CSS 11051 Stateful Failover
We have received a note concerning stateful failover of the CSS series of products, where the CSS 110XX series doesn't support stateful failover, however the CSS 115XXX will. Here is the digest of the message;
On 3/6, Hosting Engineering and Operations issued an alert regarding the
CSS 11000 load balancer. This is an update to that alert.
Since that time, we have experienced another hardware failure of this
model device.
In response to this situation, the following has occured:
* Platform Engineeringis in the process of removing the CSS 11000
from the SOE. Itis on target to be removed in April.
* Operations hasre-inforced our escalation procedures with CISCO.
Qwest is to beissued a RMA immediately for this model.
* For newconfigurations including a CSS 11000, CCAR will require
an Individual CaseBasis (ICB) review and approval.
* For existing premiumand above customers whoes configurations
include a CSS 11000, HostingOperations is planning to replace them with
compatible device. These changes have been pre-approved by CCAR as long
as:
* the networktopology remains the same
* redundancy ispreserved
* CCAR gets notifiedof the replacement model so we can update our
records
* For existing basicand enhanced customers, we are drafting a
communique that alerts them tothe performance issues exerienced by Qwest
and providing suggestedalternative solutions.
In response to recent questions from the field.....
Stateful failover with redundant CSS 11000 Series Load Balancers:
The Bottom Line: Cisco CSS 11000 Series Load Balancers do not support
stateful
failover.
Will Cisco ever support this?: Yes, this is supported in the CSS 11500
Series,
known as Adaptive Session Redundancy (ASR)
I need this today, what can I do?: Choose an alternative product. The
F5 BIG-IP
load balancers support this functionality.
What is stateful failover anyhow?
Stateful failover is a technology that can maintain state information
between
the active load-balancer and the standby load-balancer. This state
information
can include: persistence mapping, telnet sessions, ftp sessions, tcp
session
state, etc...
Why should I be concerned?
Without state synchronization applications can break if there is a
failover from
the active to standby unit. FTP Sessions will be broken, Telnet
sessions will
be broken, and most importantly persistence state mapping will be lost.
What do I need to listen for to determine if stateful failover is
important?
1. E-commerce applications that require persistence mapping.
Persistence
mapping will keep a client session mapped to the same server for a
specified
amount of time. This is often important with shopping cart and other
e-commerce
applications.
2. Long-lived sessions. Whether they are planning to transfer large
files via
FTP or long-lived telnet sessions. Anytime a connection will be
required for a
long time and starting over is not an acceptable condition, then
stateful
failover is important.
Does this sound correct or is this a bunch of hot air?
Yes. Stateful failover, or ASR as it is sometimes called, is available on the CSS 11500 and Catalyst 6500 Content Switch Modules (CSM) load balancing platforms. It is not supported on the CSS 11000 due to architectural limitations of that platform.
Stateful failover is available on these Cisco platforms today.
mikep
Similar Messages
-
CSS active-active stateful failover
Dear All,
May I confirm if CSS can do active-active stateful failover? If so, is it any restriction? and any Cisco URL I can refer to?
Thanks a lot.
makwhat do you call active-active ?
There different ways to achieve active-active.
What we can do is 1 vip active on 1 CSS-A and standby on CSS-B and a 2nd VIP active on CSS-B and standby on CSS-A.
But do you really need this ?
CSS can handle quite a huge amount of traffic so I never saw the need for active-active.
The failover can be statefull with CSS115xx not with CSS110xx or CSS118xx or CSS111xx.
Here is a sample config for one-armed mode but you can also have multiple vlans.
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_example09186a00802206a3.shtml
Regards,
Gilles -
How long I have to wail the Stateful Failover on CSS 11154 ?
Somebody knows when the next Webns release is expected to implent the TCP Stateful Failover on CSS with VIP redundancy configuration.
At the begining of the year, the Product manager said that will be available on the WebNs V6.
For information: Alteon WEBOS v8 has released this feature for more one year ago.
What do cisco ?Is Adaptive Session Redundancy what you are looking for?
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_510/advcfggd/vipredun.htm#xtocid24 -
CSS 11500 Layer4/5 stateful failover
Is this supported on 5.1? Does this actually work? Anyone tried it?
Is the enhanced feature set required to be able to implement this kind of failover?
