F5应用交付解决方案及产品介绍(User)

单击此处编辑母版标题样式,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,*,*,Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,79,F5,应用交付解决方案,及产品介绍,F5,产品部,周 丹,Tel.: 3850,HP,：,13501150374,Email,：,zhoudan,中国现有,1000+,客户,已经在中国销售,10,000,台,金融,政府及教育,企业,运营商,/,I CP,Others,F5 BIG-IP,平台,介绍,3,Price,Function / Performance,VIPRION,BIG-IP 3600,Dual core CPU,8 10/100/1000 + 2x 1GB SFP,1x 160 GB HD + 8GB CF,4 GB memory,SSL 10K TPS / 2 Gb bulk,1 Gbps max software compression,2 Gbps Traffic,1 Advanced Product Module,BIG-IP 8900,BIG-IP 1600,Dual core CPU,4 10/100/1000 + 2x 1GB SFP,1x 160GB HD,4 GB memorySSL 5K TPS / 1 Gb Bulk,1 Gbps max software compression,1 Gbps Traffic,1 Basic Product Module,2 x Dual core CPU,16 10/100/1000 + 8x 1GB SFP,2x 320 GB HD + 8GB CF,8 GB memory,SSL 25K TPS / 4 Gb bulk,5 Gbps max hardware compression,6 Gbps Traffic,Multiple Product Modules,BIG-IP 6900,2 x Quad core CPU,16 10/100/1000 + 8x 1GB SFP,2x 320 GB HD + 8GB CF,16 GB memory,SSL 58K TPS / 9.6Gb bulk,6 Gbps max hardware compression,12 Gbps Traffic,Multiple Product Modules,Quad core CPU,8 10/100/1000 + 4x 1GB SFP,1x 300 GB HD + 8GB CF,8 GB memory,SSL 15K TPS / 3.8 Gb bulk,3.8 Gbps max software compression,4 Gbps L7 Traffic,Multiple Product Modules,BIG-IP 3900,VIPRION,Single Blade,4 Blade System,L7 Fast HTTP Inf/Inf,800,000 Rps,3,200,000 Rps,L7 Full Proxy Inf/Inf,300,000 Rps,1,200,000 Rps,SSL TPS,50,000,200,000,SSL Gbps,9 Gbps,36 Gbps,L4 Conn/s (1-1),250,000 cps,1,000,000 cps,Compression,4.5 Gbps,16 Gbps,L4 Throughput,10 Gbps,36 Gbps,L7 Throughput,10 Gbps,36 Gbps,2 x Quad core CPU,16 10/100/1000 + 8x 1GB SFP,2x 320 GB HD (S/W RAID) + 8GB CF,16 GB memory,SSL 56K TPS / 9.6Gb bulk,8 Gbps max hardware compression,20 Gbps L7 Traffic,2 x hex core CPU,2 10GB+ 8x optional 10GB Port,2x 320 GB HD + 8GB CF,32 GB memory,SSL 100K TPS / 15 Gb bulk,12 Gbps max hardware compression,40 Gbps L7 Traffic,BIG-IP 8950,BIG-IP11050,低端,中端,高端,产品系列,LTM1600,LTM3600,LTM3900,LTM6900,LTM8900,简要功能说明,LTM,本地服务器负载均衡,LC,多链路负载均衡,GTM,/,/,/,广域网负载均衡，多站点容灾,WA,/,/,/,/,Web,加速,ASM,/,/,/,/,应用防火墙,Edge Gateway,（,APM,）,/,/,/,/,/,SSL VPN,必须通过外部用户认证服务器验证用户（,AD,Radius,LDAP,）,FirePass,FP4305,（,100,并发用户）,FP4310,（,250,并发用户）,FP4320,（,500,并发用户）,FP4330,（,1000,并发用户）,FP4300-E,（,2000,并发用户）,SSL VPN,包含高级功能,Web,通道模式,应用通道模式,网络层透明模式,F5,产品功能介绍,专门的硬件,通过,License,方式递交,F5,新平台性能列表,BIG-IP 1600,BIG-IP 3600,BIG-IP 3900,BIG-IP 6900,BIG-IP 8900,端口,4,个,10/100/1000M +2,个可选（,LX,、,SX,）,SFP,8,个,10/100/1000M +2,个可选（,LX,、,SX,）,SFP,8,个,10/100/1000M +4,个可选（,LX,、,SX,）,SFP,16,个,10/100/1000M +8,个可选（,LX,、,SX,）,SFP,16,个千兆电口,+,8,个,SFP+2,个万兆,SFP,Layer 4,Connections/sec,60,000,100,000,175,000,220,000,400,，,000,Layer 7,Request/sec,100,000,135,000,400,000,600,000,1,200,，,000,Max. throughput,1Gbps,2Gbps,4Gbps,6Gbps,12Gbps,Max. conc. conn.,4 Million,4 