Network Address Translation And Spoofing - Coyote Point Systems E350GX Installation And Administration Manual

Chapter 1: Equalizer Overview
ICMP Probes uses the Internet Control Message Protocol to send an "Echo request" to the server, and then wait for
the server to respond with an ICMP "Echo reply" message (like the Unix ping command). ICMP is a Layer 3
protocol. ICMP probes can be disabled via a global flag.
TCP Probes establish (and tear down) a TCP connection between Equalizer and the server, in a typical Layer 4
exchange of TCP SYN, ACK, and FIN packets. If the connection cannot be completed, Equalizer considers the
server down and stops routing requests to it. TCP probes cannot be disabled.
Equalizer's Active Content Verification (ACV) provides an optional method for checking the validity of a server's
response using Layer 7 network services that support a text-based request/response protocol, such as HTTP. When
you enable ACV for a cluster, Equalizer requests data from each server in the cluster (using an ACV Probe string)
and verifies the returned data (against an ACV Response string). If Equalizer receives no response or the response
string is not in the response, the verification fails and Equalizer stops routing new requests to that server. (Note that
ACV is not supported for Layer 4 UDP clusters.) For more information, see "Using Active Content Verification
(ACV)" on page 134.
Server Agent Probes are an optional feature that enable Equalizer to communicate with a user-written program (the
agent) running on the server. A server agent is written to open a server port and, when Equalizer connects to the
port, the server agent responds with an indication of the current server load and performance. This enables Equalizer
to adjust the dynamic weights of the server according to detailed performance measurements performed by the
agent, based on any metrics available on the server. If the server is overloaded and you have enabled server agent
load balancing, Equalizer reduces the server's dynamic weight so that the server receives fewer requests. The
interface between Equalizer and server agents is simple and well-defined. Agents can be written in any language
supported on the server (e.g., perl, C, shell script, javascript, etc.). For more information see "Server Agent Probes"
on page 255.
For those who have one or more VMware ESX Servers, Equalizer VLB can be configured to use VMware's status
reporting to determine server status, and can also be configured to automatically manage VMware servers based on
status information obtained from VMware. For more information, see Appendix F, "Equalizer VLB".

Network Address Translation and Spoofing

The servers load balanced by Equalizer provide applications or services on specific IP addresses and ports, and are
organized into virtual clusters, each with its own IP address. Clients send requests to the cluster IP addresses on
Equalizer (instead of sending them to the IP addresses of the servers).
Central to the operation of any load balancer is the Network Address Translation (NAT) subsystem. On Equalizer,
NAT is used in the following ways:
1. When Equalizer receives a client packet, it always translates the destination IP (the cluster IP) to the IP address
of one of the servers in the cluster. The server IP used is determined by the cluster's load balancing settings.
2. Depending on the setting of the cluster
When the option is enabled, then SNAT is disabled: the NAT subsystem leaves the client IP address as
spoof
the source IP address in the packet it forwards to the server. For this reason, the servers in a cluster with
enabled are usually configured to use Equalizer's IP as their default gateway, to ensure that all responses go
through Equalizer (otherwise, the server would attempt to respond directly to the client IP).
When the option is disabled, then SNAT is enabled. Equalizer translates the source IP (the client IP) to
spoof
one of Equalizer's IP addresses before forwarding packets to a server. The servers will send responses back to
Equalizer's IP (so it is usually not necessary to set Equalizer as the default gateway on the servers when
is disabled).
Match rules can be used to selectively apply the
selective SNAT. See the section "Changing the Spoof (SNAT) Setting Using Match Rules" on page 231.
3. When a server sends a response to a client request through Equalizer, the NAT subsystem always translates the
source IP in the response packets (that is, the server IP) to the cluster IP to which the client originally sent the
22
option, Equalizer may also perform Source NAT, or SNAT.
spoof
option to client requests. This is sometimes called
spoof
Equalizer Installation and Administration Guide
spoof
spoof