Regards,
carlos.Carlos,
L5 only stateful failover is supported in 5.10.
I have personally not seen any cases come in the TAC for this yet. I have not tried it out.
Pete, TAC -
Slow stateful failover for mission critical applications
I have two CSS running vip redundancy,ip interface redundancy and redundant-index on a ASR active-backup model.
They are attached to separate 3750 which share vlan info via a port channel.
When the master fails, we see the VRIR negotiation and mastership of VIPs occurs normally but the script that we run to validate our services fails and the services go to a down state.
Since the gateway for the reals is a redundant VIP that stays alive always based on a DUMMY service, we believe this could be a mac address table update on the 3750.
Traffic back from the reals is still sent to the "old" port where the gateway used to live.
Failover takes several minutes and TCP sessions timeout defeting stateful failover.
Any ideas???
Thanks
MANUELVLAN1 STP State: Disabled
VLAN1: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-78
Bridge ID: 06-a4-00-11-93-90-61-78
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
VLAN11 STP State: Disabled
VLAN11: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-79
Bridge ID: 06-a4-00-11-93-90-61-79
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
e1 Fwd 06-a4-00-11-93-90-61-79 06-a4-00-11-93-90-61-79 0 19 8001
VLAN211 STP State: Disabled
VLAN211: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-7a
Bridge ID: 06-a4-00-11-93-90-61-7a
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
VLAN222 STP State: Disabled
VLAN222: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-7b
Bridge ID: 06-a4-00-11-93-90-61-7b
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
e3 Fwd 06-a4-00-11-93-90-61-7b 06-a4-00-11-93-90-61-7b 0 19 8003 -
Problem with redundancy in CSS 11051
I have a problem with redundancy in CSS 11051. I use firewall load balancing and server load balancing. Load balancers which only load balance over 3 firewall switch from primary to master with no problems.
problem is with load balancers which load balance over firewalls and over servers two. whene the master is shutdown, backup keeps master function, all services on backup LB are alive, but it is not possible to display web page on address 10.10.7.16. Even if I try from the network 10.10.7.0/24, so before firewalls. below my config. any help appreciate.
===primary LB=====
!Generated on 10/30/2002 10:42:53
!Active version: ap0500002
configure
!*************************** GLOBAL ***************************
ip redundancy master
no console authentication
restrict ftp
app
app session 10.10.60.13
ip firewall 1 10.10.7.1 10.10.8.1 10.10.8.10
ip firewall 2 10.10.7.2 10.10.8.2 10.10.8.10
ip firewall 3 10.10.7.3 10.10.8.3 10.10.8.10
ip route 0.0.0.0 0.0.0.0 firewall 1 1
ip route 0.0.0.0 0.0.0.0 firewall 2 1
ip route 0.0.0.0 0.0.0.0 firewall 3 1
ip route 10.10.1.0 255.255.255.0 10.10.3.1 1
ip route 10.10.2.0 255.255.255.0 10.10.3.1 1
ip route 10.10.12.0 255.255.255.0 10.10.3.1 1
ip route 10.10.14.0 255.255.255.0 10.10.3.1 1
ip route 10.10.22.0 255.255.255.0 10.10.3.1 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
bridge vlan 62
interface e2
phy 100Mbits-FD
bridge vlan 7
interface e3
bridge vlan 3
interface e4
phy 100Mbits-FD
bridge vlan 7
interface e5
phy 100Mbits-FD
interface e6
phy 100Mbits-FD
bridge vlan 6
interface e7
phy 100Mbits-FD
interface e8
phy 100Mbits-FD
bridge vlan 6
!************************** CIRCUIT **************************
circuit VLAN62
ip address 10.10.60.14 255.255.255.252
redundancy-protocol
circuit VLAN7
redundancy
ip address 10.10.7.10 255.255.255.0
circuit VLAN3
redundancy
ip address 10.10.3.10 255.255.255.0
no redirects
circuit VLAN6
redundancy
ip address 10.10.6.10 255.255.255.0
!************************** SERVICE **************************
service cc1
ip address 10.10.3.129
keepalive type tcp
keepalive port 443
service cc2
ip address 10.10.3.130
keepalive type tcp
keepalive port 443
active
service ssl1
ip address 10.10.6.131
keepalive port 443
keepalive type tcp
active
service ssl3
ip address 10.10.6.133
keepalive port 443
keepalive type tcp
active
service ssl4
ip address 10.10.6.141
