Introduction
The purpose of this document is to explain how to configure ACE for TFTP load-balancing. Load-balancing TFPT can be tricky as the TFTP server opens a random UDP port to send data from. Because of this we need a catch-all VIP to source NAT the new connection in the opposite direction. For more info please refer to RFC 1350. TFTP uses two flows and we dont have tftp inpect/fix available in ACE. See below steps to understand the issue.
1) Client initiate the session using UDP flow to port 69 from a random port, lets say X.
2) server replies with data, opening a new UDP flow towards the client. Server's source port is random, while destination port for this response is X .
3) Now ACE has no clue about TFTP flows (lack of tftp fix/inspect), hence client will recieve tftp response from Real server directly.Since the response is not from VIP (where client sent the request),Client will drop the response.
Real Server and Server Farm
Real servers are dedicated physical servers that you typically configure in groups called server farms. These servers provide services to clients, such as HTTP or XML content, streaming media (video or audio), TFTP or FTP uploads and downloads, and so on. You identify real servers with names and characterize them with IP addresses, connection limits, and weight values..
Server farms are groups of networked real servers that contain the same content and that typically reside in the same physical location in a data center. Web sites often comprise groups of servers configured in a server farm. Load-balancing software distributes client requests for content or services among the real servers based on the configured policy and traffic classification, server availability and load, and other factors. If one server goes down, another server can take its place and continue to provide the same content to the clients who requested it.
Configuration
Here is a sample config. The colored part is what is specific for TFTP scenario - this is the config that NATs all UDP connections originated from the servers and sets the VIP address as the source. The rest is classical L4 load-balancing on ACE.
// access-list to catch all traffic
access-list ANYONE line 10 extended permit ip any any
probe icmp PING
// define the tftp servers
rserver host tftp-server1
ip address 10.10.10.101
inservice
rserver host tftp-server2
ip address 10.10.10.102
inservice
// allocate tftp servers to serverfarm
serverfarm host TFTP-SFARM
probe PING
rserver tftp-server1
inservice
rserver tftp-server2
inservice
// create class map to match traffic to tftp server VIP
class-map match-any TO-TFTP-VIP
description class-map for client to TFTP VIP traffic
match virtual-address 192.168.0.100 udp eq 69
// create class map to match all return traffic from tftp server
class-map match-any FROM-TFTP-REAL
description class-map from tftp server to client
match virtual-address 0.0.0.0 0.0.0.0 udp eq any
policy-map type loadbalance first-match TFTP-POLICY
class class-default
serverfarm TFTP-SFARM
// create policy map to define action for traffic to the tftp server
policy-map multi-match CLIENT-VLAN-VIPS
class TO-TFTP-VIP
loadbalance vip inservice
loadbalance policy TFTP-POLICY
loadbalance vip icmp-reply active
// create policy map to define action for return traffic from tftp server
policy-map multi-match SERVER-VLAN-VIPS
class FROM-TFTP-REAL
nat dynamic 100 vlan 20
// define the client side and server side vlans
interface vlan 20
description CLIENT-VLAN
ip address 192.168.0.1 255.255.255.0
access-group input ANYONE
access-group output ANYONE
nat-pool 100 192.168.0.100 192.168.0.100 netmask 255.255.255.255 service-policy input CLIENT-VLAN-VIPS
no shutdown
interface vlan 30
description SERVER-VLAN
ip address 10.10.10.254 255.255.255.0
access-group input ANYONE
access-group output ANYONE
service-policy input SERVER-VLAN-VIPS no shutdown
The SERVER-VLAN-VIPS service-policy will NAT all UDP connections from this VLAN to the VIP. If this needs to be done only for certain source IPs, a more creative FROM-TFTP-REAL class-map needs to be configured.
Related Information
ACE Loadbalancing-TFTP server
ACE in HA Mode for FTP Traffic Loadbalancing
Server Load-Balancing Guide vA4(2.0)
