借助A10 vThunder构建企业级实战环境2-正确部署vThunder与Web Server

这里以VMware Workstation平台为例,因为该平台上不支持vNIC混杂模式(Promiscuous Mode),所以该要求忽略。

A10官方手册是以ESXi为例,这里说一下不同,再加上我们自己的摸索:
1、修改vCPU数量为1,我发现现在的几个版本vThunder占用CPU太高,开两个vm组VRRP的话,CPU基本就满了,暂时无解(跑在服务器上也一样);
2、官方要求开启VT-x,这一点VMware Workstation上可以实现;
3、分配内存至少4GB起步,默认为8GB;
4、虚拟机默认账号为admin/a10
5、虚拟机版本还要修改以下参数限制,才能顺利的进行实验,包括以下:

A10-11(config)#
system resource-usage nat-pool-addr-count 2000 
slb resource-usage client-ssl-template-count 8192 
slb resource-usage conn-reuse-template-count 4096 
slb resource-usage fast-tcp-template-count 4096 
slb resource-usage fast-udp-template-count 4096 
slb resource-usage http-template-count 4096 
slb resource-usage nat-pool-addr-count 2000 
slb resource-usage persist-cookie-template-count 4096 
slb resource-usage persist-srcip-template-count 4096 
slb resource-usage proxy-template-count 4096 
slb resource-usage real-port-count 16384 
slb resource-usage real-server-count 8192 
slb resource-usage server-ssl-template-count 8192 
slb resource-usage service-group-count 8192 
slb resource-usage stream-template-count 4096 
slb resource-usage virtual-port-count 8192 
slb resource-usage virtual-server-count 4096 
slb resource-usage health-monitor-count 1024
执行后保存+重启虚拟机; 
修改主机名
A10-11(config)#hostname A10-11 
调整命令行自动长宽
A10-11(config)#terminal auto-size
设置时区 
A10-11(config)#timezone Asia/Shanghai
ntp server 192.168.0.10
采集虚拟机的Host ID信息去https://glm.a10networks.com/申请测试License:
A10-11#sh license
Host ID: 9204B56FB9C9AE5E29230C804E270B0905D1C978

正常加载F5-web-server的ova模板,IP地址与web服务会自动启动,在vThunder上进行基础网络配置:

A10-11(config)#
interface management 
  ip address 10.254.100.11 255.255.255.0 
  ip default-gateway 10.254.100.254 
!
interface ethernet 1 
  enable 
  ip address 192.168.100.254 255.255.255.0 
!
interface ethernet 2 
  enable 
  ip address 172.16.100.254 255.255.255.0 
!
!
ip nat pool SNAT1-172.16.100.x 172.16.100.50 172.16.100.60 netmask /24 ip-rr 
!
ip nat pool SNAT2-172.16.100.x 172.16.100.65 172.16.100.70 netmask /24 ip-rr 
!
ip nat pool-group SNAT-internal 
  member SNAT1-172.16.100.x 
  member SNAT2-172.16.100.x 
!  

最后进行SLB的最基本配置:

A10-11(config)#
slb server web1 172.16.100.1 
  port 80 tcp 
!
slb server web2 172.16.100.2 
  port 80 tcp 
!
slb service-group Web1-2 tcp 
  health-check ping 
  member web1 80 
  member web2 80 
!
slb virtual-server vs12 172.16.100.100 
  port 80 http 
    name web1-2_80_tcp 
    source-nat pool SNAT-internal 
    service-group Web1-2 

验证配置:测试虚拟机网关指向A10的eth1口,浏览器访问VIP 172.16.100.100可达,访问real server 172.16.100.1/2均不可达。这是SNAT起的作用,此时Real Server都是没有配置任何网关的。