config load-balance : config load-balance virtual-server
 
config load-balance virtual-server
Use this command to configure virtual servers.
The virtual server configuration supports three classes of application delivery control:
• Layer 7—Persistence, load balancing, and routing are based on Layer 7 objects, such as HTTP headers, cookies, and so on.
• Layer 4—Persistence, load balancing, and network address translation are based on Layer 4 objects, such as source and destination IP address.
• Layer 2—This feature is useful when the request’s destination IP is unknown and you need to load balance connections between multiple next-hop gateways.
Before you begin:
• You must have a deep understanding of the backend servers and your load balancing objectives.
• You must have configured a real server pool (required) and other configuration objects that you can incorporate into the virtual server configuration, such as persistence rules, user-defined profiles, source IP address pools if you are deploying full NAT, content routes and rewriting rules, and error messages.
• You must have read-write permission for load balancing settings.
 
Unlike virtual IPs on FortiGate or virtual servers on FortiWeb, virtual servers on FortiADC are activated as soon as you configure them and set status to enable. You do not apply them by selecting them in a policy.
Syntax
config load-balance virtual-server
edit <name>
set addr-type {ipv4|ipv6}
set alone {enable|disable}
set connection-limit <integer>
set connection-pool <datasource>
set connection-rate-limit <integer>
set content-rewriting {enable|disable}
set content-rewriting-list <string>
set content-routing {enable|disable}
set content-routing-list <string>
set error-msg <string>
set error-page <datasource>
set id <integer>
set interface <datasource>
set ip <class_ip>
set port <integer>
set ippool <datasource>
set load-balance-method <datasource>
set load-balance-persistence <datasource>
set load-balance-pool <datasource>
set load-balance-profile <datasource>
set multi-process <integer>
set packet-forwarding-method {FullNAT|NAT|direct_routing}
set status {enable|disable|maintain}
set traffic-log {enable|disable}
set trans-rate-limit <integer>
set type {l2-load-balance | l4-load-balance | l7-load-balance}
set warm-rate <integer>
set warm-up <integer>
next
end
 
