VIP and publick IP in TNS

Hi Experts,
We have a 4 nodes for ORACLE 11.1 at red hat5.0.
We created a server with failover/loading balance. the host name is VIP in TNS.
we copy this TNS to end users TNS file.
However,there are one remote user who is not in our network.
the client replace VIP by publick in client TNS and works.
I also get news from nwtwork admin that firewasll redirect IP is a node public IP.
I coufigused, Do we need to use VIP or public IP in this case?
where and when do we need to use VIP IP or public IP.
does need TNS in server side is a same as TNS in client?
The node who connect by public IP listener frequently stop and massage as TNS no listener ora-12541
thanks for your help!
JIm
Edited by: user589812 on Sep 27, 2009 7:33 AM

user589812 wrote:
I coufigused, Do we need to use VIP or public IP in this case?That depends on what the TNS alias request. If it connects to a service name (and not an Oracle SID), and the listener have this service running on multiple IP addresses (over multiple nodes), the Listener can redirect that client to connect to any of these IP addresses. Likely the service that you are using for that alias is defined for both virtual and static IPs. Which means that despite the TNS alias connecting to a virtual address initially, the Listener can redirect that client to a static (public) IP.
Solutions include to register a service that only runs on the virtual IPs and have the TNS alias use that service. Or hardcode the instance to connect to (using ORACLE_SID) and specifying the virtual IP for that.. (but this is not a very redundant definition and will fail if that virtual IP failed over to another server).

Similar Messages

Can VIP and Rservers be in the same subnet in ACE Routed Mode

Good Day,
Sorry for the lengthy post.
Currently I have a 6509s running in VSS mode with ACE30 in each chassis.
I have 5 vlans, which the VSS is the L3 interface for each. 1 Vlan is for management, the others are the data vlans for the servers.
The ACE is configured in bridge mode, with all VLANs going to a specific context (non Admin).
Some of the Host on each VLANs are not utilized for load-balancing. The default gateway for each VLAN is configured on the VSS.
I would like to setup the ACE in the routed mode, without having to change the IP address of each servers on different VLANs.
Basically I want to turn off the SVIs on VSS and move the L3 interface on the ACE Context, and let it perform the local routing for all the hosts.
I was going to add a new /30 L3 interface between the VSS and ACE to be utilized for default route traffic coming from the ACE Context, and static routes from VSS to ACE for traffic destined to host that are being load-balanced and not being load-balanced. Basically force the traffic through the load-balancer in/out.
For future deployment, I was planning on using different IP address for the VIPs, and Real servers (most likely RFC 1918).
From most of the examples I have seen the VIP and Rservers are in different Subnets. But because I am trying to not change the IP address of the rservers and VIP, I wanted to know if the VIP and Rservers can be configured to be in the same subnet where the ACE is in routed mode.
Unfortunately I don't have a spare ACE to test scenario.
As always any help would greatly be appreciated.
Regards,
Raman

Link-local addresses are usually the self assigned IP address that a device will set when a DHCP server cannot be found. These are the addresses with 169.254.x.x subnet.
If the router is assigning IP addresses for your network, then they will usually have a different IP subnet, possibly 192.168.0 for D-Link. And this subnet would be for the wired and wireless connections. So it would be more a case of bridging the two network topolgies rather than routing them.
The network host is busy message could be more to do with the driver and the IP protocol selected when creating the queue than the connection being broken between the Mac and printer. If you were to open Network Utility and select the Ping tab, enter the IP address of the HP and set the pings to 4, pressing the Ping button will soon show if there is a path through the wireless to the printer.
If you get a response to the ping you could then open Safari and type the ip address as the URL. This would then connect to the internal web page of the printer and possibly let you enable an IP protocol like LPR so that you can use LPD on the Mac instead of Bonjour to connect to the printer.
As for the driver, you could look at using a Gutenprint driver instead of the HP driver or the hpijs package to get past the limitations that some printer drivers have with network connections.

How to failover SCAN VIP and SCAN Listener from one node to another?

