A10AX链路负载均衡配置及运维手册

1、A10 AXU路H戴均衡配置及建雉手册1.余周路拓摆A10 AX1000CTC 94/29CNC 28/25 internal 7/24GWCTC 93GWCNC 29SSL VPNWeb ServersClients2. IP地址分配VlanInterfaceIPGWCTC1/294/2993CNC3/428/2529Internal5/67/246Virtual serverIPPoolPool membersctdns_9898接收DNS言青求的位 址cncdns_3131接收DNS言青求的位 址vpn_9595vpn_tcpvpn_udp:0SSL VPNweb_9696sg_web:

2、80Web伺服器在重信 端的地址web_2929sg_web:80Web伺服 器在通 端的地址硬H资言私1. tH#外觐指示燎IS色状熊茨:明POWERGreenOnOffHDDOrangeOn硬碟中白瓷料前的Off如ft腐&曲STATUSGreenOn系统止在被前的Off系统矮数摞前的EthernetPorts(Cat-5)L/AGreenOffLink DownOnLink UpFlashACT- ActivitySPDOffOff10MGreenOn100MOrangeOn1GEthernetPorts(Fiber)L/AGreenOffLink downOnLink upACTGree

3、nOffACT - No ActivityFlashACT - Activity二、登AX系列崖品支援以下介面管理方式:命令列介面（CLI） : AX支援通谩串口或路逋接来粉冏命令列 介面，命令列介面支援SSH v1/2或Telnet曲定登金录方式。圄形化使用者介面（GUI） : AX支援基於Wetail器的管理和配 置方式。BI形化使用者介面支援 HTT讲口 HTTPSfO录方式， 支援HTTP!J HTTPS勺重定向。注意：58tg情况下，AX在所有介面上（包括管理介面）禁止探用Telnet方式粉冏。58没情况下，管理介面允泮通谩 SSH HTTP HTTPSffi SNMFP?Wl 迤行

4、管理和粉冏。58tg情况下，资料介面不允音午任何曲定迤行管理和粉冏。如需在资料介面上11段管理功能.命令列登陛方式探用AX自带的Console Sit, RJ45介面一端逋接AXW, RS-232介面 一端逋接具有端I比fd1的PC端。H改AX雷源，探用16 （直逋或交叉均可）逋接AX的MGMT面 和PCAX的 MGMT面的58段 IP 位址悬：1/24。 PC的 IP 位址 配置悬典AX的MGMT面同斛段的位址（如：3/24 ）探用SSH用户端软H （如：PuTTY等前的AX的MGM介面位址。也可通谩H矜埠前曲段借，如下圄：AX的5H鼓:使用者名悬：admin, 5H鼓:密山厚热：a10。此

5、虑密礁已改悬 kubeilanda10AX探用I似Cisco的命令列模式，便於工程肺操作和雉1）常通谩SSH用户端软醴或速端端械软醴登金录 AX畤，30俞入使用者ISItirlW,刖迤入AX的使用者模式:2)jjwxc-23）在使用者模式下，AX只允音午使用一些基本的命令，查吉旬状熊基本资Ifto具H可使用的命令列表可通谩“？ ”来查言旬。jjwxc-2?axdebug AX Debug Commands enable Turn on privileged commands exit Exit from exechelp Description of the Interactive Help

6、System no Negate a command or set its defaults ping Send ICMP echo messages show Show Running System Information sshOpen an ssh connectiontelnetOpen a telnet connectiontraceroute Trace route to destination4）在使用者模式下，巾俞入“ enable”彳爰，提示输入迤入特榷模式的密碣（5516瓢密礁）。在输入正碓的密礁彳爰，迤入系统的特榷模式。jjwxc-2enablePassword:AX#5

7、）在特榷模式下，可以通谩show命令查看系统常前的逋行状熊。此外，在特榷模式下，可以通谩命令重改或重新载入系统。特榷模式下可以使用的命令同檬也可以通谩“？ ”来查言旬。AX#?active-partition Change active partitionaxdebugAX Debug CommandsclearClear or Reset FunctionsclockSet the System ClockconfigEntering config modedebugDebugging functionsdiffCompare difference between Configuration

8、 ProfilesdisableTurn off privileged commandsexitExit from execexportPut a file to a remote sitehelpDescription of the Interactive Help Systemimport localeGet a file from a remote siteSet locale for current terminalnoNegate a command or set its defaultspingshowSend ICMP echo messagesShow Running Syst

