Stateful VIP redundancy
Is it possible to do stateful VIP redundancy on 1105x devices? (Storing sticky db on redundant CSS)
I have two of them and going to configure VIP for server load balancing. Single CSS is working well but i have two of them and i dont want to see disconnected sessions when primary goes down. Does anybody recommends any solution like this?
I have gotten a pseudo statefull failover to work, no sticky information is used. It is not acturally statefull in that the other box does not have any state information but is able to take over the TCP connection without the end points being affected. I don't have the config handy right now. If you need it I can dig it up and send it to you.
One of the keys is to set the persistence command to its default value (persistence reset redirect) also the load balancing must be by source IP address. This ensures that both boxes will select the same server - assuming that the configs and service states are identical.
The manual can help but I found that it called for more statements than were necessary and that it did not note the persistence requirement. I found that the command disables the PAT on the connections so that if the source port is 3546 coming into the CSS it will keep it as 3546 going to the service. If the port is translated then the backup switch will not know the translation and send it to the wrong socket on the client, resulting in an error.
It worked great but the downside is the global persistence command is inefficient and affects all sessions and that you have to use source IP load balancing for the rule you are protecting. I did not implement this in production.
Similar Messages
-
CSS11501 commit vip redundancy script failure
Hi all,
recently when i run the commit vip redundancy script, i encountered the following error. This script has never failed in the past. Upon checking the backup CSS, i did notice that my most recent changes were actually synced. The following is the debug i have captured while running the script. Can someone please help to look at it? Thanks!
active-lb# script play commit_vip_redundancy "local 167.168.165.10 remote 167.168.165.9 -a -d"
active-lb#
Checking available disk space on systems ...
Checking the disk space locally before continuing with the script.
Verifying that another local session is not running the script.
Creating script/vipr_config_sync_lock file.
Verifying app and redundancy configs ...
Verifying that app session is up with backup switch.
Making sure app session is up.
Seconds to wait before calling it quits: 60
Checking the disk space remotely before continuing with the script.
Checking local and remote switch versions ...
Storing the running code versions of the local and remote switch.
Storing the local switch's version.
Retrieving the remote switch's version.
Checking remote version for 4.0
Checking if switch is BACKUP for any virtual routers and if
the state is 'No Service'.
Checking vip redundancy state....
Checking if backup switch is Master for any VRIDs.
If it is, either a local interface that once held redundant vips
has been removed or the Backup is a Master for another vip-redundant
relationship.
Checking compatibility of systems......
LOCAL switch is a css11501,7
REMOTE switch is a css11501,7
Mode: INTERFACE - Checking to see if interface Ethernet-Mgmt exists on remote system.
Mode: INTERFACE - Checking to see if interface e9 exists on remote system.
Mode: INTERFACE - Checking to see if interface e8 exists on remote system.
Mode: INTERFACE - Checking to see if interface e7 exists on remote system.
Mode: INTERFACE - Checking to see if interface e6 exists on remote system.
Mode: INTERFACE - Checking to see if interface e5 exists on remote system.
Mode: INTERFACE - Checking to see if interface e4 exists on remote system.
Mode: INTERFACE - Checking to see if interface e3 exists on remote system.
Mode: INTERFACE - Checking to see if interface e2 exists on remote system.
Mode: INTERFACE - Checking to see if interface e1 exists on remote system.
Working
Saving Master running-config to startup-config and archiving startup-config.
Copying running-config to startup-config.
Archiving startup-config.
Swapping Master and Backup ip addresses in tmp.cfg for app
and redundancy interface.
Checking for multiple APP sessions between redundant peers.
App Session IP: 167.168.165.9, Local IP address: 167.168.165.10
Checking IP Address size differences : <167.168.165.9> <167.168.165.10>
Adding APP session IP length difference to LOCALCONFIG byte size : 1
Adding APP session IP length difference to REMOTECONFIG byte size : 0
Removing CIRCUIT and INTERFACE modes from tmp.cfg.