Million,8Million,8 Million,16 Million,Max. SSL TPS,5,000,10,000,15,000,25,000,58,000,Max. SSL Bulk,1Gbps,2Gbps,2.4Gbps,4Gbps,9.6Gbps,Max. SSL conc. Conn.,1,000,000,1,000,000,1,000,000,1,000,000,4,000,000,Max. HTTP compression,750Mbps,1Gbps,3.8Gbps,硬件,5Gbps,硬件,8Gbps,Switch backplane,14 Gbps,24Gbps,34Gbps,68Gbps,80Gbps,最佳选择,1,:,虚拟应用动态集群解决方案,“,We expect to see an application delivery controller which is a unique, appliance-based element in the overall IT architectureWe will continue to see more integration of features, more protocol support, more optimization and greater application knowledge. We will see more horizontal scalability, with Application Delivery Controllers (ADCs) designed into network and application architectures so that all applications draw on a common ADC architecture.”,Mark Fabbi, Gartner Analyst,Enterprise Manager,TMOS,iControl,BIG-IP Global Traffic Manager,BIG-IP,WOM Module,BIG-IP Local,Traffic,Manager,BIG-IP Application,Security,Manager,BIG-IP Web,Accelerator,BIG-IP Link,Controller,ARX,File/Data Virtualization,FirePass,SSL VPN,Users,BIG-IP,Edge,Gateway,负载均衡系统是高可用的核心,BIGIP LTM,对外提供一个虚拟的应用服务器，接收所有的客户端请求,BIGIP LTM,通过负载均衡算法处理，将客户端请求转发到后台的多个应用实例,BIGIP LTM,内置可编程控制接口，可以对流量进行编程控制处理,BIGIP LTM,通过应用健康检查，准确的判断应用程序的工作和服务状态，一旦发现应用不能提供服务，则将其从负载均衡组中摘除,V,irtual Server,Network,Application,Application,负载均衡处理,可编程控制,应用健康检查,BIG-IP LTM,Domain,Server 1,Server 2,负载均衡中的,URL Switching,这么多功能都在一台,/,组服务器上无法支撑,/products/,/platform/,/service-training/,/customers/,URL,Switching,iRule,Cache/Web Servers,网络层安全,-,前端七层工作模式,10,Client,Side,TCP,Stack,Server,Side,TCP,Stack,客户端,客户端,客户端,客户端,Virtual Servers,Pools,Profiles,iRules,TMOS,服务器,服务器,服务器,服务器,传输数据,TCP,连接,TCP,连接,TCP,连接,TCP,连接,TCP,连接,TCP,连接,TCP,连接,TCP,连接,黑客,SYN Flood,ACK Flood,RST Flood,Full Proxy,模式下，绝大部分的网络层攻击无法穿越,BIG-IP LTM,One Connect,降低服务器压力,11,HTTP 1.1,客户端,客户端,客户端,客户端,HTTP 1.1,HTTP 1.1,HTTP 1.1,HTTP 1.1,Application,Server,BIG-IP LTM,F5 BIG-IP LTM,强大的应用层交换引擎，可以对多个客户端的,TCP,连接进行合并，通过少量的长连接与后台应用通讯,适合于大并发量的系统使用，尤其对于基于,JVM,的应用系统，可以有效的降低系统在频繁建立和关闭,TCP,连接时所带来的巨大开销,完全兼容,HTTP 1.1,标准协议，对后台应用透明,从最基本的负载均衡开始,确保高可用并提供扩展平台,LTM,提供应用级的负载均衡,选择最佳计算资源,应用级深度健康检查,在错误发生前的预测判断及响应,业务保障,高性能硬件平台,动态负载均衡,策略,Session,级会话保持,应用级健康检查,减少宕机时间并规模应用,连接优化,LTM,提高应用性能,连接和流量优化,减少用户端及广域网上的传输数据,Intelligent,Compression,Fast Cache,TCP Express,WebAccelerator,(add-on module),iSessions,为应用和数据提供安全保障,应用、协议和网络多层安全,法规遵从,(PCI, HPPIA, etc.),保证合法数据实时有效的强力防护,资源隐藏和内容安全,抵御网络攻击和协议攻击,Application Security Manager,(add-on module),可选加密,“,BIG-IP,帮助我们提高应用安全而无需投入更多时间和人员在新的安全功能研发上,”,Application Manger,Global 5000 Media and Entertainment Company,TechValidate 0C0-126-2FB,服务器卸载,LTM,为服务器分担负载,减少服务器访问量,集中卸载管理,SSL,One Connect,Fast Cache,SSL Offload,Compression,通过,BIGIP,，,50%,的,BIG-IP,用户节约了,20%,或者更多他们的总体投资,Source: TechValidate Survey of F5 BIG-IP Users,Server Array,Internet,SSL,HTTP,SSL,卸载 