English 中文(简体)
确保网络冗余性:如何在没有停机的情况下从默认ISP切换到备用ISP。
原标题:
  • 时间:2008-12-08 19:44:49
  •  标签:

这是情况。我正在与这家小公司合作,他们希望拥有冗余的互联网接入。他们从办公室运行一堆服务-一个网站、POP+SMTP服务器,使用VPN从家里访问网络共享。他们有两个独立的互联网连接,来自两家ISP(一家是当地的有线电视提供商,另一家是DSL)。如果他们的默认连接出现问题,他们会切换到备份连接。

不幸的是,目前他们的设置方式需要每次更改DNS记录,这意味着每次切换最好会有几个小时的停机时间。他们想要完全冗余,并能够在网络之间切换而无需停机。如何实现这一点?

能否在远程数据中心设置一个服务器,将DNS指向它,并将其转发网络流量到正确的IP地址?

如果只是一个Web应用程序,我会建立一个基本的服务器,并使用301重定向或类似的东西。我并不在乎它每次都需要手动切换,因为他们的员工中有一两个专门的IT人员可以做到这一点。但他们还需要将他们的POP、SMTP和VPN流量重定向到这里。

这就像是负载均衡一样,但实际上并不是。有现有的解决方案可以提供这个功能吗?你怎么提供像这样的ISP冗余性?

最佳回答

Last time I did it, I had my own ASN and spoke BGP to both ISPs announcing my own /24 (which you can get from either ISP, or maybe ARIN). You could go down this route, but its a fair bit of setup. And a random Cable/DSL ISP probably won t set this up with you. This does eliminate all the points of failure and makes the switchover completely transparent.

You can also lower the TTLs on the DNS records to 5 minutes or so. This won t be instant switch over, but 5 minutes may be fast enough.

Otherwise, you certainly can use the remote server in a colo, but then of course that becomes the single point of failure. You have a couple of choices of how to redirect the traffic:

  • GRE/etc. tunnel: You run two tunnels from the colo box, one to each connection at your office. Tunnel all relevant traffic both ways and you wind up with a few IPs from the colo at your office. You can then run a routing protocol (even something simple, like RIP) to make this automatically fail over, or even use both ISPs simultaneously for additional bandwidth. This can be implemented fairly easily on Linux boxes or Cisco routers. I assume Juniper can to, but I ve never used them. Failover is transparent (e.g., will not break VPN connections). Beware of MTU issues. If your office connections do not do reverse path filtering (or can make an exception for you), you do not have to tunnel outgoing traffic back to the colo.
  • NAT. May or may not work with whatever protocols you re running, but you can set up 1:1 static NAT at the colo to redirect the traffic. Easily done for common TCP protocols, and maybe your VPN too. Doable on pretty much anything. Failover is not transparent; existing connections will time out. Can also use both connections for additional bandwidth on a per-connection basis. Traffic must be tunneled back to colo.
  • Obvious third answer: Move the services to the colo. Has the advantage of protecting from power outages, too.
问题回答

我认为DynDns的“自定义DNS”服务可能有助于您的情况-您域名背后的IP地址可能会动态更新(许多路由器都内置了支持)。

Updated: To reduce the downtime, you can create a simple script that pings the primary ISP once a while and in case of failure updates DynDNS to secondary one (and the same way back).

这有点晚,但答案是轮流 DNS。将您的Web服务器(www.example.com)设置为两个IP地址,1.1.1.1和2.2.2.2。当人们尝试访问www.example.com时,浏览器会自动随机尝试一种并在第一个不回答时切换到另一个,然后缓存结果,直到浏览器关闭或连接再次失败。无需停机,如果首先选择错误的IP地址,仅在第一次连接时短暂中断。

实际上,您甚至可以同时在两个IP地址上运行Web服务器; 这被称为超级简单的负载平衡。

你可以设置一个默认下一跳的路由映射。

这将处理出站流量,而不是需要AS号和BGP公告至少为/24的块的入站冗余,因为ISP不会公布小于/24块的任何内容。





相关问题
热门标签