9、em InformationsshOpen an ssh connectiontelnetOpen a telnet connectionterminaltracerouteSet Terminal Parameters, only for current terminal Trace route to destinationwriteWrite ConfigurationshutdownrebootShutdown the SystemReboot the SystemreloadReload the system, without rebooting6）在特榷模式下，通谩“ config

10、terminal 命令，可以迤入到全域配置模式下。在全域配置模式下，可以完成 AX的路、系统、均衡功能等的配置任矜。AX#config terminal AX(config)#注意：1） AX在命令列下的基本操作格典 Cisco完全一致，如：Tab 命令列祷全。通谩在命令彳爰加曲虢来查言旬命令全耦或支援的子命令。2）悬了防止配置街突，在同一畤AX僮允言午一他使用者迤入全域配置模式。因此，常巾俞入迤入全域配置介面畤，命令列有以下提示，即明常前已系区有管理H在配置模式下工作。如果你需要迤入配置模式，可以要求其他管理H退出配置模式或通谩命令清除其他 管理H的CLI ,#, (config)#等之前的

11、部分即IgigHS的主械名耦。畤匾、畤置1S置畤K：在CLI全域配置模式下，用clock命令配置畤小例：4各畤1M置悬北与畤(MAX(config)#clock timezone Asia/ShanghaiIS置畤在CLI特榷模式下，用clock命令配置畤瓷轩I示例：符畤段置悬2008年12月25日12:30:00AX#clock set 12:30:00 December 25 200818示畤IW、AX#show clock*11:38:20 CST Sun Dec 28 2008修改管理jM密礁输入新密礁雨次，碓定，保存五、余周路配置1. Vlan 定AX的VLAN配置典襟型的802.1

12、q曲定相容。58IS配置下，AX的所有ethernet 介面均H於 VLAN 1。在VLAN中，AX的ethernet介面可以有雨槿状魅：tagged和untagged。tagged介面可以同畤H於多（0 VLANuntagged介面只能分配给覃（0 VLAN在左A0功能功能表中，圜？ “配置模式”，黑占擎翔路 -VLAM ,迤入VLAN配置介面，在介面中，可以封新增、修改或删除VLAN0已置在右侧配置介面中，黑占擎“添加”退撵介面状熊：未株己的（untagged）或株己的（tagged） 融VLANb配三唇虚擦子介面2. Vlan介面位址定在左勺功能功能表中，逐撵“配置模式”，黑占擎萼周路

13、- 介面”在右UIB部子功能表中，黑占拳“虚擦”，迤入虚擦子介面消覃面黑占擎要配置的虚SS子介面，迤入虚SS子介面配置介面填U IP地址和子税I路遮罩3.路由U定1）在左侧功能功能表中，逐撵“配置模式”，黑占擎萼周路 -路由”，迤入路由配置介面。AX支援静熊和勤熊路由式通轩1曲定,以及IPv6下的静熊路由式通轩I曲定。道木里彳堇介貂IPv4静熊路由式通轩I曲定的IS置步骤配胃*士HA 一也而曰*傀有n向埴7-mb*n口由也。S.O.A.D222210 192.i_口口 口 0口 0AD门？口齿.1国1-：2S5W十耀Ifi Z7 D255 255255 3“&51 (J255 2&525E。1

14、7215 30651】理过的白255 25525E J1721.3066172M2E25SSES25E01721620153F.乜之二17216.3.66二三5 2E三工三E 3O* c Hh SPDUdr Al -J_3rOL4f1T2J- 1 二2）在右Bl部子功能表楠中黑占擎“ IPv4静熊的，迤入IPv4静熊路由式通制I曲定1S置介面3）as “新增”，迤入静熊路由is置真面a）填; IP位址首!b）填嘉子税I路遮罩c）填HfW道（下一跳路由）4）黑占擎“碓定”，完成静熊路由的创建六、H载均衡功能配置1.伺服器H载均衡部分（SLB1）添加伺服器N铝JMflitt 生国苣7 *1ri 理