Checking for ips with matching subnets for circuit sync.
Checking IP Address size differences : <167.168.165.10> <167.168.165.9>
Replacing local system VRID priorities and preempt settings with remote settings.
Local IP: 167.168.165.10 VRID: 40 PRIORITY: 254 PREEMPT: True
Remote IP: 167.168.165.9 VRID: 40 PRIORITY: 1 PREEMPT: False
Checking Number length differences : <254> <1>
Checking IP Address size differences : <167.168.165.132> <167.168.165.131>
Replacing local system VRID priorities and preempt settings with remote settings.
Local IP: 167.168.165.132 VRID: 41 PRIORITY: 254 PREEMPT: True
Remote IP: 167.168.165.131 VRID: 41 PRIORITY: 1 PREEMPT: False
Checking Number length differences : <254> <1>
Checking IP Address size differences : <167.168.166.3> <167.168.166.2>
Replacing local system VRID priorities and preempt settings with remote settings.
Local IP: 167.168.166.3 VRID: 42 PRIORITY: 254 PREEMPT: True
Remote IP: 167.168.166.2 VRID: 42 PRIORITY: 1 PREEMPT: False
Checking Number length differences : <254> <1>
IP addr bytes to add to LOCAL BYTE COUNT : 1
IP addr bytes to add to REMOTE BYTE COUNT : 1
Checking for SSL configuration ...
Working
Using rcmd to copy tmp.cfg to a file on Backup switch.
Archiving copy to Backup's startup-config.
Archiving Backup's current startup-config.
Restoring startup-config (new copy) to startup-config.
Clearing running-config.
Script playing the copy script of the Master's running-config.
Checking to make sure backup App goes down
Making sure app session is down.
Seconds to wait before calling it quits: 9168
Copy success being verified by comparing byte sizes of archived running-
configs of the Master switch and the Backup switch.
Making sure app session is up.
Seconds to wait before calling it quits: 9108
Waiting for completion signal from remote switch ...
Verifying running-config copy success ...
Comparing the byte count now.
Accounting for preempt configurations.
Adding 0 bytes to LOCALCONFIG byte count
Adding 24 bytes to REMOTECONFIG byte count
Accounting for priority value length differences.
Adding 0 bytes to LOCALCONFIG byte count
Adding 6 bytes to REMOTECONFIG byte count
Accounting for IP address size differences.
Adding 1 bytes to LOCALCONFIG byte count
Adding 1 bytes to REMOTECONFIG byte count
File copy Vipr Config Sync Failed. Commit unsuccessful!
localconfig: 218346 bytes
remoteconfig : 218320 bytesHi Daniel,
According to this output, the synchronization process goes well, but it fails when it has to verify what it synchronized. If you look at the last two lines, you will see that the size of the original local configuration is slightly bigger than the remote one. That's causing the validation to fail.
The first thing we need to confirm is whether the configuration really got properly replicated (you will have to check line by line to make sure it's the same). If so, we would just need to figure out why the file sizes are different.
There were some cases in the past in which the hard drive on the secondary device was failing, and as a result, the file was getting corrupted, leading to the size mismatch, so that's a possibility we need to take into account. Anyway, it would probably be better to open a TAC case to have it investigated in more detail.
Regards
Daniel -
CSS 11151 VIP Redundancy - Link State Redundancy/Keepalive
I have a pair of CSS 11151 each connected to a pair of cross-connected 3550 switches,I've configured VIP & Interface Redundacy,either VLAN1 interface or VLAN2 interface is shut down will cause the virtual router switchover. Recently I met some problem with CSS switchover when just one VLAN1 interface shutdown, and I was told that "type redundancy-up" should not work with VIP redundant mode, so I am trying to configure a critical service with a keepalive ap-kal-pinglist and ping all the circuit vlan's ip address on the CSS itself. but I am still confuse with some aspects.