提高,Web,应用性能,BIG-IP SSL,从,WEB,服务器上卸载,SSL,加解密过程，明显提高,HTTP,访问速度,加速,SSL,部署,方便的在任何网络中部署,Key Length Guidance/Best Practices,Recommends transition to 2048-bit key lengths by Jan 1,st,2011,Special Publication 800-57 Part 1 Table 4,Microsoft uses and recommends 2048-bit keys,Per the NIST guidelines for all,servers,and other,products,Red Hat,recommends 2048+ length,for keys using RSA algorithm,Performance Impact,SSL Termination on Application Server,vs,BIG-IP,Key Length,32 Bit Commodity Hardware,64 Bit Commodity Hardware,6900,Series,8900,Series,11000,Series,VIPRION,(PBx4 100/200),1024,525 TPS,1,570 TPS,25,000 TPS,58,000 TPS,100,000 TPS,200,000 TPS,2048,96 TPS,273 TPS,5,000 TPS,11,600 TPS,20,000 TPS,40,000 TPS,4096,15 TPS,38 TPS,1,471 TPS,3,412 TPS,5,882 TPS,11,765 TPS,Additional Considerations:,2048-bit keys NOT good fit for Software-only or for virtualization,Any additional security/encryption requirements, such as FIPS, require additional hardware,Type of traffic impacts benefit of session reuse,灵活制定访问规则,完全应用控制,流量深度检查及转换,开放的,API,和,SDK,便于和第三方配合,iControl,iRules,64% of BIG-IP users said that they can respond more quickly,to changing business needs after deploying F5 BIG-IP.,Source: TechValidate Survey of F5 BIG-IP Users,根据地理位置的负载分发,BIG-IP Local Traffic Manager,构建您的应用交付网络信息系统,灵活扩展的应用交付架构,提高应用系统整体处理能力,为数据提供安全防护,根据应用系统灵活的定制交付平台,Users,Applications,BIG-IP,快速优化功能的各方面和效果,22,应用加速,IBR (Dynamic Content Control),连接复用,动态页面显示,动态压缩,SSL,加速,页面传送时间,Internet or WAN,服务器卸载,Http,压缩,动态代理,Content Spooling,连接优化,带宽管理,连接限制,网络优化,压缩,TCP,优化,Differential Compression,QoS,安全和认证,Client Browser,Web Server,页面传送时间,60%,75%,40%,70%,25%,35%,10%,10%,最佳选择,2,:,应用级容灾解决方案,“,About 40% of the Fortune 1,000 companies arent prepared for a regional disaster. And small and midsize businesses are even less ready.”,Simon Mingay, Disaster Recovery Analyst at Gartner,应用,&,存储,Enterprise Manager,TMOS,iControl,BIG-IP,WOM Module,BIG-IP,Edge,Gateway,BIG-IP Local,Traffic,Manager,BIG-IP Application,Security,Manager,BIG-IP Web,Accelerator,BIG-IP Link,Controller,ARX,File/Data Virtualization,FirePass,SSL VPN,Users,BIG-IP Global Traffic Manager,BIG-IP GTM,Reliable and Cost-Effective Application Delivery for the WAN,支持,DNSS,EC,根据数据中心内应用可用性灵活选择,可根据用户端地域定制访问规则,根据企业规则定制访问规则,多种广域网负载均衡算法选择,支持,FQDN,下的,SOA,服务汇总,L-DNS,Corporate Servers,Client,Router,Corporate Servers,Site 2 (Standby or Active/Active),BIG-IP GTM,Router,Corporate Servers,Site 1 (Primary),BIG-IP GTM,根据数据中心服务的可用性、性能及负载自动容灾。,支持应用级容灾数据中心，用户访问根据就进行原则或者物理地址记性选择。