Environment:
O.S : HP-UX B.11.31 U ia64
RDBMS: Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
It is a 2 Node RAC.
Question:
How to failover the SCAN VIP and SCAN LISTENER running on node 1 to node 2?
What is the relation between standard LISTENER and SCAN LISTENER ?
Why do we need LISTENER, when we have SCAN LISTENER ?
When I tried with SRCVTL STOP LISTENER , I thought the SCAN LISTENER adn SCAN IP will failover, but it did not?
Also please clarify if I use SRVCTL RELOCATE SCAN -i 1 -n Node1
Actalluy I am trying that by moving the SCAN listeners so that when I do PSU 7 patching on 1 node, no incoming attempt to connect will spawn
a process and thereby opening files in $ORACLE_HOME (which would prevent the patch from occurring)
Please clarify my queries.
Thanks, Sivaprasad.S

Hi Sivaprasad,
1. The following link will help you for SCAN VIP and SCAN LISTENER failover from 1 node to another.
http://heliosguneserol.wordpress.com/2012/10/19/how-to-relocate-scan_listener-from-one-node-to-another-node-on-rac-system/
http://oracledbabay.blogspot.co.uk/2013/05/steps-to-change-scan-ip-address-in.html
2. The Standard LISTENER is specific for particular node for which it is running. It cannot be relocated as its specific for the node its running. SCAN listeners are not replacements for the node listeners.A new set of cluster processes called scan listeners will run on three nodes in a cluster (or all nodes if there are less than 3). If you have more than three nodes, regardless of the number of nodes you have, there will be at most three scan listeners. So no relation for standard LISTENER and SCAN LISTENER.
3. Hmmm. let me put it in easy way for this question. All the RAC services like, asm, db , services, nodeapps registers with this SCAN_LISTENER. So if any of these services (asm, db , services, nodeapps) got down/not running, the SCAN_LISTENER will know the down status, and if any client requests to access the node/service which is down, the SCAN_LISTENER will redirect the client request to the least loaded node. So here all these process will happen without the knowledge of client. And As usual the standard LISTENER looks only for incoming request to connect with the database. So we need both LISTENER and SCAN LISTENER.
4. If you provide SRCVTL STOP LISTENER, it stops the default listener on the specified node_name, or the listeners represented in a given list of listener names, that are registered with Oracle Clusterware on the given node. No failover will happen under this case.
5. Yes you can relocate if you want to relocate the scan.
Hope this helps!!
Regards,
Pradeep. V

Weired issue odd IP's can ping the VIP and even can't on the Nexus 9K switch.

Hello experts!
we have two nexus 9k core, attached to the HP Blade v7000 chasis and VPC configured. All Vlans are HSRP are configured. VPC is configured successfully. But the weird this is that source IP address 10.1.2.3 can ping the dest VIP (on the loadblanacer) but 10.1.2.4 can't ie all odd IP's can ping the vip and even IP's can't ping and this is happening in all other Vlans. No firewall no security applience ... windows firewalls are turned off, no ACL's on the swtiches. If I shut down the interface on nexus 1 then all IP's can ping the VIP, as soon as I unshut the interface then .4 stops pinging, and if I shutdown the interface on nexus 2 then all IP's can ping. 10 gig links are connected to Flex fabric card and vpc port channel is up. Any thoughts or help ?
Nexus 1 Nexus 2

Hello experts!
we have two nexus 9k core, attached to the HP Blade v7000 chasis and VPC configured. All Vlans are HSRP are configured. VPC is configured successfully. But the weird this is that source IP address 10.1.2.3 can ping the dest VIP (on the loadblanacer) but 10.1.2.4 can't ie all odd IP's can ping the vip and even IP's can't ping and this is happening in all other Vlans. No firewall no security applience ... windows firewalls are turned off, no ACL's on the swtiches. If I shut down the interface on nexus 1 then all IP's can ping the VIP, as soon as I unshut the interface then .4 stops pinging, and if I shutdown the interface on nexus 2 then all IP's can ping. 10 gig links are connected to Flex fabric card and vpc port channel is up. Any thoughts or help ?
Nexus 1 Nexus 2

Weired issue odd IP's can ping the VIP and even can't!

