Keepalived study notes,

Keepalived study notes,

Note
LVS (Linux Virtual Server): Linux Virtual Server. keepalived is used as the Server Load balancer.
RS (Real Server): Real Server
VRRP (Virtual Router Redundancy Protocol): vro Redundancy Protocol, which solves the problem of spof When configuring static gateways in the LAN.

 

What is 1Keepalived and what is its function?
Definition of 1.1Keepalived
Keepalived is a LVS high availability solution based on VRRP protocol.
Role of 1.2Keepalived
1.2.1 high availability through IP address drift
The primary and secondary LVS share a virtual IP address. At the same time, only one LVS occupies the VIP address and provides external services. If the LVS address is unavailable, the VIP address will drift to another LVS address and provide external services;
1.2.2 monitor the status of the RS Cluster
If RS is unavailable, keepalived will remove it from the cluster. If RS is restored, keepalived will re-add it to the cluster.
2Keepalived has several modes. What are the similarities and differences between different modes?
2.1Keepalived mode type
Keepalived has three modes: NAT (address translation), DR (direct routing), and TUN (Tunnel)
2.2Keepalived Modes
2.2.1NAT
Advantage: RS in the cluster can use any operating system that supports TCP/IP. RS can be assigned a private IP address of the Internet, and only LVS needs a valid IP address.
Disadvantage: Limited scalability. When the number of RS nodes increases to 20 or more, LVS will become the bottleneck of the entire system, because all request packets and response packets need to be regenerated through LVS.
2.2.2TUN
We found that many Internet services (such as WEB servers) have very short request packets, while the response packets are usually very large.
Advantage: LVS is only responsible for distributing request packets to RS, while RS directly sends response packets to users. Therefore, LVS can process a large amount of requests. In this way, a server Load balancer can serve over 100 RS servers, and LVS is no longer a bottleneck in the system.
Disadvantage: however, This method requires all servers to support the "IP Tunneling" (IP Encapsulation) protocol. I only implement this in Linux.
2.2.3DR
Advantage: Like TUN, LVS only distributes requests, and the response packet is returned to the client through a separate routing method. Compared with TUN, DR does not require a tunnel structure, so most operating systems can be used as RS.
Insufficient: The LVS Nic must be in the same network segment as the RS Nic.
3. What are the verification methods for different modes of configuration?
3.1 basic environment requirements
Two LVS and n (n> = 2) RS are required.
3.1.1LVS
Install ipvsadm (LVS management tool) and keepalived;
Enable route forwarding:
Vim/etc/sysctl. conf
Net. ipv4.ip _ forward = 1
Verification:
Sysctl-p
Net. ipv4.ip _ forward = 1
3.1.2RS
Install httpd (for final testing)
3.2NAT mode configuration
3.2.1 environment overview
Operating System Load Balancing mode VIPNVIP
RHEL7.4NAT193.168.140.80192.168.102.165

LVS1LVS2RS1RS2
Ens3: 192.168.103851ens3: 192.168.10%2ens3: 192.168.10%3ens3: 192.168.10%4
Ens4: 193.168.140.79ens4: 193.168.140.83 Gateway: 192.168.102.165 Gateway: 192.168.102.165

3.2.2LVS
Vim/etc/keepalived. conf
! Configuration File for keepalived
Global_defs {
Notification_email {
Qingean@163.com # fault acceptance contacts
}
Icationication_email_from admin@test.com # fault sender
Smtp_server 127.0.0.1 # send an email on the local machine
Smtp_connect_timeout 30
Router_id LVS_MASTER # Change BACKUP to LVS_BACKUP
}
Vrrp_instance VI_1 {
State MASTER # BACKUP to BACKUP
Interface ens4
Virtual_router_id 51 # virtual route ID, same as Master/Slave
Priority 100 # modify BACKUP to 90
Advert_int 1
Authentication {
Auth_type PASS
Auth_pass 1111 # Master/Slave authentication passwords must be consistent
}
Virtual_ipaddress {
193.168.140.80 # virtual IP address (VIP)
}
}
Vrrp_instance LAN_GATEWAY {# define a gateway
State MASTER # BACKUP to BACKUP
Interface ens3
Virtual_router_id 62 # virtual route ID, same as Master/Slave
Priority 100 # modify BACKUP to 90
Advert_int 1
Authentication {
Auth_type PASS
Auth_pass 1111
}
Virtual_ipaddress {# ens3 gateway virtual IP Address
192.168.102.165
}
}
Virtual_server 192.168.102.165 80 {# define the virtual IP address and port of the Intranet Gateway
Delay_loop 6 # Check the RS time, in seconds
Lb_algo rr # sets the load scheduling algorithm, such as rr, wrr, lc, and wlc) lblc, lblcr, dh, and sh)
Lb_kind NAT # Set LVS Server Load balancer NAT Mode
Persistence_timeout 50 # connections from the same IP address are allocated to the same real server within 60 seconds (recommended to be changed to 0 during testing)
Protocol TCP # Use the TCP protocol to check the RS status
Real_server 192.168.101_1 80 {# first gateway node
Weight 3 # node weight
TCP_CHECK {# Health Check Method
Connect_timeout 3 # connection timeout
Nb_get_retry 3 # Number of Retries
Delay_before_retry 3 # Retry Interval/S
}
}
Real_server 192.168.102.162 80 {# Second gateway node
Weight 3
TCP_CHECK {
Connect_timeout 3
Nb_get_retry 3
Delay_before_retry 3
}
}
}
Virtual_server 193.168.140.80 {# define a virtual IP Address
Delay_loop 6
Lb_algo rr
Lb_kind NAT
Persistence_timeout 50
Protocol TCP
Real_server 192.168.102.163 80 {# first RS
Weight 3
TCP_CHECK {
Connect_timeout 3
Nb_get_retry 3
Delay_before_retry 3
Connect_port 80
}
}
Real_server 192.168.102.164 80 {# Second RS
Weight 3
TCP_CHECK {
Connect_timeout 3
Nb_get_retry 3
Delay_before_retry 3
Connect_port 80
}
}
}
3.2.3RS
Add the gateway to all RS as 192.168.102.165:
Vim/etc/sysconfig/network-scripts/ifcfg-ens3
GATEWAY = 192.168.102.165
Restart; use route-n to check whether the operation is successful
IPVS connection entries
Pro expire state source virtual destination
TCP 0:54 FIN_WAIT 10.167.225.60: 53882 193.168.140.80: 80 192.168.102.163: 80
TCP 00:37 NONE 10.167.225.60: 0 193.168.140.80: 80 192.168.102.163: 80