keepalive type tcp
keepalive port 443
active
service ssl6
ip address 10.10.6.143
keepalive port 443
keepalive type tcp
active
service www1
ip address 10.10.6.101
keepalive type tcp
keepalive port 443
weight 2
active
service www3
ip address 10.10.6.103
keepalive type tcp
keepalive port 443
active
service www4
ip address 10.10.6.121
keepalive port 443
keepalive type tcp
active
service www6
ip address 10.10.6.123
keepalive type tcp
keepalive port 443
active
!*************************** OWNER ***************************
owner L5_Owner
content L5_Rule
vip address 10.10.7.6
application ssl
protocol tcp
port 443
url "/*"
add service www1
add service www3
add service www4
advanced-balance sticky-srcip
add service www6
balance weightedrr
active
content L5_Rule_CC
vip address 10.10.3.120
advanced-balance sticky-srcip
add service cc1
add service cc2
active
content L5_Rule_SSL
vip address 10.10.7.16
application ssl
protocol tcp
port 443
url "/*"
add service ssl1
add service ssl3
add service ssl4
advanced-balance sticky-srcip
add service ssl6
active
!*************************** GROUP ***************************
group CC
vip address 10.10.3.120
add destination service cc1
add destination service cc2
active
======
===backup LB=====
!Generated on 10/29/2002 20:47:30
!Active version: ap0503015
configure
!*************************** GLOBAL ***************************
ip redundancy
console authentication primary none
restrict ftp
app
app session 10.10.60.14
ip firewall 1 10.10.7.1 10.10.8.1 10.10.8.10
ip firewall 2 10.10.7.2 10.10.8.2 10.10.8.10
ip firewall 3 10.10.7.3 10.10.8.3 10.10.8.10
ip route 0.0.0.0 0.0.0.0 firewall 1 1
ip route 0.0.0.0 0.0.0.0 firewall 2 1
ip route 0.0.0.0 0.0.0.0 firewall 3 1
ip route 10.10.1.0 255.255.255.0 10.10.3.1 1
ip route 10.10.2.0 255.255.255.0 10.10.3.1 1
ip route 10.10.12.0 255.255.255.0 10.10.3.1 1
ip route 10.10.14.0 255.255.255.0 10.10.3.1 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
bridge vlan 62
interface e2
phy 100Mbits-FD
bridge vlan 7
interface e3
phy 100Mbits-FD
bridge vlan 3
interface e4
phy 100Mbits-FD
bridge vlan 7
interface e5
phy 100Mbits-FD
interface e6
phy 100Mbits-FD
bridge vlan 6
interface e7
phy 100Mbits-FD
interface e8
phy 100Mbits-FD
bridge vlan 6
!************************** CIRCUIT **************************
circuit VLAN62
ip address 10.10.60.13 255.255.255.252
redundancy-protocol
circuit VLAN7
redundancy
ip address 10.10.7.10 255.255.255.0
circuit VLAN3
redundancy
ip address 10.10.3.10 255.255.255.0
no redirects
circuit VLAN6
redundancy
ip address 10.10.6.10 255.255.255.0
!************************** SERVICE **************************
service cc1
ip address 10.10.3.129
active
service cc2
ip address 10.10.3.130
active
service ssl1
ip address 10.10.6.131
keepalive port 443
keepalive type tcp
active
service ssl3
ip address 10.10.6.133
keepalive port 443
keepalive type tcp
active
service ssl4
ip address 10.10.6.141
keepalive type tcp
keepalive port 443
active
service ssl6
ip address 10.10.6.143
keepalive port 443
keepalive type tcp
active
service www1
ip address 10.10.6.101
keepalive type tcp
keepalive port 443
weight 2
active
service www3
ip address 10.10.6.103
keepalive type tcp
keepalive port 443
active
service www4
ip address 10.10.6.121
keepalive port 443
keepalive type tcp
active
service www6
ip address 10.10.6.123
keepalive type tcp
keepalive port 443
active
!*************************** OWNER ***************************
owner L5_Owner
content L5_Rule
vip address 10.10.7.6
protocol tcp
port 443
url "/*"
add service www1
add service www3
add service www4
advanced-balance sticky-srcip
add service www6
balance weightedrr
active
content L5_Rule_CC
vip address 10.10.3.120
advanced-balance sticky-srcip
add service cc1
add service cc2
active
content L5_Rule_SSL
vip address 10.10.7.16
protocol tcp
port 443
url "/*"
add service ssl1
add service ssl3
add service ssl4
advanced-balance sticky-srcip
add service ssl6
active
!*************************** GROUP ***************************
group CC
vip address 10.10.3.120
add destination service cc1
add destination service cc2
active
=======Please visit the folloiwing page where you can find many configuration examples on configuring CSS for Load Balancing.