15、1* 1! 1 pF 口鼻嗝MU7- HsaHh ; cnt_tank59 33 4：7 12Sping_di&ckQQ口 d_iinir 23gM，昭 pmg!_fiGckQQ rs_1J2.ie 29丐17216 23 55_6eeT00口 /0=1厚5中3117217 12pingQQiMJ巳立昵在nQ 圈也0KW0 g用如添加web伺服器rs_ ,鼓:定名耦，ip地址，迫I各伺服器的服矜埠80添加到埠表中碓定即可2）伺服器&帚黜r ?kAM * u bvitundJ AX1K0位行 广注用徜需Mess/配置&*巾耳.殳周什. ) t 卿 91* H 1.眈 *p 5Lff“以也k P0

16、M.fiw 0支噌x OSLfiH好曲* M，例售冏咕将讨* =&绩|1 cnc._lmk_fczp7CF会由RI CTc:_lmk_udpU0P轮由口 d_lini,_fcpTCP轮由 nJIfju 制UDP轮由 8laLEUJ3ue,*y_CHMGilTCP轮/ 渤aWL也健，el*一u小UPP轮而制_a口TCP轮而帝5TCP*淘口出“邛UDFIf-ifl2中造Q如符web伺服器添加到伺服器黜sg_web中。段定名耦，或撵伺服器资源(rs_ ),指定埠80,添加到黜列表中程福羊品5LR 结材了尹任眸餐冢，也丫,美型1Tp7，注端询*谆用爆期“晶小庭乱成目；fii。/界PvdilPrfl口B

17、S0r=172 1629.5磐器；口镇植AT临，工悔2或5用JLEC施加vpa._112. 17. 1. 3 ctJ.Lnk cm IkLlk优先频：1|v自里智5PT优先转 喉rcJ7Z U EB.Elfault1碓定即可。3)IS置虚ss伺服器因web服矜要在ft信和通分别亵佛服矜，所以要在18信和通各段定一他virtual server 的位址，如重信的是 96 ,堵周通的是 29。段定名耦和地址添加埠资源，逐定匹配的伺服器黜和保持模式，如下圄，然彳爰碓定。区周通端的virtual server也是I似的配置方法。2. SS路H载均衡部分（GSLB定 DNS代理，道彳固是 AX 接收 D

18、NS解析者青求的位址AX-kubvadnd/AX1&HA法有配五况行 ZHffi 由帮鼬。1口律理 r n配宜用支匚打二代理策略Oir站卢钮定羲 GSLB勺策略 kubeiland policyGSLB kuoDiiaridjKlic名毒产kubeiland_paliqi霍讣去日随投使用中UthChiHk未史用Geognaph掘 ffi AcliireRTT逗中伺服器模式定廉域路彝伟的服矜IP资源置站瓷言孔，道是服矜ip和I1路梆定的配置如在重信站ct_site , 定iKit路的介面位址定域，道是彝伟服矜的功能燮数名耦定七、常用雉1,配置保存及恢彳复系统黜IBS份1）在左侧功能功能表中，黑占

19、擎”配置模式 - 系统-雉”2）在右部的“借份”子功能表楠中可以逗撵下列a）催f份- 系统：催?份整他I系统,包括：改S&鼓:定槽、aRules指令槽、健康检查指令槽、黑白名覃、SSLlgltlt善和金编等b）借份- 配置：僮借份指定的段定槽（改勤配置或常前配置）c）借份-系统日借份存在AXigHS中的系统日应冏备伶莹：俗本地远程3）逐撵借份槽案的保存位置。可退撵借份至本地或速端。a）逐撵借份至本地，黑占擎“鹰用”，AX曾弹出“文件下载” ！1 界舌方Mo逗撵下载目金泉彳爰，流霓器曾自勤的符逗撵借份的内容下载到本地甯:月简b）逐撵借份至速端，刖可以避撵符槽案借份至速端的FTR TFTRRCR

20、SCP伺服器。填U主械（IP位址）、埠、路彳至、使用者和 密码彳爰，AX曾自SM各逗撵借份的内容上伸到指定的伺服器。1）在左侧功能功能表中，黑占擎”配置模式 - 系统-雉”2）在右Bl部的“恢彳复”子功能表楠中，可以逐撵下列ilKga）恢彳复，系统：恢彳复整他系统，包括：改勤段定槽、aflex指令槽、健康检查指令槽、黑白名覃、SSLlgltlt善和金编等。b）恢彳复-配置：僮恢彳复IS定槽，可退撵符段定槽恢彳复到改勤配置或常前配置。3）逐撵恢彳复槽的位置，系统支援优本地或速端恢彳复。a）本地：优本地ft膈中避撵需要恢彳复的配置（或系统）槽。b）速程：优速端伺服器恢彳复，需要填瘾速端伺服器的主械