1. Should I configure two separate virtual router for two circuit VLANs?
2. How to configure the service IP address? Because two 3550 have separate vlan ip address, and did not configured HSRP.
3. The script on my CSS is different with document, can I edit a new ap-kal-pinglist script to replace it?
Here's my config...
!************ INTERFACE *********************
interface 2
bridge vlan 2
!**************** CIRCUIT **************************
circuit VLAN1
ip address 10.0.2.33 255.255.255.128
ip virtual-router 1 priority 100
ip redundant-interface 1 10.0.2.29
ip critical-service 1 sw1-up-down
ip critical-service 1 sw2-up-down
circuit VLAN2
ip address 10.0.2.133 255.255.255.240
ip virtual-router 1 priority 100
ip redundant-interface 1 10.0.2.129
ip redundant-vip 1 10.0.2.132
ip critical-service 1 gateway
!************************** SERVICE
service gateway
ip address 10.0.2.130
type redundancy-up
active
service sw1-up-down
ip address 10.0.2.30
type redundancy-up
active
service sw2-up-down
ip address 10.0.2.31
type redundancy-up
activeI would recommend an upgrade to version 7.40 in order to get the 'reporter' functionality.
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_command_reference_chapter09186a008028fe6c.html
A reporter let you define which ports you want to monitor and when to failover [all ports down or any port down].
If you can't use 7.40, here is an answer to your question :
1. it does not matter. The vrid is used to differentiate other instances of VRRP that could exist on the same VLAN.
2. if you plan to use an ap-kal-pinglist, the service ip address really does not matter. The keepalive will use the ip addresses that you will pass to the ap-kal-pinglist function
3. you can modify the script and upload it back to the CSS. However, I would recommend using a different name in case you need the original script in the future.
Regards,
Gilles. -
What causes the VIP to failover when using VIP redundancy?
I am trying to setup VIP redudancy and would like to understand what circumstances cause a failover for the VIP. An example of what I would hope it does is if a redundant interface were to failover the VIP could be associated with it and failover as well or be configured to do so. Thanks in advance.
the CSS master is responsible to advertise itself on the interface you have Vip redundancy configured.
If the backup does not hear the master it will take over mastership.
another reason would be the lost a critical service.
You can define a service to be critical, and if it goes down, the active CSS will stop advertising itself as master forcing failover to the backup.
Gilles. -
VIP Redundancy and Management interface
If two CSS's have been configured as active and standby (VIP redundancy), and one of the interfaces of the active CSS goes down, and say the backup becomes active, I lose total connectivity to the Active box via the management interface IP. Once it regains back the active status, i can reconnect. Is this a "feature" or a "bug"...??
I think the software version is 6.14 build 107..I will post the configs soon..i dont see anything wrong with the configuration, its all straight forward configuration. I will post the boot config and the running config soon.
-
Yet another question...
I am running two CSS 11501 using VIP and INT Redundancy. One thing I am a little confused about, based on the sample configs and documentation is the following statment.
"Typically, you configure VIP redundancy on the public side of CSS peers that are positioned in front of a server farm. You configure virtual interface redundancy on the private-side interfaces attached to the Layer 2 device in front of the servers"
This sort of makes sense to me. Except if I only configure VIP redundancy on the public side of the CSS how do I route my packets from my firewall to the CSS for servers behind the CSS that are not VIPed - if I do not use Interface redundancy on the public side as well, then I have to route the packets to the physical interface.
I guess the question is - can I use interface redundancy on both the public side and the Server sid of the CSS as well as VIP Redundancy on the Public side??
Thanks,
HeathHeath,
that's no problem.
You can turn on interface redundancy wherever you want.
The documentation just refers to the most common situation.
Regards,
Gilles. -
Slow stateful failover for mission critical applications
I have two CSS running vip redundancy,ip interface redundancy and redundant-index on a ASR active-backup model.
They are attached to separate 3750 which share vlan info via a port channel.
When the master fails, we see the VRIR negotiation and mastership of VIPs occurs normally but the script that we run to validate our services fails and the services go to a down state.