type
Specify the virtual server type:
• l7-load-balance: Persistence, load balancing, and routing are based on Layer 7 objects, such as HTTP headers, cookies, and so on.
• l4-load-balance:Persistence, load balancing, and network address translation are based on Layer 4 objects, such as source and destination IP address.
• l2-load-balance:This feature is useful when the request’s destination IP is unknown and you need to load balance connections between multiple next-hop gateways.
After you have specified the type, the CLI commands are constrained to the ones that are applicable to the specified type, not all of the settings described in this table.
addr-type
• IPv4
• IPv6
Note: IPv6 is not supported for FTP or HTTP Turbo profiles.
alone
Enable/disable alone mode. When enabled, each HTTP virtual server is handled by a separate haproxy daemon. When disabled, all HTTP virtual servers are handled by one haproxy daemon.
connection-limit
Limit the number of concurrent connections. The default is 0 (disabled). The valid range is 1 to 1,048,576 concurrent connections.
You can apply a connection limit per real server and per virtual server. Both limits are enforced. Attempted connections that are dropped by security rules are not counted.
Note: Connection Limit is not supported for FTP profiles.
connection-pool
Specify a connection pool configuration object.
connection-rate-limit
With all Layer 4 profiles, and with the Layer 2 TCP profile, you can limit the number of new connections per second. The default is 0 (disabled). The valid range is 1 to 86,400 connections per second.
You can apply a connection rate limit per real server and per virtual server. Both limits are enforced. Attempted connections that are dropped by security rules are not counted.
Note: Connection Rate Limit is not supported for FTP profiles.
content-rewriting
Enable to rewrite HTTP headers.
content-rewriting-list
Specify content rewriting rules.
Note: You can select multiple content rewriting rules in the virtual server configuration. Rules that you add are consulted from top to bottom. The first rule to match is applied. If the traffic does not match any of the content rewriting rule conditions, the header is not rewritten.
content-routing
Enable to route packets to backend servers based on IP address (Layer 4) or HTTP headers (Layer 7 content).
Overrides static or policy routes.
content-routing-list
Specify content route configuration objects.
Note: You can specify multiple content routing rules in the virtual server configuration. Rules that you add are consulted from top to bottom. The first rule to match is applied. If the traffic does not match any of the content routing rule conditions specified in the virtual server configuration, the system behaves unexpectedly. Therefore, it is important that you create a “catch all” rule that has no match conditions. In the virtual server configuration, this rule should be ordered last so it can be used to forward traffic to a default pool.
error-msg
Specify an error page configuration object.
error-page
If you do not use an error page, you can enter an error message to be returned to clients in the event no server is available.
id
Deprecated.
interface
Network interface that receives client traffic for this virtual server.
ip
IP address provisioned for the virtual server.
Note: You do not specify an IP address for a Layer 2 virtual server. A Layer 2 virtual server is not aware of IP addresses. Instead of routing data for a specific destination, this type of server simply forwards data from the specified network interface and port.
port
Port number to listen for client requests.
Note: If a Layer 2 virtual server is assigned a network interface that uses port 80 or 443, ensure that the HTTPS and HTTP administrative access options are not enabled for the interface.
ippool
If you are configuring a Layer 4 virtual server and enable Full NAT, select a source pool configuration object.
load-balance-method
Specify a predefined or user-defined method configuration object.
load-balance-persistence
Specify a predefined or user-defined persistence configuration object.
load-balance-pool
Specify a server pool configuration object.
load-balance-profile
Specify a predefined or user-defined profile configuration object.
multi-process
If your system has a multicore CPU, you can assign the number of CPU cores to handle traffic for an HTTP virtual server. The valid range is 1 to 15.
packet-forwarding-method
In Layer 4 virtual server deployments, select one of the following packet forwarding methods:
• Direct Routing — Forwards the source and destination IP addresses with no changes.
Note: For FTP profiles, when Direct Routing is selected, you must also configure a persistence method.
• DNAT — Replaces the destination IP address with the IP address of the backend server selected by the load balancer.
The destination IP address of the initial request is the IP address of the virtual server. Be sure to configure FortiADC as the default gateway on the backend server so that the reply goes through FortiADC and can also be translated.
• Full NAT —Replaces both the destination and source IP addresses.
The source IP address is replaced by an IP address from the pool you define using Server Load Balance > Resources > Source Pool. The destination IP address is replaced with the IP address of the backend server selected by the load balancer.
status
• enable—The server can receive new sessions.
• disable—The server does not receive new sessions and closes any current sessions as soon as possible.
• maintain—The server does not receive new sessions but maintains any current connections.
traffic-log
Enable to record traffic logs for this virtual server.
Note: Local logging is constrained by available disk space. We recommend that if you enable traffic logs, you monitor your disk space closely. We also recommend that you use local logging during evaluation and verification of your initial deployment, and then configure remote logging to send logs to a log management repository.
trans-rate-limit
Limit the number of HTTP requests per second. The default is 0 (disabled). The valid range is 1 to 1,048,567 transactions per second.
The system counts each client HTTP request against the limit. When the HTTP request rate exceeds the limit, the virtual server sends an HTTP 503 error response to the client.
Note: Transaction Rate Limit is not supported for HTTP Turbo profiles.
warm-rate
Maximum connection rate while the virtual server is starting up. The default is 10 connections per second. The valid range is 1 to 86,400 connections per second.
If Warm Up is 5 and Warm Rate is 2, the number of allowed new connections increases at the following rate:
• 1st second—Total of 2 new connections allowed (0+2).
• 2nd second—2 new connections added for a total of 4 new connections allowed (2+2).
• 3rd second—2 new connections added for a total of 6 new connections allowed (4+2).
• 4th second—2 new connections added for a total of 8 new connections allowed (6+2).
• 5th second—2 new connections added for a total of 10 new connections allowed (8+2).
warm-up
If the server cannot initially handle full connection load when it begins to respond to health checks (for example, if it begins to respond when startup is not fully complete), indicate how long to forward traffic at a lesser rate. The default is 0 (disabled). The valid range is 1 to 86,400 seconds.
Example
FortiADC-VM # config load-balance virtual-server
FortiADC-VM (virtual-server) # edit lb-vs1
Add new entry 'lb-vs1' for node 1775
 
FortiADC-VM (lb-vs1) # get
status : enable
type : l4-load-balance
multi-process : 1
packet-forwarding-method: NAT
interface :
addr-type : ipv4
ip : 0.0.0.0
port : 80
connection-limit : 10000
load-balance-profile:
content-routing : disable
load-balance-persistence:
load-balance-method :
load-balance-pool :
traffic-log : disable
warm-up : 0
warm-rate : 10
connection-rate-limit: 0
id : 0
 
FortiADC-VM (lb-vs1) # set ip 192.168.200.1
FortiADC-VM (lb-vs1) # set interface port4
FortiADC-VM (lb-vs1) # set load-balance-profile LB_PROF_TCP
FortiADC-VM (lb-vs1) # set load-balance-method LB_METHOD_ROUND_ROBIN
FortiADC-VM (lb-vs1) # set load-balance-pool lb-pool
FortiADC-VM (lb-vs1) # end
 
FortiADC-VM # get load-balance virtual-server lb-vs1
status : enable
type : l4-load-balance
multi-process : 1
packet-forwarding-method: NAT
interface : port4
addr-type : ipv4
ip : 192.168.200.1
port : 80
connection-limit : 10000
load-balance-profile: LB_PROF_TCP
content-routing : disable
load-balance-persistence:
load-balance-method : LB_METHOD_ROUND_ROBIN
load-balance-pool : lb-pool
traffic-log : disable
warm-up : 0
warm-rate : 10
connection-rate-limit: 0
id : 1