Hello experts!
we have two nexus 9k core, attached to the HP Blade v7000 chasis and VPC configured. All Vlans are HSRP are configured. VPC is configured successfully. But the weird this is that source IP address 10.1.2.3 can ping the dest VIP (on the loadblanacer) but 10.1.2.4 can't ie all odd IP's can ping the vip and even IP's can't ping and this is happening in all other Vlans. No firewall no security applience ... windows firewalls are turned off, no ACL's on the swtiches. If I shut down the interface on nexus 1 then all IP's can ping the VIP, as soon as I unshut the interface then .4 stops pinging, and if I shutdown the interface on nexus 2 then all IP's can ping. 10 gig links are connected to Flex fabric card and vpc port channel is up. Any thoughts or help ?
                               Nexus 1                                                                                                                        Nexus 2

Nexus 1
show hsrp active brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active addr      Standby addr     Group addr
Vlan99      1   120 P Active   local            10.104.0.3       10.104.0.1      (conf)
Vlan160     5   120 P Active   local            10.104.5.3       10.104.5.1      (conf)
Vlan200     6   120 P Active   local            10.104.6.3       10.104.6.1      (conf)
Vlan210     7   120 P Active   local            10.104.7.3       10.104.7.1      (conf)
Vlan310     9   120 P Active   local            10.104.9.3       10.104.9.1      (conf)
Vlan350     11 120 P Active   local            10.104.11.3      10.104.11.1     (conf)
Vlan450     13 120 P Active   local            10.104.13.3      10.104.13.1     (conf)
Vlan700     14 120 P Active   local            10.104.14.6      10.104.14.4     (conf)
Vlan750     15 120 P Active   local            10.104.15.3      10.104.15.1     (conf)
=======================
Nexus 2
show hsrp active brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active addr      Standby addr     Group addr
Vlan100     3   120 P Active   local            10.104.2.2       10.104.2.1
(conf)
Vlan150     4   120 P Active   local            10.104.4.2       10.104.4.1
(conf)
Vlan199     2   120 P Active   local            10.104.1.2       10.104.1.1
(conf)
Vlan300     8   120 P Active   local            10.104.8.2       10.104.8.1
(conf)
Vlan320     10 120 P Active   local            10.104.10.2      10.104.10.1
(conf)
Vlan400     12 120 P Active   local            10.104.12.2      10.104.12.1
(conf)
Vlan760     16 120 P Active   local            10.104.16.2      10.104.16.1

Should SCAN VIP and Listener jump among Nodes?

Oracle (GI and DB): 11.2.0.3 SE
OS: RHEL 5.6
I remember when I first tried scan several years ago (most likely with 11.2.0.1 EE), the SCAN VIP and Listeners jumps from node to node whenever a DB connection was established.
Recently, in a newly installed 2 node cluster running 11.2.0.3 SE, it seems the SCAN VIP and Listener stick to a single node unless during failover or requested with a command. As a result, a SCAN VIP and Listeners end up running on a single node after some failover testing.
Which is the designed behaviour? I understand they can direct connection requests to DB instance on other node. Just want to know whether they are supposed to jump?

Hi,
I have not tried it myself, but if you look at the crs profile on how SCANs are defined, they are set to DISPERSION.
# crsctl stat res ora.scan1.vip -p
NAME=ora.scan1.vip
TYPE=ora.scan_vip.type
START_DEPENDENCIES=hard(ora.net1.network) dispersion:active(type:ora.scan_vip.type) pullup(ora.net1.network)
...So they should not/never run on the same node, since the dispersion policy tells them differently.
However this dependency is checked at startup time, and not always during runtime. So if you do a lot of test, your szenario is possible.
Have you tried waiting a while, if this resolves the issue?
If they stay on the same node, I would open an SR, because then it does not follow the dispersion policy.
Regards
Sebastian

Correlating a flow from client to the VIP and from the VIP to the server

Hi,
we need to look at a flow from a client to a server that is traversing a VIP on the ACE. So, we pulled the sniffer traces between the client and the VIP and also between the VIP and the back-end server. How do we find the same flow on these sniffer traces?
Thanks.
_ greg