Since the gateway for the reals is a redundant VIP that stays alive always based on a DUMMY service, we believe this could be a mac address table update on the 3750.
Traffic back from the reals is still sent to the "old" port where the gateway used to live.
Failover takes several minutes and TCP sessions timeout defeting stateful failover.
Any ideas???
Thanks
MANUELVLAN1 STP State: Disabled
VLAN1: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-78
Bridge ID: 06-a4-00-11-93-90-61-78
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
VLAN11 STP State: Disabled
VLAN11: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-79
Bridge ID: 06-a4-00-11-93-90-61-79
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
e1 Fwd 06-a4-00-11-93-90-61-79 06-a4-00-11-93-90-61-79 0 19 8001
VLAN211 STP State: Disabled
VLAN211: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-7a
Bridge ID: 06-a4-00-11-93-90-61-7a
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
VLAN222 STP State: Disabled
VLAN222: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-7b
Bridge ID: 06-a4-00-11-93-90-61-7b
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
e3 Fwd 06-a4-00-11-93-90-61-7b 06-a4-00-11-93-90-61-7b 0 19 8003 -
How long I have to wail the Stateful Failover on CSS 11154 ?
Somebody knows when the next Webns release is expected to implent the TCP Stateful Failover on CSS with VIP redundancy configuration.
At the begining of the year, the Product manager said that will be available on the WebNs V6.
For information: Alteon WEBOS v8 has released this feature for more one year ago.
What do cisco ?Is Adaptive Session Redundancy what you are looking for?
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_510/advcfggd/vipredun.htm#xtocid24 -
Redundancy and load sharing on more than 2 CSS's
Hello,
I have configured VIP, virtual interface and ASR on a pair of CSS's before. Currently, I have some VIP on CSS1 and some other VIP on CSS2 for resilience.
Because of performance issue (actually a fear for performance issue instead of real) I am looking into scaling up to 3 or more CSS's. I think I can have VIP and virtual interface redundancy on 3 or more CSS's but not ASR. Is it true?
Any advice will be welcomed.
CT Yau
Hong Kongnormally vip redundancy and asr are for pair of css only.
I think you can do vip redundancy with more than 2 CSS but it is officially not supported.
You can however have multiple VRRP group per interface and therefore combine your CSS by pair [a-b,b-c,a-c]
ASR is definitely not going to work with more than 2 CSS.
Regards,
Gilles -
I have configured a critical service(ap-kal-pinglist) for the VIP redundant failover, default freq,maxfail and retry freq is 5,3,5, so I think the failover time is 5+5*3*2=35s.But the virtual-router's state changed from "master" to "backup" in around 5 secs after connection lost.
Anyone help me to understand it?Service sw1-up-down connect to e2 interface,going down in 15sec
Service sw2-up-down connect to e3 interface,going down in 4sec?
JAN 14 02:38:41 5/1 3857 NETMAN-2: Generic:LINK DOWN for e2
JAN 14 02:39:57 5/1 3858 NETMAN-2: Generic:LINK DOWN for e3
JAN 14 02:39:57 5/1 3859 VRRP-0: VrrpTx: Failed on Ipv4FindInterface
JAN 14 02:40:11 5/1 3860 NETMAN-2: Enterprise:Service Transition:sw2-up-down -> down
JAN 14 02:40:11 5/1 3861 NETMAN-2: Enterprise:Service Transition:sw1-up-down -> down -
We have configured two CSS in vip redundant mode.If one CSS rebooted which is active and having high priority traffic is flowing from CSS having low priority.Once high priority CSS again comes online will it take active mode back? Secondly If now we reboot active CSS which has low priority will other CSS take over?
PushpakPushpak,
In VIP redundancy the CSS uses VRID to determine what VIP addresses it will be master and backup for. When CSS-1 comes back online, it will take mastership for any VRID(s) it has a higher priority for.
Regards
Kris -
Quirkiness with box to box redundancy.
I have several sets of CSS's running in box to box redundancy running version 5.03 Build 15.