3.3DR mode configuration
3.3.1 environment overview
Operating System Load Balancing mode VIP
RHEL7.4DR193.168.140.80

LVS1LVS2RS1RS2
Ens4: 193.168.140.79ens4: 193.168.140.83ens4: 193.168.140.152ens4: 193.168.140.133

3.3.2LVS
Vim/etc/keepalived. conf
! Configuration File for keepalived
Global_defs {
Notification_email {
Qingean@163.com
}
Notification_email_from admin@test.com
Smtp_server 127.0.0.1
Smtp_connect_timeout 30
Router_id LVS_MASTER
}
Vrrp_instance VI_1 {
State MASTER # BACKUP to BACKUP
Interface ens4
Virtual_router_id 51
Priority 100 # modify BACKUP to 90
Advert_int 1
Authentication {
Auth_type PASS
Auth_pass 1111
}
Virtual_ipaddress {
193.168.140.80
}
}
Virtual_server 193.168.140.80 {
Delay_loop 6
Lb_algo rr
Lb_kind DR
Nat_mask 255.255.255.255.255
Protocol TCP
Real_server 193.168.140.152 80 {
Weight 10
TCP_CHECK {
Connect_timeout 10
Nb_get_retry 3
Delay_before_retry 3
Connect_port 80
}
}
Real_server 193.168.140.20.80 {
Weight 10
TCP_CHECK {
Connect_timeout 10
Nb_get_retry 3
Delay_before_retry 3
Connect_port 80
}
}
}

3.3.3RS
Modify sysctl. conf for all RS
Net. ipv4.conf. lo. arp_ignore = 1
Net. ipv4.conf. lo. arp_announce = 2
Net. ipv4.conf. all. arp_ignore = 1
Net. ipv4.conf. all. arp_announce = 2
Net. ipv4.ip _ forward = 1
Run/sbin/ifconfig lo: 0 193.168.140.80 broadcast 193.168.140.80 netmask 255.255.255.255
Use route-n to check whether the operation is successful.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 193.168.1.1 0.0.0.0 UG 100 0 0 ens4
193.168.0.0 0.0.0.0 255.255.0.0 U 100 0 0 ens4
193.168.140.80 0.0.0.0 255.255.255.255 UH 0 0 0 lo
If/sbin/route add-host 193.168.140.80 dev lo: 0
3.4 Verification Method
3.4.1 disable the firewall on all machines:
Systemctl stop firewalld
3.4.2 write all RS to the test page and enable the httpd service
RS1: echo "RS1">/var/www/html/index.html
RS2: echo "RS2">/var/www/html/index.html
Systemctl start httpd
3.4.3 enable keepalived for Master/Slave LVS
Systemctl start keepalived
3.4.4 access
Http: // 193.168.140.80 #
Refresh will show RS1 or RS2 in turn
3.4.5 check the server to which the access request of the current test server is forwarded
Ipvsadm-lcn
IPVS connection entries
Pro expire state source virtual destination
TCP 0:54 FIN_WAIT 10.167.225.60: 53882 193.168.140.80: 80 192.168.102.163: 80
TCP 00:37 NONE 10.167.225.60: 0 193.168.140.80: 80 192.168.102.163: 80
3.4.6 Test
Simulate the failure of the master LVS, the server will work as usual, and then the Web1 will be down, then only Web2 will be displayed, so as to achieve IP load balancing, high availability cluster. After the master LVS recovers, it switches to the active server. If the Keepalived monitoring module detects the web fault recovery, the recovered host adds the node to the cluster system.