Hi Greg,
If ACE is just forwarding the client request the you should see the client port and IP at the backend. If ACE is doing NAT then you can try and filter on the basis of time stamps or information in HTTP header like specific client cookie but mostly when you have different front end and back end streams then time stamps are your best option. Normally during TS taking simultaneous output of "show conn" also helps in corelating front end and backend connection. You can take connection ID and see the corresponding backend stream and vice versa
show np x me-stats "-c -vvv"--->where x is NP 1 or 2 or 3 or 4 depending upon the specific connection output in show conn.
Regards,
Kanwal

RAC 11gR2 VIP and SCAN failover behavior

I tried to failover testing on 2 node 11gR2 RAC on Linux 5 X86-64 with configure in tnsnames.ora on client side (client side TAF configuration) with the following configuration
NVSDB =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = dbrac-scan)(PORT = 1521))
(LOAD_BALANCE = yes)
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = NVSDB)
(FAILOVER_MODE =
(TYPE = SELECT)
(METHOD = BASIC)
(RETRIES = 180)
(DELAY = 5)
The test scenario
1. Connect from client to RAC database , and test query with select * from dba_objects
2. Open new terminal and connect to instance in step 1 , then shutdown abort
3. I found that , the session in step 1 not failover to other node , and VIP and SCAN not failover to other node too
In my opinion session , VIP and SCAN should failover to other node.
Or is this the default behavior of VIP and SCAN on 11gR2 ??
Can anyone suggest me ?
Thankyou and Regards

user10139161 wrote:
3. I found that , the session in step 1 not failover to other node , Which client/driver did you use to try this? The reason I am asking is that TAF is not supported with jdbc:thin, so if you were trying this with sqldeveloper and the defaul driver that would be the expected behaviour
and VIP and SCAN not failover to other node tooThat is also expected. You only stopped the instance, there is no reason to relocatethe VIP. In your case, client could still connect to the listener running on this node, the listener would know of the second instance still being up and redirect all connection attempts there.
What you could try is rebooting the whole server, then you would see IPs being relocated.
Bjoern

Global load balancing/active active vip and virtual interface redundancy

Is there a way to configure both of these technologies without exposing the external addressing to the internal network? I have active active within the data center and would like to have active/active across two data centers but I don't see any way to use internal addressing for my content rules and still use them for dns unless I can specify records without using content rules. Thanks.
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a008009438a.shtml
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a0080157898.html

Hi Victor,
In response to your questions regarding doing Active/Active GSLB using VIP and interface redundancy.
Rule Based GSLB will not work with VIP/Interface
redundancy.
The reason is because the CSS can not set up an app session to a redundant
interface, it needs to set the app session up to a real interface. Thus, a
full mess topology must be used for GSLB and vip/interface redudancy.
Bug ID CSddw27861 reported this problem and engineering added the command
"ap-kal-vip" to support a full mess topology. This command can only be used
under zone based GSLB and not rule based.
The syntax for the command would be:
dns-record a www.work.com 5.5.5.5 0 single kal-ap-vip 1.1.1.1
rule/ACL based GSLB with vip/int redundancy will not work.
Regards,
Mark

I am using Mavericks. I had a list of VIPS and used it extensively. Now it has disappeared and VIPs on the menu bar is faded. There is nil response to VIP in help. Can you tell me what has happened?

I am using Mavericks. In Mail I had a list of VIPS and used it extensively. Now it has disappeared and VIPs on the menu bar is faded. There is nil response to VIP in help. Can you tell me what has happened?

Triple-click anywhere in the line below on this page to select it:
~/Library/Mail/V2/MailData/VIPSenders.plist
Right-click or control-click the highlighted line and select
Services ▹ Show Info in Finder (or just Show Info)
from the contextual menu.* An Info dialog should open.
Does the dialog show "You can read and write" in the Sharing & Permissions section?
In the General section, is the box labeled Locked checked?
What is the Modified date?
If you don't have read and write access to the item, change the settings as directed here. Note, however, that if one file has wrong access settings, most likely others do as well. If the item is locked, unlock it.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. Open a TextEdit window and paste into it (command-V). Select the line you just pasted and continue as above.

