Microsoft PowerPoint - TD_CGN.pptx

Size: px

Start display at page:

Download "Microsoft PowerPoint - TD_CGN.pptx"

ことこみおか
5 years ago
Views:

1 F5 BIG-IP による CGN(CAREER GRADE NAT) 紹介

2 Version 11.3 CGN リリース

3 11.2 以前の IPv4 アドレス枯渇及び IPv6 ソリューション Translation NAT44, with simple irule NAT64 and DNS64 HSL engineによる高性能なログ出力 Tunneling IP in IP Dual Stack HW, SWの制限なし IPv4 and IPv6 VS 22 のサービスプロバイダでの利用実績

4 NAT44 を実施する irule の例 ~ ユーザー単位のポートの利用制限 ~ irule deterministic_snat_nat44 ltm rule /Common/deterministic_snat_nat44 { when RULE_INIT { set static::count 0 set static::ppu 2000 } when CLIENT_ACCEPTED { set port_min [expr ([getfield [IP::client_addr] "." 4]%32)*$static::ppu ] set port_max [expr $port_min + $static::ppu 1 ] set hint_ip 192.[getfield [IP::client_addr] "." 2].[expr ([getfield [IP::client_addr] "." 3] 1)%4 +1].[expr ([getfield [IP::client_addr] "." 4]/32) +1] # actual port used depends on hash of src_port and dst_port and tmm set real_port [TCP::unused_port [IP::local_addr] [TCP::local_port] $hint_ip [TCP::client_port] $port_min $port_max] if { $real_port < $port_min $real_port > $port_max } { incr static::count log local0.alert "[format %15s:% 5u [IP::client_addr] [TCP::client_port]] : [format %15s:% 5u $hint_ip $real_port] : [format %5u %5u %5u $port_min $real_port $port_max] : Not Ok $static::count" } reject # don't perform suspended operation here (otherwise, there might be a race condition that other connection for the same tmm may use same port?) snat $hint_ip $real_port forward }

$NAT44 を実施する irule の例 ~ ユーザー単位のポートの利用制限 ~ irule deterministic_snat_nat44 ltm rule /Common/deterministic_snat_nat44 { when RULE_INIT { set static::count 0 set static::ppu 2000 } when CLIENT_ACCEPTED {$

5 NAT44 を実施する irule の例 ~ ユーザー単位のポートの利用制限 ~ irule deterministic_snat_nat44 ltm rule /Common/deterministic_snat_nat44 { when RULE_INIT { set static::count 0 set static::ppu 2000 } when CLIENT_ACCEPTED { set port_min [expr ([getfield [IP::client_addr] "." 4]%32)*$static::ppu ] set port_max [expr $port_min + $static::ppu 1 ] set hint_ip 192.[getfield [IP::client_addr] "." 2].[expr ([getfield [IP::client_addr] "." 3] 1)%4 +1].[expr ([getfield [IP::client_addr] "." 4]/32) +1] # actual port used depends on hash of src_port and dst_port and tmm set real_port [TCP::unused_port [IP::local_addr] [TCP::local_port] $hint_ip [TCP::client_port] $port_min $port_max] if { $real_port < $port_min $real_port > $port_max } { incr static::count log local0.alert "[format %15s:% 5u [IP::client_addr] [TCP::client_port]] : [format %15s:% 5u $hint_ip $real_port] : [format %5u %5u %5u $port_min $real_port $port_max] : Not Ok $static::count" } reject # don't perform suspended operation here (otherwise, there might be a race condition that other connection for the same tmm may use same port?) snat $hint_ip $real_port forward }

6 Version 11.3 以降では irule 不要

7 Version 11.3 NAT44 and NAT444: Native based (no irules needed for base feature) Translation address persistence Large scale configuration Configurable Logging Endpoint independent mapping/filtering. Useful for tethering, full cone NAT and P2P features. TCP, UDP and ICMP (per RFC s 4787, 5382 and 6145) ALG functions for port coordination and control plane broken protocols (SIP, RTSP) Additional protocols possible with custom irules

8 実装による性能向上 irule による Deterministic NAT 実施時 CPS はカタログスペックの約 25% に性能が劣化機能実装によりほぼカタログスペックの CPS 性能を実現

9 F5 のソリューションによる IPv6 への投資計画 ~CGN(NAT44) からユーザーの IPv6 化 (NAT64, DNS64)~

10 CGN 導入前 Mobile Smart Devices 3G PC/Laptop HSPA/HSDPA 3G F5 Internet IPv4 IPv4(Pub) GGSN Traffic Steering Mobile Optimization (Flash networks)

11 ユーザー数増加により IPv4 アドレスの欠乏が発生

12 一部ユーザーの NAT44 移行 IPv4 アドレスの有効利用

13 一部ユーザーを NAT44 に収容 Mobile Smart Devices 3G IPv4(Pri) IPv4(Pub) PC/Laptop HSPA/HSDPA 3G Destination IPv4 F5 NAT44 F5 Destination IPv4 Internet IPv4 GGSN Traffic Steering Mobile Optimization (Flash networks)

14 全ユーザーを NAT44 に移行

15 全ユーザーを NAT44 に収容 Mobile Smart Devices 3G IPv4(Pri) PC/Laptop HSPA/HSDPA 3G Destination IPv4 F5 NAT44 F5 Destination IPv4 Internet IPv4 GGSN Traffic Steering IPv4(Pri) BRAS Mobile Optimization (Flash networks) Broadband

16 IPv6 と IPv4 の混合利用

17 v4 ユーザーは NAT44 v6 ユーザーは NAT64 を利用して v4 ネットワークへ接続 Mobile Smart Devices 3G IPv4(Pri) IPv6(Pub) PC/Laptop HSPA/HSDPA 3G Destination IPv4 Destination IPv4 F5 NAT44 NAT64 F5 Destination IPv4 Destination IPv4 Internet IPv4 GGSN 4G Traffic Steering IPv4(Pri) BRAS Mobile Optimization (Flash networks) Broadband

18 設定画面サンプル

19 CGN メニュー

20 LSN Pool 設定メニュー

21 LSN Pool の設定

22 Endpoint-Independent Mapping 設定

23 データプレーン統合ソリューション

24 Mobile Data Plane の統合 F5 Vision: 3GPP Mobile Date Plane Architecture Typical Approach F5 Approach Optimize Plane Application Plane VAS Plane

25 F5 を LB としてのみ利用 VAS / Optimization Video Optimization WAP Gateway GGSN PGW RTR DPI FW CGN RTR Internet Radius Gx Gy URL Filtering Transparent caching AAA PCRF OCS

26 F5 をトラフィックステアリングと LB として利用 Video Optimization WAP Gateway VAS / Optimization GGSN PGW DPI FW CGN RTR Internet Radius Gx Gy URL Filtering Transparent caching AAA PCRF OCS

27 LB/CGN/DPI の統合による管理ポイントと運用コストの削減 Video Optimization WAP Gateway VAS / Optimization GGSN PGW CGN DPI FW RTR Internet Radius Gx Gy URL Filtering Transparent caching AAA PCRF OCS

Microsoft PowerPoint - F5_IPv6_solution.pptx

Microsoft PowerPoint - F5_IPv6_solution.pptx F5のIPv4アドレス枯渇対策移行ソリューションのご紹介 F5のソリューション 3 F5ソリューション: IPv4/トランスレータ Handsets Devices IPv4 Legacy Devices GW IPv4 GW DNS64 NAT44/NAT64/NAT66 Translation Logging IPv4 Internet/ Network Internet/ Network