Citrix NetScaler EE, Руководство по установке и настройке

Страница: 575 / 1026

© 1999-2017 Citrix Systems, Inc. All rights reserved. p.575 https://docs.citrix.com
Forwarding Rules
Dec 27, 2012
By default, the
owner
of a group-mode connection is set by a hash of the source and destination IP addresses. Each
appliance in the group uses the same algorithm to determine which group member owns a given connection. This method
requires no configuration. The owner can optionally be specified through user-settable rules.
Because the group-mode hash is not identical to that used by load balancers, about half of the traffic tends to be
forwarded to the owning appliance in a two-Appliance group. In the worst case, forwarding causes the load on the LAN-
side interface to be doubled, which halves the appliance's peak forwarding rate for actual WAN traffic.
This speed penalty can be reduced if the Primary or Aux1 Ethernet ports are used for traffic between group members. For
example, if you have a group of two appliances, you can use an Ethernet cable to connect the two units' Primary ports,
then specify the Primary port on the Group Mode page on each unit. However, maximum performance is achieved if the
amount of traffic forwarded between the group-mode members is minimized.
The owner can optionally be set according to specific IP/port-based rules. These rules must be identical on all appliances in
the group. Each member of the group verifies that its group-mode configuration is identical to the others. If not all of the
configurations are identical, none of the member appliances enter group mode.
If traffic arrives first at the appliance that owns the connection, it is accelerated and forwarded normally. If it arrives first at
a different appliance in the group, it is forwarded to its owner over a GRE tunnel, which accelerates it and returns it to the
original appliance for forwarding. Thus, group mode leaves the router's link selection unchanged.
Using explicit IP-based forwarding rules can reduce the amount of group-mode forwarding. This is especially useful in
primary-link/backup-link scenarios, where each link handles a particular range of IP addresses, but can act as a backup when
the other link is down.
Figure 1. IP-Based Owner Selection
Forwarding rules can ensure that group members handle only their "natural" traffic. In many installations, where traffic is
usually routed over its normal link and only rarely crosses the other one, these rules can reduce overhead substantially.
Rules are evaluated in order, from top to bottom, and the first matching rule is used. Rules are matched against an optional
IP address/mask pair (which is compared against both source and destination addresses), and against an optional port
range.
Regardless of the ordering of rules, if the partner appliance is not available, traffic is not forwarded to it, whether a rule
matches or not.
For example, in the figure below, member 172.16.1.102 is the owner of all traffic to or from its own subnet (172.16.1.0/24),
while member 172.16.0.184 is the owner of all other traffic.
If a packet arrives at unit 172.16.1.102, and it is not addressed to/from net 172.16.1.0/24, it is forwarded to 172.16.0.184.
If unit 172.16.0.184 fails, however, unit 172.16.1.102 no longer forwards packets. It attempts to handle the traffic itself. This
behavior can be inhibited by clicking Do
Do NOT Accelerat e When Member Failure Det ect ed NOT Accelerat e When Member Failure Det ect ed on the Group Mode tab.