f5 big-ipによる cgn career grade nat）紹介 · f5 big-ip による cgn ... mobile optimization...
TRANSCRIPT
F5 BIG-IPによるCGN（CAREER GRADE NAT） 紹介
Version 11.3CGN リリース
11.2以前のIPv4アドレス枯渇及びIPv6ソリューション• Translation
• NAT44, with simple iRule• NAT64 and DNS64• HSL engineによる高性能なログ出力
• Tunneling• IP in IP
• Dual Stack• HW, SWの制限なし
• IPv4 and IPv6 VS
• 22のサービスプロバイダでの利用実績
NAT44を実施するiRuleの例~ユーザー単位のポートの利用制限~
iRule deterministic_snat_nat44ltm rule /Common/deterministic_snat_nat44 {when RULE_INIT {set static::count 0set static::ppu 2000
}when CLIENT_ACCEPTED {
set port_min [expr ([getfield [IP::client_addr] "." 4]%32)*$static::ppu + 1000]set port_max [expr $port_min + $static::ppu ‐ 1 ]set hint_ip 192.[getfield [IP::client_addr] "." 2].[expr ([getfield [IP::client_addr] "." 3]‐1)%4 +1].[expr ([getfield [IP::client_addr] "." 4]/32) +1]
# actual port used depends on hash of src_port and dst_port and tmmset real_port [TCP::unused_port [IP::local_addr] [TCP::local_port] $hint_ip [TCP::client_port] $port_min $port_max]
if { $real_port < $port_min || $real_port > $port_max } {incr static::countlog local0.alert "[format %15s:%‐5u [IP::client_addr] [TCP::client_port]] :¥[format %15s:%‐5u $hint_ip $real_port] :¥[format %5u‐%5u‐%5u $port_min $real_port $port_max] : Not Ok $static::count"
reject}
# don't perform suspended operation here (otherwise, there might be a race condition that other connection for the same tmm may use same port?)snat $hint_ip $real_port
forward}
NAT44を実施するiRuleの例~ユーザー単位のポートの利用制限~
iRule deterministic_snat_nat44ltm rule /Common/deterministic_snat_nat44 {when RULE_INIT {set static::count 0set static::ppu 2000
}when CLIENT_ACCEPTED {
set port_min [expr ([getfield [IP::client_addr] "." 4]%32)*$static::ppu + 1000]set port_max [expr $port_min + $static::ppu ‐ 1 ]set hint_ip 192.[getfield [IP::client_addr] "." 2].[expr ([getfield [IP::client_addr] "." 3]‐1)%4 +1].[expr ([getfield [IP::client_addr] "." 4]/32) +1]
# actual port used depends on hash of src_port and dst_port and tmmset real_port [TCP::unused_port [IP::local_addr] [TCP::local_port] $hint_ip [TCP::client_port] $port_min $port_max]
if { $real_port < $port_min || $real_port > $port_max } {incr static::countlog local0.alert "[format %15s:%‐5u [IP::client_addr] [TCP::client_port]] :¥[format %15s:%‐5u $hint_ip $real_port] :¥[format %5u‐%5u‐%5u $port_min $real_port $port_max] : Not Ok $static::count"
reject}
# don't perform suspended operation here (otherwise, there might be a race condition that other connection for the same tmm may use same port?)snat $hint_ip $real_port
forward}
Version 11.3以降 ではiRule不要
Version 11.3
• NAT44 and NAT444: Native based (no iRules needed for base feature)
• Translation address persistence• Large scale configuration• Configurable Logging • Endpoint independent mapping/filtering. Useful for tethering, full cone
NAT and P2P features.• TCP, UDP and ICMP (per RFC’s 4787, 5382 and 6145)
• ALG functions for port coordination and control plane “broken” protocols (SIP, RTSP)• Additional protocols possible with custom iRules
実装による性能向上
• iRuleによるDeterministic NAT実施時、CPSはカタログスペックの約25%に性能が劣化
• 機能実装により、ほぼカタログスペックのCPS性能を実現
F5のソリューションによるIPv6への
投資計画～CGN(NAT44)からユーザーのIPv6化(NAT64, DNS64)～
F5
CGN導入前
GGSN
InternetIPv4
IPv4(Pub)
PC/LaptopHSPA/HSDPA
3G
MobileSmart Devices3G
Mobile Optimization
(Flash networks)
TrafficSteering
ユーザー数増加により、IPv4アドレスの欠乏が発生
一部ユーザーのNAT44移行IPv4アドレスの有効利用
F5
F5
一部ユーザーをNAT44に収容
GGSN
InternetIPv4
IPv4(Pub)
Mobile Optimization
(Flash networks)
TrafficSteering
IPv4(Pri)Destination – IPv4 Destination – IPv4NAT44
PC/LaptopHSPA/HSDPA
3G
MobileSmart Devices3G
全ユーザーをNAT44に移行
F5
F5
全ユーザーをNAT44に収容
GGSN
InternetIPv4
Mobile Optimization
(Flash networks)
TrafficSteering
IPv4(Pri)Destination – IPv4 Destination – IPv4NAT44
PC/LaptopHSPA/HSDPA
3G
MobileSmart Devices3G
Broadband
IPv4(Pri)
BRAS
IPv6とIPv4の混合利用
F5
F5
v4ユーザーはNAT44、v6ユーザーはNAT64を利用してv4ネットワークへ接続
GGSN
InternetIPv4
Mobile Optimization
(Flash networks)
TrafficSteering
IPv4(Pri)Destination – IPv4 Destination – IPv4NAT44
PC/LaptopHSPA/HSDPA
3G
MobileSmart Devices3G
Broadband
IPv4(Pri)
BRAS
IPv6(Pub) NAT64
4G
Destination – IPv4 Destination – IPv4
設定画面サンプル
CGNメニュー
LSN Pool設定メニュー
LSN Poolの設定
Endpoint-Independent Mapping 設定
データプレーン統合ソリューション
Mobile Data Planeの統合
F5 Vision: 3GPP Mobile Date Plane Architecture
F5 Approach
Typical Approach
Optimize Plane Application Plane VAS Plane
F5をLBとしてのみ利用
URL Filtering
WAP GatewayVideo Optimization
Internet
Transparent caching
GGSNPGW
RTR DPI FW CGN
VAS / Optimization
RTR
AAA PCRF OCS
Radius Gx Gy
F5をトラフィックステアリングとLBとして利用
URL Filtering
WAP GatewayVideo Optimization
Internet
Transparent caching
GGSNPGW
FW CGN RTR
VAS / Optimization
AAA PCRF OCS
DPI
Radius Gx Gy
LB/CGN/DPIの統合による、管理ポイントと運用コストの削減
URL Filtering
WAP GatewayVideo Optimization
Internet
Transparent caching
GGSNPGW
DPI FWCGN RTR
VAS / Optimization
AAA PCRF OCS
Radius Gx Gy
