Lab Configuring TCP Load Distribution

Transcription

1 Lab Configuring TCP Load Distribution Objective In this lab, the student will configure NAT with the TCP Load Distribution option. The student will also learn to use the prefix-length option as an alternative to the netmask option of the ip nat pool command. Scenario Step 1 The International Travel Agency (ITA) expanded and updated their network. They chose to use the /24 private addresses and NAT to handle connectivity with the outside world. In securing the outside IP addresses from their ISP, ITA is required to pay a monthly fee for each IP address. ITA has asked for a series of prototypes to be set up to test the capabilities of NAT to meet their requirements. The company hopes to be able to get by with 14 real IP addresses, /28. For a variety of reasons including security concerns, the company wishes to hide the internal network from the outside. The ITA Web server, , is overwhelmed by outside traffic. A pool of two mirrored servers needs to be created to handle the load. These servers will be addressed as and Outside users and DNS use the global IP address, , to access the Web server. ITA would like to continue using the single address and have the NAT router distribute the requests between the two mirrored servers. A prototype needs to be created that will demonstrate TCP load distribution using NAT. Build and configure the network according to the diagram. Host A represents a user outside of the ITA network. Be sure to configure Host A with the correct default gateway. 1-5 CCNP 2: Remote Access v Lab Copyright 2003, Cisco Systems, Inc.

2 Step 2 Issue the following to configure SanJose1 to use a default route to ISP1: SanJose1(config)#ip route On ISP1, issue the following to configure a static route to the global addresses used by SanJose1 for NAT: ISP1(config)#ip route Step 3 For testing purposes, configure SanJose1 as a Web server at , as shown in the following: SanJose1(config)#ip http server For the purposes of this lab, another router will act as the second Web server. Configure this router as shown in the following: Router(config)#hostname Web2 Web2(config)#enable password cisco Web2(config)#ip default-gateway Web2(config)#no ip routing Web2(config)#interface fastethernet0/0 Web2(config-if)#ip address Web2(config-if)#no shutdown Web2(config-if)#exit Web2(config)#ip http server Step 4 Create a NAT pool to represent the planned Web servers, as the following shows: SanJose1(config)#ip nat pool WebServers prefix-length 24 type rotary Note: In this command, the keyword prefix-length is used instead of the keyword netmask. Both keywords specify the subnet mask. The prefix-length option allows the mask to be specified as a bitcount, 24 instead of The type rotary sets up a round-robin rotation through the designated pool. The name WebServers is a user-defined variable, so it can be any useful word. Next, create an access list to define the global address that will be used to access the server pool. Remember, that is to be used. The following was the original Web server IP address that is known to the outside users: SanJose1(config)#access-list 50 permit The following is the command that links the pool and the global address: SanJose1(config)#ip nat inside destination list 50 pool WebServers 2-5 CCNP 2: Remote Access v Lab Copyright 2003, Cisco Systems, Inc.

3 The inside destination indicates that the NAT translations will be established from the outside network to the inside network. Issue the following to specify an interface on SanJose1 that is to be used by inside network hosts requiring address translation: SanJose1(config)#interface fastethernet0/0 SanJose1(config-if)#ip nat inside Issue the following to specify an interface to be used as the outside NAT interface: SanJose1(config)#interface serial0/0 SanJose1(config-if)#ip nat outside Step 5 Verify that the workstation can ping and Troubleshoot as necessary. Ping from Host A. The ping should fail because ping uses ICMP and not TCP. TCP is the only protocol supported by the NAT load distribution feature. To test this configuration, have Host A open a Web browser window. On the address line of the Web browser on Host A, enter When the following screen appears, use any username and cisco as the password. Note: The password is case sensitive. If the router is not configured with cisco as the enable secret/password, then enter the password that it is configured with instead. 3-5 CCNP 2: Remote Access v Lab Copyright 2003, Cisco Systems, Inc.

4 After the router has been authenticated, a page similar to the following should be seen: 1. What is the inside address of the router for the Web server being viewed? Click on the Refresh button on the Web browser. A new page should appear, as shown in the following figure: 2. What is the inside address of the router for the Web server being viewed? 3. If Refresh is clicked again, what will happen? 4-5 CCNP 2: Remote Access v Lab Copyright 2003, Cisco Systems, Inc.

5 Issue the show ip nat translations command as follows to verify that SanJose1 is distributing the TCP load to itself and Web2: SanJose1#show ip nat translations Pro Inside global Inside local Outside local Outside global tcp : : : :1322 tcp : : : :1323 tcp : : : :1324 tcp : : : :1325 tcp : : : :1326 tcp : : : :1327 tcp : : : :1328 tcp : : : :1329 tcp : : : :1330 tcp : : : :1331 tcp : : : :1332 tcp : : : : CCNP 2: Remote Access v Lab Copyright 2003, Cisco Systems, Inc.