BAPI for create VIP and Group_d for BP

Hey
Do you know BAPI for filling fields VIP and Group_d from table BP001 for BP?
Regards
Radek

Hey, thank you, with this BAPI I found bapi BAPI_BUPA_FS_TREASURY_ADD that suit my needs.
BAPI FS_API_BP001_change is only for changing records, BAPI FS_API_BP001_ADD has some problems (short dump).
Regards
Radek

VIP and Interface Redundancy

Yet another question...
I am running two CSS 11501 using VIP and INT Redundancy. One thing I am a little confused about, based on the sample configs and documentation is the following statment.
"Typically, you configure VIP redundancy on the public side of CSS peers that are positioned in front of a server farm. You configure virtual interface redundancy on the private-side interfaces attached to the Layer 2 device in front of the servers"
This sort of makes sense to me. Except if I only configure VIP redundancy on the public side of the CSS how do I route my packets from my firewall to the CSS for servers behind the CSS that are not VIPed - if I do not use Interface redundancy on the public side as well, then I have to route the packets to the physical interface.
I guess the question is - can I use interface redundancy on both the public side and the Server sid of the CSS as well as VIP Redundancy on the Public side??
Thanks,
Heath

Heath,
that's no problem.
You can turn on interface redundancy wherever you want.
The documentation just refers to the most common situation.
Regards,
Gilles.

Lack of VIP and Failover

DB Version : 10.2.0.4
When VIP is functional , the CONNECTION REFUSED errors are quickly detected, and transparently the connection request will be transferred(fail over) to the next available IP.
If something goes wrong with your VIP , the failover will still happen but only after a substantial delay (until the TCP CONNECTION timeout is detected ). Am i Right?

Yes, this is TCP behaviour - nothing specifically to do with using virtual IP addresses.
The Oracle client driver will use the socket connect() call to initiate the TCP connection. It can take some time before this call fails with a ETIMEDOUT error. A ECONNREFUSED is usually immediate.
In case of a connect() failure, the client driver will then use the next IP address in the address list and try that (should the TNS provide an enumerated list of addresses).
The ETIMEDOUT error can result after a very long delay when the server owning that IP address has not yet completed loading (or shutting down) its IP stack or NIC. The ECONNREFUSED is usually immediate as the IP stack is up and running, and can respond directly with a "+no service listening on that port+" error.

I deleted emails from VIPs and didn't realise they would be deleted from my Mailbox. VIPs does't appear in Mail on Time Machine. Is there any way I can restore the deleted emails?

I deleted emails from VIPs in Apple Mail and didn't realise they would be deleted from my Mailbox. I have tried to restore from Time Machine but VIPs doesn't appear. Is there any way I can retrieve the deleted emails? I also have bachups on an external hard drive.
I have OS X 10.9.2

You can't download pictures from iCloud by logging into icloud.com. If you deleted pictures from camera roll AND photo stream, the only possibility is preforming a restore from an iCloud backup, assuming the backup has the pictures in it. (Many users have been unable to restore and get back their pictures.)
If the restore doesn't have all the pictures, then they are gone.
In the future, use photo stream to sync photos from an iPhone to a computer, then copy the photos on the computer from the photo stream album into a permanent album. Photo stream pics stay there only for 30 days, and only up to 1000 photos are stored. Don't use photo stream as a storage medium, it's only for copying photos from one device to another. Always copy (either via USB cable or photo stream) to a computer and then move to an album.