21、IP位址、埠、服10型（FTP TFTP SCP RCP、路彳至及槽案名、用户名和密礁。恢复自；本地近程修改；ftF jJ TOC o 1-5 h z 主机；|攀口；|21（1-65535）潞铅：|用户：|至理|应用4）逐撵恢彳复槽的位置彳爰，黑占擎“鹰用”，系统曾弹出以下！I界舌方现，提示系统符在完成配置上停彳爰重新H械（重新改勤内核，相常於Windows Internet EKplorerreload 命令）。2d0 执行系烧假塞得便设备和W日哈话重新裁入，随定要健鲜？匚二鲤二二il取消I2,常用雉命令D示系统常前资源配置情况，如：系统常前及支援的最大伊彝逋接数(l4-session-co

22、unt ),系统常前及支援的最大real server数量(real-server-count ) 等AX#show system resource-usageResourceCurrent Default Minimum Maximuml2-mac-count5125125128192l3-route-cache-count2562562568192l4-session-count6291456 1048576 13107216777216real-server-count102410245124096real-port-count204820485128192service-group-c

23、ount5125125122048virtual-port-count102410242562048virtual-server-count5125125122048http-template-count256256321024proxy-template-count256256321024conn-reuse-template-count 256256321024fast-tcp-template-count256256321024fast-udp-template-count256256321024client-ssl-template-count256256321024server-ss

24、l-template-count256256321024stream-template-count256256321024persist-cookie-template-count 256256321024persist-srcip-template-count 2562563210242) K示AX系统软H、硬醴及固件的版本瓷制IAX#show versionAX Series Advanced Traffic Manager AX2200Copyright 2007-2008 by A10 Networks, Inc.Advanced Core OS (ACOS) version 1.2.

25、4, build 271 (Dec-11-2008,12:24)Booted from hard disk primary imageSerial Number: AX22141108340045Firmware version 7.9aRule version: 1.0,0Hard disk primary image (default) version 1.2.4, build 271Hard disk secondary image version 1.2.1, build 368Compact flash primary image (default) version 1.2.1, b

26、uild 368Compact flash secondary image version 1.2.1, build 368Last configuration saved at Dec-24-2008, 22:40Hardware: 8 CPUs, Dual 150G Hard diskMemory 4146 Mbyte, Free Memory 416 MbyteCurrent time is Dec-28-2008, 19:58The system has been up 16 days, 9 hours, 50 minutes3）查AX常前逋行的性能状憨资料AX#show slb pe

27、rformance interval 2Refreshing SLB performance every 2 seconds. (press AC to quit) Note: cpi conn/interval, tpi transactions/intervalCPU UsageL4cpiL7cpiL7tpiSSLcpiNatcpi Time13/12/13/135557225748190019:59:3713/13/12/125808214949630019:59:3913/13/12/125958206746520019:59:4113/13/13/136150200448020019

28、:59:4312/12/12/126362206749940019:59:4512/11/13/126419207748960019:59:474) 查询 AX,ij 前的 session状况AX#show sessTraffic TypeTotalTCP Established49380TCP Half Open249810UDP0Non TCP/UDP IP sessions0Other1399Reverse NAT TCP0Reverse NAT UDP0Free Buff Count0Curr Free ConnConn CountConn Freed tcp syn half ope

29、n542646115388542015302064820189Prot Forward Source Forward DestReverse Dest Age HashReverse SourceTcp 15:1831 84:809:8023:3520240 1Tcp 25:53408 89:801:8025:53408 120 1Tcp 70:2229 89:808:8070:2229 120 1Tcp 97:11079 81:80:8023:8508180 15）查介面的基本状熊资轩IAX#show interfaces ethernet 1Ethernet 1 is up, line p

30、rotocol is upHardware is GigabitEthernet, Address is 001f.a001.0d52Internet address is , Subnet mask is Configured Speed auto, Actual 1Gbit, Configured Duplex auto, Actual fdxMember of L2 Vlan 2, Port is TaggedFlow Control is disabled, IP MTU is 1500 bytesPort as Mirror disabled, Monitoring this Por