My question is what causes one CSS to out of the blue go backup and the other become master? I've had this happen on just about all the ones I have configured for box to box. This one pair has been running for a little over a year without a problem and today failed over to the other CSS twice. Nothing shows up in the logs except the "transition to redundancy backup / master." Another pair did this several times about a year ago, after having ran for quite some time. I rebooted both units and they were fine for a period of about 6 months. I find this very strange and am curious if anyone else has had these same problems. I have updated the code on one set, the problem reappered about 7 months later.
I'm now deploying all new CSS installs using interface/vip redundancy.
Thanks!the version you are using is a potential explanation.
I would really not recommend it.
You should either go to 5.0 or 6.10
Regarding the problem you got, it could also be related to how you connected the CSS together.
Do you have a straight connection between the 2 ? or do you use a switch ?
If a switch, something could have happened there.
Gilles. -
CSS 11501 7.40 Monitoring the services on real servers?
Hi,
Just want to ask some basic questions, How can i monitor the services (ie 80 and 443) of the real servers. So that when the CSS11501 detects that one of the services of one of the real servers is down, it will not forward the traffic to that server. Or is the CSS is configured to monitor the services by default?
Because we are planning to upgrade one of the webservers (web01) while web02 is running, if we shutdown the service 80 and 443, does it affect the end-user, will CSS automatically redirect it to web02?
Regards,
MarlonHere is my sample configuration
!************************** SERVICE **************************
service WEB01-79-HTTP
ip address 172.20.13.4
keepalive type tcp
keepalive port 80
active
service WEB01-79-HTTPS
ip address 172.20.13.4
keepalive type tcp
keepalive port 443
active
service WEB01-80-HTTP
ip address 172.20.13.5
keepalive type tcp
keepalive port 80
active
service WEB01-80-HTTPS
ip address 172.20.13.5
keepalive type tcp
keepalive port 443
active
service WEB01-82-HTTP
ip address 172.20.13.6
keepalive type tcp
keepalive port 80
active
service WEB01-82-HTTPS
ip address 172.20.13.6
keepalive type tcp
keepalive port 443
active
service WEB01-83-HTTP
ip address 172.20.13.7
keepalive type tcp
keepalive port 80
active
service WEB01-83-HTTPS
ip address 172.20.13.7
keepalive type tcp
keepalive port 443
active
service WEB01-79
ip address 172.20.13.4
active
service WEB01-80
ip address 172.20.13.5
active
service WEB02-82
ip address 172.20.13.6
active
service WEB02-83
ip address 172.20.13.7
active
!*************************** OWNER ***************************
owner VRL
content VIP
redundancy-l4-stateless
content WEB-HTTP1
vip address 172.20.10.85
protocol tcp
port 80
advanced-balance sticky-srcip
add service WEB01-79-HTTP
add service WEB01-82-HTTP
redundancy-l4-stateless
active
content WEB-HTTP2
vip address 172.20.10.86
port 80
protocol tcp
advanced-balance sticky-srcip
add service WEB01-80-HTTP
add service WEB01-83-HTTP
redundancy-l4-stateless
active
content WEB-HTTPS1
advanced-balance sticky-srcip
vip address 172.20.10.85
protocol tcp
port 443
add service WEB01-79-HTTPS
add service WEB01-82-HTTPS
redundancy-l4-stateless
application ssl
sticky-inact-timeout 20
active
content WEB-HTTPS2
advanced-balance sticky-srcip
vip address 172.20.10.86
protocol tcp
port 443
add service WEB01-80-HTTPS
add service WEB01-83-HTTPS
redundancy-l4-stateless
application ssl
sticky-inact-timeout 20
active
content WEB01-79
add service WEB01-79
vip address 172.20.10.79
redundancy-l4-stateless
active
content WEB01-80
add service WEB01-80
vip address 172.20.10.80
redundancy-l4-stateless
active
content WEB02-82
add service WEB02-82
vip address 172.20.10.82
redundancy-l4-stateless
active
content WEB02-83
add service WEB02-83
vip address 172.20.10.83
redundancy-l4-stateless
active
!*************************** GROUP ***************************
group WEB01-79
add service WEB01-79
vip address 172.20.10.79
redundancy-l4-stateless
active
group WEB01-80
add service WEB01-80
vip address 172.20.10.80
redundancy-l4-stateless
active
group WEB02-82
add service WEB02-82
vip address 172.20.10.82
redundancy-l4-stateless
active
group WEB02-83
add service WEB02-83
vip address 172.20.10.83
redundancy-l4-stateless
active -
Critical Services on CSS - All or Any?
