FTP-Strict_LB_Routed_Mode【DOC精选】.docVIP

Strict FTP Load Balancing using Routed Mode on ACE Goal Configure basic FTP load balancing where client traffic enters on one network and is directed to FTP servers residing on a second network. All traffic will be sent to a single serverfarm containing five real servers. ACE will be configured to inspect FTP control channel messages, and dynamically open the appropriate data channel ports. Additionally, ACE will be configured with strict FTP inspection, denying any unwanted FTP commands from being used. Design Clients will send application requests through the MFSC, which routes them to a virtual IP address (VIP) within ACE. The VIP used in this example resides in an ACE context which is configured with a client VLAN and a server VLAN. Client requests will hit the VIP, ACE will pick the appropriate server, and then destination NAT the client request to send to the server. The server will respond using the interface VLAN of ACE as its default gateway to the client. ACE will then change the source IP to be the VIP and forward the response to the client via the MSFC. When the client and server negotiate the TCP port to be used for the data channel, ACE performs address translation on the IP’s embedded within the FTP protocol. ACE will also automatically open its access-list to permit the dynamically assigned data-channel port. Configuration The ACE needs to be configured via ACLs to allow traffic into the ACE data plane. After the ACL checks are made, a service-policy which is applied to the interface is used to classify traffic destined to the VIP. The VIP is associated to a load balancing action within the multi-match policy. The load balancing action tells ACE how to handle traffic which has hit a VIP. In this example, all FTP connections will be serviced by a serverfarm containing five real servers. The ACE configuration is layered, such that it builds from the real IPs to finally applying the VIP on an interface. Due to this structure, it is optim