ACE - Inspection per VIP and other Questions

I have my ACE up and running with SLB for HTTP, terminating SSL and inspection for the traffic flowing through the ACE.
One thing i haven't figured out yet is how to let the ACE distinguish between inspecting only the VIP traffic versus inspecting the whole traffic flowing through the routed VLAN.
My service-policy is currently bound on the xfer net VLAN which also services the VIP.
I made a "match url" rule with action reset for the regex "admin". If try to access the link "slb.foo.local/admin" via the VIP it works but it unfortunatly also works if i access the real servers in the VLAN behind the ACE directly.
A: Any idea how to solve that with best practice?
B: I haven't found a way to create a self signed certificate so far. Is it not implemented or did i just miss it?
C: Is an ACL mandatory to get traffic flowing via the VIP to the real servers? I have the feeling that without an ACL permitting the traffic explicitly there won't be a flow at all.
D: The commands "loadbalance vip icmp-reply active" and "loadbalance vip advertise active" for RHI are now two times in my config. Do i only need them once in my policy or does it make sense to keep them per HTTP and HTTPS Class?
The corresponding config:
class-map match-all HTTP-INSPECT-L4CLASS
description HTTP protcol deep packet inspection
2 match port tcp eq www
class-map type http inspect match-any HTTP-INSPECT-L7CLASS
description HTTP - Deep packet Inspection - Definition
2 match content length range 0 256
3 match url [/]admin
4 match url .asp
class-map match-all L4-VIP-CLASS
2 match virtual-address 10.10.10.85 tcp eq www
class-map match-all L4-VIP-CLASS-SSL
2 match virtual-address 10.10.10.85 tcp eq https
class-map type http loadbalance match-any L7-SLB-CLASS-1
3 match http header Host header-value "10.10.10.85*"
4 match http header Host header-value "slb.foo.local*"
class-map type management match-any REMOTE_ACCESS
2 match protocol ssh any
3 match protocol icmp any
policy-map type management first-match REMOTE_MGM_ALLOW_POLICY
class REMOTE_ACCESS
permit
policy-map type loadbalance first-match L7-SLB-Policy
class L7-SLB-CLASS-1
serverfarm LB-Testfarm
policy-map type inspect http all-match HTTP-INSPECT-L7POLICY
class HTTP-INSPECT-L7CLASS
reset
policy-map multi-match L4-SLB-POLICY
class L4-VIP-CLASS
loadbalance vip inservice
loadbalance policy L7-SLB-Policy
loadbalance vip icmp-reply active
loadbalance vip advertise active
appl-parameter http advanced-options HTTP_PARAMETER_MAP
class L4-VIP-CLASS-SSL
loadbalance vip inservice
loadbalance policy L7-SLB-Policy
loadbalance vip icmp-reply active
loadbalance vip advertise active
ssl-proxy server SSL-PSERVICE-Server
class HTTP-INSPECT-L4CLASS
inspect http policy HTTP-INSPECT-L7POLICY
interface vlan 444
description XFER-ACE
ip address 10.10.10.83 255.255.255.240
access-group input All
access-group output All
service-policy input L4-SLB-POLICY
service-policy input REMOTE_MGM_ALLOW_POLICY
no shutdown
interface vlan 555
description ACE-Server
ip address 10.10.10.97 255.255.255.240
access-group input All
access-group output All
no shutdown
Thanks for reading...
Roble

Gilles hope you still read this thread :)
In another Post you mentioned that the ACE features URL rewriting. I am desperate looking for this feature but can't find it anywhere in the docs.
Since i am terminating ssl on the front and speaking plain http on the back end i have some problems with the portal application and links to non-secure documents.
I don't think i can make the appl. admins fix the problem or make the company for the portal
rewrite the code. (3 letters NOT starting with an I)
From the SCA Docs i found following description which matches my problem.
[quote]
When you have configured the urlrewrite command, the SCA can inspect the full HTML answer to replace all links to a nonsecure document with a link to the same document via HTTPS
[/quote]
EDIT:
Another thing...
I currently redirect all my http traffic to a certain https url with a redirect rserver. Works fine.
I am still thinking about how to solve the same problem with ssl/https portion of my vip.
vip:443 -> redirect to vip:443/url/foo/bar/
I tried something like...
vip:443 -> redirect to vip:444/url/foo/bar/
But somehow that didn't work out. You have a valid "conceptional" approach to this issue?
Roble

VIP and publick IP in TNS

Similar Messages

Maybe you are looking for