I've configured vip redundancy on a pair of 11506. I would like critical services defined to failover when ALL the services are down or the upstream gateway is down. The documentation isn't very clear on this. There are simple examples and only the one line about an ALL SERVICES option. (see below)
"Local critical services for any service other than scripted or redundancy
uplink, such as a Web service. The VR goes down when all associated local
critical services go down."
I assume you do the ALL services option by creating multipe critical services under the IP Interface. But the documentation doesn't say. Am I right?Hi Gilles,
Thanks for the weekend reply! I'd read that section on critical services. It lists three options. The first two will fail if ANY of the configured keepalives fail while the third we clarified how to do an ALL option.
What I really want to do is fail over when the upstream gateway is unreachable OR all services are down (basically a hybrid ANY/ALL option).
Rather than build a separate service should I use the existing ones? I'm already using port specific keepalives under my services (port 80 and a custom application TCP port).
Can I add a second keepalive type to each service with the ping script listing the server IP and upstream router IP? That way if the router fails the service is down.
I'm guessing if it isn't possible to add a second keepalive to a service I will need to write a custom script to accomplish what I'm trying to do. No biggie I'm just looking for the quickest way to do this.
Thanks in advance. -
CSS Config Syncing problem 8.10
When I sync two CSSs running virtual router redundancy with "script play commit_vip_redundancy", I get an error about the remote unit not having the virtual IP configured.
If I try add the IP to the circuit (ip redundant-vip) on the backup CSS manually first, I get an error that the content rule does not exist.
So currently I'm pasting the config into the devices separately, which is time consuming. Only after the config is present on the 2nd unit can I replicate changes using the specified script.
I am running ver 8.10 software. Any solutions to the problem?
Related to the above, is there an easy way to switch over to box-box redundancy from VIP, keeping in mind that the configuration is over 4000 lines long with hundreds of services and content rules?First, I would not recommend to switch over to box-to-box redundancy.
You have better failover response time with vip redundancy.
Regarding your issue, I would suggest to open a service request with the TAC.
Provide your config and the output of "script play commit_vip_redundancy -d"
We need to investigate this and submit a bug if necessary.
Gilles.
Maybe you are looking for
-
Open .pdf file in Word & "Convert File" Box appears...Weird.
Using my MacBook Pro, I click on a PDF file to open in Microsoft Word & an angry box appears that says "Convert File." In the box it says: Convert file from: then it lists various file types i.e., Text only, MS-DOS Text, Rich Text Format, HTML Docume
-
Can't create a Contact from a recent call on iPhon...
Hi Folks, I just made a phone call on my iPhone 4 (IOS 7.12) and want to add the called number to "Contacts". It shows on the "recent" tab, but there the only option offered is to "Block", "Cancel" or add the number to favorites! I have added them
-
My imessage doesn't don't want to work yesterday it was working perfectly i don't what happen.
-
What type of component should I derive from?
Hi, I am developing a UI component, which accepts an array from a bean. I will use the data to draw several curves on a page. So I derived my UI component from UIOut. JSP likes this: <w:multiline width="400" height="300" title="Simulation Results"
-
I have a large number of jpeg images with embedded IPTC data. When importing these to Library, I set up a preset to import all IPTC fields, but my data are not transferred with the image. Does LR import embedded IPTC data and if so, how is it done? P