,为用户选择最佳体验数据中心,Router,L-DNS,BIG-IP GTM,BIG-IP LTM,Corporate Servers,Site 1 (Primary),Client,Router,BIG-IP LTM,Corporate Servers,Site 2 (Back up),BIG-IP GTM,最佳选择,3,:,多链路接入解决方案,“,Multi-home every location that requires mission-critical Internet connectivity, including externally hosted Web sites “,Gartner,“We learned about it from a sudden burst of sporadic customer calls. “We were given no warning.”,Tim Bradley, senior vice president of VoIP at New Global Telecom, a Level 3 master agent in Golden, Colo.,Enterprise Manager,TMOS,iControl,BIG-IP Global Traffic Manager,BIG-IP,WOM Module,BIG-IP,Edge,Gateway,BIG-IP Local,Traffic,Manager,BIG-IP Application,Security,Manager,BIG-IP Web,Accelerator,ARX,File/Data Virtualization,FirePass,SSL VPN,Users,BIG-IP Link,Controller,多链路接入解决方案,Internet,BIG-IP,Link Controller,Corporate Servers,Corporate Users,ISP1,ISP2,ISP3,Firewalls,Corporate Network,2,1,2,1,Client,Server,BIG-IP Link Controller,可以实现多链路接入处理，有效的解决了运营商之间的互联互通导致的用户访问速度慢、丢包等网络层问题。,客户端只需要访问统一的域名即可，,BIG-IP LC,会智能的引导客户端通过最佳的链路访问后台的应用系统，保证在正常情况下的最佳客户体验,当某一条链路出现故障的时候，,BIG-IP LC,会判断链路的故障，从而将所有的用户引导到仍然可以对外提供服务的链路上，保证业务的持续运行。,“,The distributed nature and high performance requirements of modern data protection schemes, combined with high WAN costs, lead to disappointing application performance, oversized bandwidth bills, or both.,In addition, enterprises who are concerned about data replication and disaster recovery, where high speed links are common, should consider a solution that can offer scale in terms of concurrent optimized connections and high throughput.”,Joe Skorupa,Gartner Analyst,最佳选择,4,:,广域网优化解决方案,Enterprise Manager,TMOS,iControl,BIG-IP Global Traffic Manager,BIG-IP,WOM Module,BIG-IP,Edge,Gateway,BIG-IP Local,Traffic,Manager,BIG-IP Application,Security,Manager,BIG-IP Web,Accelerator,BIG-IP Link,Controller,ARX,File/Data Virtualization,FirePass,SSL VPN,Users,广域网优化解决方案,Step 3,Symmetric,Adaptive,Compression,Step 4,SSL,Encryption,Step 5,TCP,Optimization,Step 2,Symmetric,Data,Deduplication,Raw,Data,Step 6,Bandwidth,Allocation,Optimized,Data,Step 1,Application,Protocol,Acceleration,Raw Data,Optimized,Data,WAN,Additionally with Full WOM,Free WAN Opt Service with LTM,BIG-IP + WOM,BIG-IP + WOM,iSessions,Data Replication Oracle Streams,WAN,Large & increasing volumes of data needs to be replicated,Distance between DCs (Latency),RPOs and RTOs decreasing,Problem,1hr 35mins to replicate 650 MB of Oracle Data base Transactions,Effective throughput 7 Mbps,Link: 45 Mbps,100 ms latency,1% packet loss,Secondary Data Center,Primary Data Center,Oracle 11g Database,Oracle 11g Database,Oracle Streams,Oracle Streams,Data Replication Oracle Streams,9 mins to replicate the same data,Effective throughput,72 Mbps,Secondary Data Center,Primary Data Center,Oracle 11g Database,Oracle 11g Database,Accelerate data transfer over WAN,Utilize bandwidth more effectively,Mitigate the effect of latency,Improve RTOs / RPOs,Solution,WAN,iSessions,iSessions,BIG-IP 3600 LTM,BIG-IP 3600 LTM,Oracle Streams,Oracle Streams,TCP Express,Symmetric Adaptive Compression,SSL Offload,TCP Express,Symmetric Adaptive