View page as slide show

Networking kung-fu

7 Maio 2011, E.T. Porto Linux

Vou falar de:

  • bridge
  • bridge + VLAN
  • Multilink trunk
  • bridge+ VLAN + Multilink trunk
  • ipvs
  • stunnel

bridge




ethx ----- Brigde ---- vif1 
                  :--- vif2
                  :--- vif3
                  :--- vif4
                  :--- vifN               

bridge

 brctl addbr nomedabridge
 brctl addif ethX
 brctl show 

root@kvm0:~# brctl show
bridge name  bridge id	       STP enabled  interfaces
rede28eth0   8000.0015171954fc	no	    eth0
					    vnet2

bridge

  • interfaces config file:
auto rede28eth0
iface rede28eth0 inet manual
        bridge_ports eth0
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

bridge + VLAN

ethx --ethx.vlanX--- Brigde ---- vifX1 
     :                      :--- vifX2
     :                      :--- vifX3
     :                      :--- vifX4
     :                      :--- vifXN     
     :
     :-ethx.vlanY--- Brigde ---- vifY1 
                            :--- vifY2
                            :--- vifY3
                            :--- vifY4
                            :--- vifYN  
          

bridge + VLAN

vconfig add eth1 25
vconfig add eth1 97
root@kvm0:~# cat /proc/net/vlan/config 

VLAN Dev name	 | VLAN ID
eth1.25         | 25       | eth1
eth1.97         | 97       | eth1

bridge + VLAN

  • interfaces config file:
auto marcadores
iface marcadores inet manual
        bridge_ports eth7.112
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off
        pre-up vconfig add eth7 112
        post-down vconfig rem eth7.112

multilink trunk (bonding)

ethA ---:
        +
ethB ---:----bond0
        +
ethC ---:


multilink trunk (bonding)

  • configuring bonding manually:
 modprobe bonding mode=balance-alb miimon=100  
 ifenslave bond0 eth0
 ifenslave bond0 eth1

multilink trunk (bonding)

  • interfaces config file:
auto bond0
iface bond0 inet manual
  slaves eth2 eth3
    bond_mode 802.3ad
    bond_xmit_hash_policy layer3+4
    bond_lacp_rate fast
    bond_miimon 100
    bond_downdelay 200
    bond_updelay 200

multilink trunk (bonding)

root@kvm0:~# cat /proc/net/bonding/bond0 

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
Transmit Hash Policy: layer3+4 (1)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 200
Down Delay (ms): 200

802.3ad info
LACP rate: fast
Aggregator selection policy (ad_select): stable
Active Aggregator Info:
	Aggregator ID: 2
	Number of ports: 2
	Actor Key: 17
	Partner Key: 12289
	Partner Mac Address: 5c:e2:86:19:7c:01

bridge + VLAN + multilink trunk

ethA ---:
        +
ethB ---:---bond0--bond0.vlanX--- Brigde --- vif1
        +         :                      :-- vif2
ethC ---:         :                      :-- vif3
                  :                      :-- vif4
                  :                      :-- vifN     
                  :
                  :-bond0.vlanY--- Brigde --- vif1 
                                         :-- vif2
                                         :-- vif3
                                         :-- vif4
                                         :-- vifN  

bridge + VLAN + multilink trunk

  • interfaces config file:

auto redegestao
iface redegestao inet static
        bridge_ports bond0.97
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off
        pre-up vconfig add bond0 97
        post-down vconfig rem bond0.97

bridge + VLAN + multilink trunk + IP

  • interfaces config file:

auto redegestao
iface redegestao inet static
        bridge_ports bond0.97
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off
        pre-up vconfig add bond0 97
        post-down vconfig rem bond0.97
	address 172.16.20.123
	netmask 255.255.255.0
	network 172.16.20.0
	broadcast 172.16.20.255

ipvs


VIP:port ---- IPVS ---- Real Server 1
                   :--- Real Server 2
                   :--- Real Server N

ipvs :: scheduling-method

  • rr - Round Robin
  • wrr - Weighted Round Robin
  • lc - Least-Connection
  • wlc - Weighted Least-Connection
  • lblc - Locality-Based Least-Connection
  • lblcr - Locality-Based Least-Connection with Replication
  • dh - Destination Hashing
  • sh - Source Hashing
  • sed - Shortest Expected Delay
  • nq - Never Queue

ipvs

  • configuring ipvs manually:
ipvsadm -A -t 193.136.28.130:143
ipvsadm -a -t 193.136.28.130:143 -r 172.16.20.179:143 -m
ipvsadm -a -t 193.136.28.130:143 -r 172.16.20.180:143 -m
ipvsadm -a -t 193.136.28.130:143 -r 172.16.20.181:143 -m

ipvs

  • /etc/ldirectord.conf

# Virtual Service for IMAP
virtual=193.136.28.130:143
        real=172.16.20.179:143 masq
        real=172.16.20.180:143 masq
        real=172.16.20.181:143 masq
        service=imap
        scheduler=rr
        #persistent=600
        protocol=tcp
        checktype=negotiate
  • network address translation:
 iptables -t nat -A POSTROUTING -o eth0 -s \
172.16.20.179 -j SNAT --to-source 193.136.28.130

ipvs

IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port   Forward Weight ActiveConn InActConn
TCP  193.136.28.130:25 rr
  -> 172.16.20.179:25     Masq    1      0          0         
  -> 172.16.20.180:25     Masq    1      0          0         
  -> 172.16.20.181:25     Masq    1      0          0         
TCP  193.136.28.130:143 rr persistent 300
  -> 172.16.20.179:143    Masq    1      1          0         
  -> 172.16.20.180:143    Masq    1      0          0         
  -> 172.16.20.181:143    Masq    1      0          0 

stunnel

IP:PORT ---- Stunnel---- IP:PORT
193.136.28.130:993 ---- Stunnel---- 193.136.28.130:143
stunnel -p imap.pem -d 193.136.28.130:993 -r 193.136.28.130:143

stunnel

cert=/etc/ssl/certs/10279593.crt
CAfile=/etc/ssl/certs/10279593.ca-bundle
key=/etc/ssl/certs/imap.key 

sslVersion = all

chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /imap.pid

socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

[imaps]
accept  = 193.136.28.130:993
connect = 193.136.28.130:143

big picture

 ethA ethB  ethC       
   :    :     :                     
   -----+------
        :                       :- vifX4 (RSN)
      bond0                     :- vifX3 (RS2)
        :                       :- vifX2 (RS1)
.-------:--bond0.vlanX-- Brigde -- vifX1----.   
:                                           :
:                                           :
:               /-stunnel--VIP:port--IPVS--\:   
:              :\-stunnel--VIP:port--IPVS--/                                     
:              :                     
:              :--------------------.   
:                                   :
:-bond0.vlanY--- Brigde -- vifY1 ---:
                        :- vifY2 -- (VM2) 
                        :- vifY3 -- (VM2)
                        :- vifY4 -- (VM2)
                        :- vifYN -- (VMN)

q&a

apresentacoes/networking-kung-fu.txt · Modificado em: 2011/05/09 09:51 por ndantas
Recent changes RSS feed Driven by DokuWiki html2fpdf enhanced