Alteon Application Switch Operating System Application Guide
Server Load Balancing
Document ID: RDWR-ALOS-V2900_AG1302
203
For more information on how to map a virtual server port to a real server port, see
.
Monitoring Real Servers
Typically, the management network is used by network administrators to monitor real servers and
services. By configuring the mnet and mmask options of the SLB Configuration menu
(
/cfg/slb/adv
), you can access the real services being load balanced.
Note:
Clients on the management network do not have access to SLB services and cannot access
the virtual services being load balanced.
The mnet and mmask options are described below:
•
mnet—If defined, management traffic with this source IP address is allowed direct (non-SLB)
access to the real servers. Only specify an IP address in dotted decimal notation. A range of IP
addresses is produced when used with the mmask option.
•
mmask—This IP address mask is used with mnet to select management traffic that is allowed
direct real server access only.
Delayed Binding
Delayed binding can be used in several scenarios, for example Layer 7 matching, for which you need
to accumulate information about the client connection on which a load-balancing decision is
performed.
Delayed binding consists of the following statuses:
•
Enabled— Performs SYN SYN denial-of-service Protection and enables some Alteon Layer 7
capabilities and SYN protection.
•
Disabled— No delayed binding is performed.
•
Force Proxy—Uses the Application Service Engine and enables TCP Optimization.
Delayed Binding Using Denial-of-service Protection
The delayed binding feature prevents SYN denial-of-service (DoS) attacks on the server. DoS occurs
when the server or Alteon is denied servicing the client because it is saturated with invalid traffic.
Typically, a three-way handshake occurs before a client connects to a server. The client sends out a
synchronization (SYN) request to the server. The server allocates an area to process the client
requests, and acknowledges the client by sending a SYN ACK. The client then acknowledges the SYN
ACK by sending an acknowledgement (ACK) back to the server, thus completing the three-way
handshake.
Figure 35 - Mapped and Non-Mapped Server Access, page 204
illustrates a classic type of SYN DoS
attack. If the client does not acknowledge the server's SYN ACK with a data request (REQ) and
instead sends another SYN request, the server gets saturated with SYN requests. As a result, all of
the servers resources are consumed and it can no longer service legitimate client requests.
Содержание Alteon
Страница 2: ...Alteon Application Switch Operating System Application Guide 2 Document ID RDWR ALOS V2900_AG1302 ...
Страница 42: ...Alteon Application Switch Operating System Application Guide Preface 42 Document ID RDWR ALOS V2900_AG1302 ...
Страница 582: ...Alteon Application Switch Operating System Application Guide High Availability 582 Document ID RDWR ALOS V2900_AG1302 ...