Compression,SSL Offload,9x Faster,Large File Transfer VM Image,WAN,Distance between DCs (Latency),Large & increasing volumes of data needs to be replicated,Problem,13 hrs 19 mins,Effective throughput 1.7 Mbps,Link: 45 Mbps,100 ms latency,1% packet loss,Secondary Data Center,Primary Data Center,FTP,FTP,Server,10 GB VM Image,Server,Large File Transfer VM Image,Secondary Data Center,Primary Data Center,WAN,iSessions,iSessions,BIG-IP 3900 LTM + WOM,BIG-IP 3900 LTM + WOM,FTP,FTP,Server,Server,10 GB VM Image,12 mins,Effective throughput 116 Mbps,65x Faster,“,The traditional notion of putting network security at just the perimeter, the border between the Internet and the private network doesnt really hold up anymore. You can provide a certain level of security by putting firewalls and IDPs at the border point but it doesnt really help you understand whats going on behind the border and secure all those connections that could be coming in from inside the network. There needs to be something new added into the network to secure the interior of the network just as well as you secure the border between inside and outside.”,Jeff Wilson, Principal Analyst, VPNs and Security, Infonetics Research,最佳选择,5,:,远程安全接入解决方案,Enterprise Manager,TMOS,iControl,BIG-IP Global Traffic Manager,BIG-IP,WOM Module,BIG-IP Local,Traffic,Manager,BIG-IP Application,Security,Manager,BIG-IP Web,Accelerator,BIG-IP Link,Controller,ARX,File/Data Virtualization,FirePass,SSL VPN,Users,BIG-IP,Edge,Gateway,Mobile and Remote Users Growing Dramatically,1.2 Billion Mobile Workers WW by 2013,IDC Research 2010,BIG-IP Edge Gateway,整合了对称的,非对称的,和,client,端加速技术,BIG-IP V10.2:,安全，快速的接入,BIG-IP Edge,客户端提供随时随地的自动接入,Always Connected Application Access,Auto-Connect!,At Home,(wireless),On the way to work,(Aircard),In the office,(docked LAN connection),Presenting,(corporate wireless),In the Cafe,(wireless),统一快速远程安全接入,DMZ,Utilize existing user directories,Datacenter,Resouces,BIG-IP Edge Gateway,One solution to manage all access policies regardless of access network,Capacity and performance to secure all user traffic,Optimizes application delivery to remote and mobile users,Improves quality of real-time applications; soft phones and streaming media,Mobile Users,Wireless Users,Internet,Branch Office Users,Internal LAN,VLAN2,WAN Opt.,Web Accl.,Access,LAN Users,Internal LAN,VLAN1,BIG-IP Edge Gateway,整体安全接入解决方案,Remote User,Primary,Datacenter,U.S. West Coast,Remote Office,Europe,BIG-IP Edge Gateway,BIG-IP GTM,BIG-IP Edge Gateway,BIG-IP LTM,Backup,Datacenter,U.S. Midwest,BIG-IP GTM,BIG-IP Edge Gateway,BIG-IP LTM,Remote User,Remote Office,Japan,BIG-IP Edge Gateway,Direct users to the Most optimal Edge Gateway,Remote user and office access to applications is SECURE and ACCELERATED,Remote User,BIG-IP benefits:,Reduce costs