31、t disabledMember of trunk group 1 Primary Port2626863166 packets input, 18947933902591 bytesReceived 109770 broadcasts, Received 2792987 multicasts, Received2623960409 unicasts0 input errors, 0 CRC 0 frame0 runts 0 giants4219761737 packets output 19648722561084 bytesTransmitted 0 broadcasts 18447 mu

32、lticasts 4219743290 unicasts0 output errors 0 collisions300 second input rate: 145424752 bits/sec, 41878 packets/sec, 14%utilization300 second output rate: 141355168 bits/sec, 36442 packets/sec, 14%utilization6）查看所有介面的基本统言十资制IAX#show statisticsPort Good Rcv Good Sent Bcast Rcv Bcast Sent Errors12627

33、03438642199116531097700023148297539264009641295630115130160332145918434215949736202135500423017670344216211751174720050000060000070000080000090000010000001100000120000013000001400000150000016572645357265414755488701700000180000019000002000000XAUI 24208541782706797108 442095931096537）查看ethernet介面的基本统

34、言十4犬!18资轩1AX#show statistics interface ethernet 1Port Link Dupl Speed IsTagged MAC Address IP Address1 Up Full 1000 Tagged 001F.A001.0D52 Port 1 Counters:InOctets 18948220633412OutOctets 19649002019283InPkts 2627568556OutPkts 4220376013InBroadcastPkts109770 OutBroadcastPktsInMulticastPkts2793024 Out

35、MulticastPkts18447InUnicastPkts2624665762 OutUnicastPkts4220357566InBadPktsOutErrorsInFragmentsCRCInDiscardsCollisionsInErrors0 LateCollisionsInGiantPkts0InShortPkts0InJabber0InFlowCtrlPkts0 OutFlowCtrlPkts0InUtilization14 OutUtilization148）查H http-proxy 常前的基本逋行资制1AX#show slb http-proxyTotalCurr Pro

36、xy Conns190381Total Proxy Conns399668796HTTP requests 946982935 HTTP requests(succ) 946361043 No proxy error 0 Client RST 252041605 Server RST56018 TOC o 1-5 h z No tuple error0Parse req fail700Server selection fail 0 Fwd req fail5595Fwd req data fail0Req retransmit0Req pkt out-of-order 0 Server res

37、election 0 Server premature close 0 Server conn made7182008Source NAT failure0Tot data before compress 0 Tot data after compress 09）查TCP-Proxy常前的逋行基本瓷制IAX#show slb tcp-proxyTotalCurrently EST conns 187078Active open conns 7178534 Passive open conns 399688841Connect attemp failures 0Total in TCP pack

38、ets 1425422464Total out TCP packets 1629985150Retransmited packets 710061378Resets rcvd on EST conn 254662860Reset Sent 4422941AX#show slb conAX#show slb connection-reuseTotalOpen persist1262Active persist585Total established7121154Total terminated7121610Total bind947000369Total unbind946443651Delay

39、ed unbind0Long resp0Missed resp0Unbound data rcvd0查H url-hashing 的常前通行基本瓷制1AX#show slb persistTotalURL hash ok (pri) 946593716URL hash ok (sec) 515121URL hash fail 0查伺服器的常前逋行基本瓷制IAX#show slb serverTotal Number of Services configured: 98Current = Current Connections, Total = Total ConnectionsReq-pkt

40、= Request packets, Resp-pkt = Response packetsServiceCurrent Total Req-pkt Resp-pkt Statesquid_1:80/tcp64355476241778009336307890Upsquid_1: Total64355476241778009336307890Upsquid_2:80/tcp60286114254786003348995169Upsquid_2: Total60286114254786003348995169Upsquid_3:80/tcp59246553250260252342244125Ups

41、quid_3: Total59246553250260252342244125Up查t1服矜黜的常前逋行基本瓷制IAX#show slb service-groupTotal Number of Service Groups configured: 11Current = Current Connections, Total = Total ConnectionsReq-p = Request packets, Resp-p = Response packetsService Group NameServiceCurrentTotalReq-p Resp-p*sg-img01State: Al

42、l Upsquid_1:8063355477241783091 336314488squid_2:8058286118254791082 349001998squid_3:8058246554250265795 342251009squid_4:8060248818268123564 366016882squid_5:8053267696248790345 339888477squid_6:8054301258239579289 324911571查VIP常前逋行的基本瓷制IAX#show slb virtual-serverTotal Number of Virtual Services c