http://www.cisco.com/en/US/products/hw/contnetw/ps789/prod_configuration_examples_list.html
Hope it helps. -
PO for LAN failover and stateful failover link?
Hi.. We have 2 x ASA 5520s running ver 9.0. We plan to aggregate the 2 interfaces used for LAN failover and stateful failover into a lacp PO. So both the ASAs are connected to each other directly using these 2 interfaces and then we logically make it a one PO. We then assign the PO intface an ip. Is this supported?
You can use any unused interface (physical, redundant, or EtherChannel) as the failover link. (Source)
That said, It would be an uncommon implementation. I almost always see them on separate physical interfaces. -
DMVPN and IPSec Stateful Failover?
Will IPSec Stateful Failover work with a DMVPN hub? If I have two 3845 with the proper AIMs, will this work?
Yes it is supported. It is supprted on VAM, VMA2, VAM2+.
-
Hi,
I'd like to know if it's possible to do port mirroring on a CSS 11051 or if there is a command (a sort of tcpdump) that allows you to analyse traffic?
Best regards,
Olivier GOURANTON.this feature does not exist on this platform.
You can try the command 'flow options ?' to turn on some packet debugging, but only process-switched traffic will be displayed.
For fast-switched traffic you won't see anything.
Regards,
Gilles. -
Hi,
Is GSS cabaple of doing stateful failover. Lets say if i have 2 ACE VIPs configured in GSS in Active-Standby mode. What will happen of existing connections in Active if it goes down?Good morning,
The GSS is a DNS server, so it makes no sense to talk about connections on it.
In the setup you described, if the primary ACE VIP fails, the GSS will stop returning that VIP in the DNS replies and use the secondary instead.
What will happen to the connections on the ACE will depend on what made the VIP go down (and then we would be getting into the ACE topic), if for example the server went down, then, I'm afraid all connections will break. If however, just connectivity between the ACE and the GSS was lost, then, the connections will continue to work normally.
Regards
Daniel -
Adding stateful failover to running configuration
Hi,
I have failover pair of ASA boxes without configuration of stateful failover. There is only basic LAN failover.
I want to add stateful failover configuration using dedicated interface of ASA. Is this with downtime zero when I will add command for stateful failover?
Thanks
PeterAs far as I know it won't affect traffic flow and there's not gonna be any downtime.
-
Ipsec Stateful Failover issue with Dynamic-Map
Hi all, I have an issue with a couple of Cisco ISR 2921 in Ha Ipsec Stateful Failover configuration.
With static crypto-map, stateful works good, Ipsec sessions are correctly trasmitted from Cisco Active router to Cisco Standby router.
With dynamic-map and profile, stateful fails, Ipsec sessions are not correctly trasmitted from Cisco Active router to Cisco Standby router.
I tried different IOS version:152-1.T3, 152-3.T2 and 153-1.T but I have the same behavior.
Could you help me?
MarcoYes it is supported. It is supprted on VAM, VMA2, VAM2+.
-
CBAC Stateful Failover HA: ¿can it be used for three segments?
Hello team.
I need to protect three segments (inside, outside, DMZ) with two routers running CBAC and Stateful Failover High Availability.
I would like to know if the concept shown with two sample segments (inside, outside) in the documentation (http://www.cisco.com/en/US/prod/collateral/routers/ps5855/white_paper_c11_472858.html) can be extended for routers with three interfaces, each one attached to the segments I need to protect.
If this is a supported scenario, I would appreciate your pointing me to a sample configuration.
Thank you very much in advance.