and complexity,Gain superior scalability and high availability,Better security with access control,Save up to 10x on capex and opex,Layer with app. security,Proxy,Web Servers,App 1,App 2,App 3,App n,BIG-IP Access Policy Manager,Policy Manager,Directory,WEB,应用的快速接入,:,提高认证部署性能,1,1,Code in the Application,Costly, difficult to change,Not repeatable, less secure,Agents on servers,Difficult to manage,Not interoperable or secure,Decentralized and costly,2,2,3,Specialized Access Proxies,Doesnt scale and basic reliability,More boxes and expensive,3,AAA,=,A,uthentication,A,uthorization, and,A,ccounting,AAA,AAA,AAA,AAA,Access Policy Design,Industry-leading advanced Visual Policy Editor (VPE),Flexible,Easy to understand, visual representation of policy,VPE Rules (TCL-based) for advanced functions,Trigger TMM iRules events,Usability features,Macros,Visual cues to aid configuration,BIG-IP Edge Gateway: SharePoint,统一接入,Competitor SSL VPN,= 211s= 47s,BIG-IP Edge Gateway = 114s= 16s,Twice as Fast User Downloads,Test includes a user logging onto VPN, navigating,through SharePoint content, and downloading a 4 MB document,First Time,Repeat,最佳选择,6:,WEB,应用加速解决方案,“,Twenty-eight percent of shoppers who have suffered failed performance attempts said they stopped shopping at the website where they had problems, and six percent said they stopped buying at that particular companys off-line store.”,Boston Consulting Group, InforWorld/ComputerWorld,”Perhaps as much as $4.35 billion in e-commerce sales in the U.S. may be lost each year due to unacceptable download speeds and resulting user bailout behaviors.”,Zona Research,Enterprise Manager,TMOS,iControl,BIG-IP Global Traffic Manager,BIG-IP,WOM Module,BIG-IP,Local,Traffic,Manager,BIG-IP Application,Security,Manager,BIG-IP Web,Accelerator,BIG-IP Link,Controller,ARX,File/Data Virtualization,FirePass,SSL VPN,Users,BIG-IP,Edge,Gateway,BIG-IP WebAccelerator,WEB,应用加速解决方案,Primary Data Center,Web Servers,BIG-IP LTM,+ WebAccelerator,Solution,让传输数据更加简化和有效,WEB,应用加速及优化,减少带宽占用,卸载服务器处理负载,减少网络延迟影响,Real-time,Monitors,Pre-defined,Acceleration,Policies,信息化建设的发展,基础网络搭建完成,核心业务应用也基本建设完成,接下来我们能做的还有哪些？,互联网环境下,-,加速用户体验,-,降低交易风险,Internet,延迟，带宽，丢包，,如何把应用页面递交的更快,互联网协议的问题,TCP/IP,协议的缺陷与协议的发展。,通用操作系统下，能修改,TCP/IP,的底层参数吗？,F5 TCP,优化特性,TCP profiles have the following optimizations available:,time wait recycle,delayed acks,proxy mss,Maximum Segment Size,proxy options,deferred accept,selective acks,Ecn,Explicit Congestion Notification,显式拥塞通告 路由器通知发送端降低发送速率避免丢包，缓解拥塞,limited transmit RFC3042,Enhancing TCPs Loss Recovery Using Limited Transmit,(,使用限制传输，增强,TCP,的丢失修复能力,),rfc1323,TCP,Extensions for High Performance,slow start,bandwidth delay,Nagle,小包优化,proxy buffer,最新平台的,F5,为了满足不断变化的应用。提供了大量的,TCP/IP,优化特性。可以让你更细微地调整协议底层的参数。,主流浏览器在单个主机下的并发连接数：,IE6,2,IE7,2,IE8,6,Fire