Network Security Wiki

BGP OSPF Questions: Difference between revisions

Page Discussion

BGP OSPF Questions (view source)

Revision as of 21:11, 4 November 2022

4,148 bytes removed ,  1 year ago
m
→‎load balacing mehtods
 
Line 851:
switch(config-vsan-db)# vsan <number> interface vfc <number>
switch(config-vsan-db)# exit
 
= load balacing mehtods =
static -Round robin ,ratio
Dyanamic -LFOPD (least connection ,fastest ,observed,predective,dyanmic ratio )
 
 
 
Least connection -load balacing is based on no of connection counts ,if the connection counts are equal it will use round robin
 
 
Fastest -No of layer 7 request pending on each member.
 
Observed -ration load balacing method but ratio assigned by BIG IP,No off least connections counts BIG IP assign the request and check dyanamically and assign the ratio's of the request.
 
Predective -similar to oberved but assigns the ratio agressivley based on average connection counts .
 
 
load balacing by poolmember or node .
 
 
Priorty activation -helps to configure back sets for exsiting pool members .BIG Ip will use high priorty pool member first .
 
Fallback host is only used for HTTP request ,if all the pool memebers are not availiable BIG will redirect the cilent request
 
--------------------------------------------------------------------------------------
 
Monitors :check the status of nodes and pool memembers ,if any pool meember resposnse time is not good or is not responding big ip will not send the request to that node.
 
monitor type :
 
adress check -BIG IP send ICMP request and wait for reply if there is no reply it considers nei down does not send the trafic further to that node.
 
service check -will check TCP port number on which server is lisenting ,if no responce it considers down ----
 
contect check -we can check if the server is resondping with right contest ,like for http requset get/http .... request is send .
 
interactive check -TEST for FTP connection .once connection is open username and password is send then request is send get /file once file is recieved connection is closed .
 
F5 recommends time out = 3n+1 (frquency) for setting the monitor for http
 
Customization of monitor
 
Assign nodes to monitor
 
 
-------------------------------
 
Profiles -defining traffic behaviour for virtual server.
 
Profiles contains setting how to process traffic though virtual servers.if for certain application BIG IP load balace the traffic then it will break the client connection
to avoid this we use perstiance profile so that return request for the cilent is send to same server.
 
persisteance profile - isconfigured for clients and group of cilents how BIG IP knows the returning client request need to send to same server ,persistance profile is confiured taking source ip address of http cookie
 
SSL termination -
 
 
FTP profile
 
 
All virtual servers have layer four profile includes tCP,UDP,fastl4
 
 
Profile types -service profile ,persistance profile ,protocol profile ,ssl profile ,authentication profile ,other profiles.
 
 
persistence types-
----------------------------------------------------------------
 
source address persistance :keeps the track of source ip address ,adminstrator can set the net mask in persitance record so that all lients in same mask will assigned to same pool member.
 
Limitation -if the client address being NAted .
 
 
Cookie persistance -only uses http protocol
 
Three modes : (insert ,rewrite ,passive ) mode.
 
Insert mode -BIG ip create special cookie in HTTP resonse to client .
rewrite -pool member created blanl cookie and big ip inserts special cookie
passive -pool memeber created special cookie and BIG IP let it pass through
 
-------------------------------------------------------------------------------
 
 
SSL Profile
 
SSL is secured socket layer .
 
website which uses HTTPS we need to us SSL profile as traffic is being Nated for source clients and web app is using https protocol.
Using SSL termination BIG can decrypt the traffic and assigned to pool member.
 
 
BIG IP contains SSL encryption hardware so all the encruption and key exchange are done in hardware .centralized certifiacte management.
 
 
 
----------------------------------------------------------------------------------------
I rule :
 
is a script that direct traffic though BIG IP , based on TCl command language .I rule give controll of inbound and outbound traffic from BIg IP.
 
I rule contains follwing events ( I rule name ,events ,condtion ,action )
 
 
= Security =
Retrieved from "https://aman.awiki.org/wiki/Special:MobileDiff/4684"