Rogelio Alvez
ArgentinaRogelio,
Basicamente seria HSRP groups asi como el ASA usa el stateful link, el Router establece una asociacion con un IPC group que se configure por HSRP group:
Mira el siguiente link:
Step 6
ipc zone default
Example:
Router(config)# ipc zone default
Configures the interdevice communication protocol, Inter-Process Communication (IPC), and enters IPC zone configuration mode
Use this command to initiate the communication link between the active router and standby routers.
http://www.cisco.com/en/US/prod/collateral/routers/ps5855/white_paper_c11_472858.html
Si tienes alguna duda con mucho gusto.
Mike -
CSS 11051: Sorry Server receives request although the normal server is up
Hello,
my customer has configured a sorry for his server. If the normal server is down the Sorry Server receives the requests. That works fine. But if the normal server comes back the Sorry Server still receives some requests( 2 hours and more). Has anybody an idea what might be the reason for that ?
regards
Dietrich Schleyer
content webserver
add service server12
vip address 10.40.52.20
primarySorryServer server13
protocol tcp
port 80
url "/*"
no persistent
active
service server12
ip address 10.40.52.12
port 80
protocol tcp
keepalive type named applicationwww01
active
service server13
ip address 10.40.52.13
protocol tcp
port 80
keepalive type named applicationwww02
active
keepalive applicationwww01
ip address 10.40.52.12
port 80
type http non-persistent
uri "/test.html"
frequency 10
method get
active
keepalive applicationwww02
ip address 10.40.52.13
port 80
uri "/test.html"
frequency 10
method get
type http non-persistent
activeAccording to: http://www.cisco.com/warp/public/117/css_sorry_server.html After the CSS 11000 directs requests to a primary sorry server, the switch will continue to use the primary sorry server even when the original server becomes functional. To force the connection back to the original server, you must suspend the primary sorry server or wait until the connection is dropped or times out. When a new session is initiated by the CSS 11000, the connection should go back to the original server.
-
IPSEC Stateful Failover using two 4507RE switches
Hello
I have been trying to find the configuration guides for a cat4500e-universalk9.SPA.03.04.00.SG.151-2.SG, with entservices license.
We have an immediate requirement to build a HA IPSEC VPN from two 4507RE switches, while we wait for new ASA's to be provisioned. I don't think we can do it, in HA setup.
Advice is very welcome.
Thanks
NickNick,
IPsec is not supported at all on cat4500 platform.
We're working on removing IKE/IPsec commands from new parser in IOS XE:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCuh60386
M.
(Editted typos)
nicholas boran wrote: HelloI have been trying to find the configuration guides for a cat4500e-universalk9.SPA.03.04.00.SG.151-2.SG, with entservices license.We have an immediate requirement to build a HA IPSEC VPN from two 4507RE switches, while we wait for new ASA's to be provisioned. I don't think we can do it, in HA setup.Advice is very welcome.ThanksNick
Maybe you are looking for
-
Print html content of an JEditorPane
Hello! I have an JEditorPane with some HTML Content displayed (as it is displayed in a browser). Now i want to sent this content to a printer. After some search i found the DocumentRenderer class from this link: http://www.fawcette.com/javapro/2002_1
-
My ipod touch 4th generation won't charge all of a sudden and I'm not sure what to do?
When I get home from school I instantly put my ipod on it's charger because I use it a lot during the day. i always put in on an ipod dock and play my music while it charges and use my computer until it's completely done charging. So, today I did tha
-
Bridge CS5.1 – Disappearing File Names (Now You Don't See It All)
Bridge CS5.1. Lion 10.7.2. 27" iMac native display at native resolution. For some reason, in Lion (but not Snow Leopard) Bridge cuts-off the bottom line of long file names (see the screenshot). Irritating. Difficult if I'm trying to distinguish betwe
-
Characters not showing up in Captivate 6
Greetings, I'm relatively new to Captivate but not the Adobe Creative Suite and am working on a project. I was elated to hear that Characters are automatically included (a few at least) and you don't have to purchase them separately. However, upon at
-
TOC style template for epubs - where is it stored?
Hello, some years ago I saved 3 different toc styles for my epubs. Now I added some more (for 2 levels etc.). This new ones also I saved. But when I start to build the epub in the first option windows at the point TOC style navigation there are still