43、onfigured: 11Virtual Server Name IP Current Total RequestResponseService-Group Service connection connection packets packets*vip-img0181port 80 httpsg-img0180/http 3381705950 15033686192058432509Total received conn attempts on this port: 98807531*vip-img0282port 80 httpsg-img0280/http 3551723176 151

44、22789142077867603Total received conn attempts on this port: 98618839查看系统常前配置的NAT位址集显及其使用情况AX#show ip nat pool statisticsPool Address Port Usage Total Used Total Freed Failednat-g1 23 1363719991971985560Pool Address Port Usage Total Used Total Freed Failednat-g2 24 0863386330sh run!Current configurat

45、ion : 6413 bytesConfiguration last updated at 16:29:45 CST Thu Nov 5 2009Configuration last saved at 16:29:45 CST Thu Nov 5 2009 version 2.2.4-p4, build 3 (Oct-16-2009,21:21) !hostname AX-kubeiland!clock timezone Asia/Shanghai vlan 2untagged ethernet 1 to 2 router-interface ve 2 name CTC !vlan 3unta

46、gged ethernet 3 to 4 router-interface ve 3 name CNC !vlan 4untagged ethernet 5 to 6 router-interface ve 4 name internalaccess-list 5 permit any interface managementip address 1 flow-control!interface ve 2ip address 94 48ip nat outsidename CTC!interface ve 3ip address 28 28ip nat outside-MORE-name CN

47、C!interface ve 4ip address 7 ip allow-promiscuous-vipip nat inside name internal!ip route /0 93ip route /0 29ip route /16 6ip route /24 6ip route /24 6ip route /24 6ip route /24 6ip route /24 6ip route /24 6 ip nat pool out_nat_ct 94 94 netmask /29ip nat pool out_nat_cnc 28 28 netmask /25ip nat pool

48、 out_nat_vpn 95 95 netmask /29ip nat pool-group out_nat out_nat_ct out_nat_cnc health monitor ping_check interval 2 timeout 1 health monitor tcp_check interval 2 timeout 1 method tcp port 80!health monitor sip_checkoverride-ipv4 method tcp port 80!bw-list geo_out_bwlist!-MORE-!slb server vpn_ health

49、-check pingport 0 tcpno health-checkport 0 udp no health-check!slb server ct_link 93 health-check ping_checkport 0 tcpno health-checkport 0 udp no health-check!slb server cnc_link 29 health-check ping_checkport 0 tcpno health-checkport 0 udp no health-check!slb server rs_ health-check tcp_checkport

50、80 tcpno health-check!slb service-group sg_web tcp member rs_:80slb service-group vpn_tcp tcpmember vpn_:0slb service-group vpn_udp udp member vpn_:0!slb service-group ct_link_tcp tcp member ct_link:0 priority 5 member cnc_link:0-MORE-!slb service-group ct_link_udp udp member ct_link:0!slb service-g

51、roup cnc_link_tcp tcp health-check ping_check member cnc_link:0 priority 5 member ct_link:0!slb service-group cnc_link_udp udp health-check ping_check member cnc_link:0!slb service-group default_gateway_pool_tcp tcp health-check ping_check member ct_link:0 member cnc_link:0!slb service-group default

52、_gateway_pool_udp udp health-check ping_check member ct_link:0 member cnc_link:0!slb template policy vs_out_policy bw-list name geo_out_bwlist bw-list id 1 service-group ct_link_tcp bw-list id 2 service-group cnc_link_tcp use-destination-ip!slb template persist source-ip source_addr_jimmy slb templa

53、te persist destination-ip dst_addr_jimmy slb virtual-server ctdns_98 98port 53 udpgslb-enable-MORE-!slb virtual-server cncdns_31 31port 53 udpgslb-enable !slb virtual-server vpn_95 95port 0 tcpservice-group vpn_tcpuse-rcv-hop-for-respaccess-list 5 source-nat-pool out_nat_vpnport 0 udpservice-group v

54、pn_udpuse-rcv-hop-for-respno-dest-nataccess-list 5 source-nat-pool out_nat_vpn !slb virtual-server web_96 96port 80 tcpservice-group sg_webuse-rcv-hop-for-resptemplate persist source-ip source_addr_jimmy access-list 5 source-nat-pool out_nat!slb virtual-server vs_out port 0 tcpservice-group default_gateway_pool_tcpuse-rcv-hop-f