name DEFAULT-VLAN by port
# router-interface ve 1

By default all ports on the ServerIron XL are assigned to port 1, this command allows the switch to use ve1 to access the ‘default-gateway’.

#ip forward

Enables IP forwarding, so that the load balancer can access the outside world.

#ip address 192.168.0.3 255.255.255.0

This is the management IP of the ServerIron XL

#ip default-gateway 192.168.0.1

This is the default gateway of the ServerIron XL

#interface ve 1
# ip address 192.168.0.4 255.255.255.0

This command assigns an IP address to the virtual interface Ve1 which allows the ServerIron XL to create static routes to reach the default-gateway.

The above configuration is very short, and is just an example of how quick and easy it is to leverage these devices in order to provide Content Load balancing for your critical Web, or other sorts of applications.

I hope you find this guide useful.

-Drew