On Wed, Jan 22, 2003 at 11:38:35AM -0800, Brent Van Dussen wrote:
> You'll need to keep the serveriron and the customers webservers in the same
> L2 domain. If the webservers and the serveriron are all part of the same
> customer installation I don't see why it has to be separated out into VLAN's.
Thanks for the quick response!
The ServerIrons are not dedicated to this customer; the customer's
virtual server will be "sharing time" on a ServerIron we also use for
in-house load-balanced virtual servers. Ultimately other customers
might end up in a similar configuration, and we prefer to map our colo
customers into separate L2 domains.
Is the point of having them in the same L2 domain that the ServerIron
can see ARPs for the servers directly?
> DSR will do everything else that you need it to, just remember that you'll
> have to configure Loopbacks on each of the real servers.
>
> If the real servers are in a different subnet than the serveriron you can
> use the source-ip or just put both subnets on the upstream L3 device and
> the serveriron will route health checks up to the router and back down to
> the real servers.
Sorry, you lost me here.
Are you talking about just adding the "server source-ip
[IP-in-their-netblock]" globally, with a usual "server real foo"
definition, and "port http dsr" on the virtual server, and that that
should do it all? I've never tried this particular permutation, but if
it should work, I'll give it a shot!
-- Clifton
--
Clifton Royston -- LavaNet Systems Architect -- [EMAIL PROTECTED]
"If you ride fast enough, the Specialist can't catch you."
"What's the Specialist?" Samantha says.
"The Specialist wears a hat," says the babysitter. "The hat makes noises."
She doesn't say anything else.
Kelly Link, _The Specialist's Hat_
From [EMAIL PROTECTED] Wed Jan 22 15:31:19 2003
From: [EMAIL PROTECTED] (Clifton Royston)
Date: Wed Jan 22 20:31:06 2003
Subject: [f-nsp] Re: can this be done?
In-Reply-To: <[EMAIL PROTECTED]>;
from [EMAIL PROTECTED] on Wed, Jan 22, 2003 at 01:13:53PM -0600
References: <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
On Wed, Jan 22, 2003 at 01:13:53PM -0600, Kim Wall wrote:
> "I think I could achieve 2, 3, and 4 by defining the servers as
> "remote" instead of "real" and configuring DSR, but the documentation
> seems to imply that the ServerIrons can't automatically detect a
> failed server in that case."
>
> Clifton, not sure what version of software you are using, but I know
> that the SI-XL still performs "pings" as a basic health check to
> remote real servers using version 7.3.05. This is done automatically.
This was a good tip, and got me thinking (and reading the docs deeper)
about how to enable additional health checks.
For those Googling the mailing list, it turns out to be perfectly
easy to configure further application layer checks in conjunction with
a "dsr" or "Switchback" configuration. Setting up explicit health
checks on http to work with DSR or Switchback, e.g. in an
asymmetrically routed network, is as simple as this:
server port 80
! number of seconds and retries between polls
tcp keepalive 60 2
server real foo xx.yy.zz.ww
port http
port http keepalive
port http url "HEAD /"
server real bar xx.yy.zz.vv
port http
port http keepalive
port http url "HEAD /"
server virtual baz xx.yy.zz.qq
port http dsr
bind http foo http bar http
If you tail the http logs on the real servers, you will see the
"HEAD" requests from the ServerIron itself show up every 60 seconds, or
however often you've configured them, along with whatever connections
get made to the virtual server.
This also appears to work in the multiple subnet and multiple VLAN
environment I was originally concerned about.
-- Clifton
--
Clifton Royston -- LavaNet Systems Architect -- [EMAIL PROTECTED]
"If you ride fast enough, the Specialist can't catch you."
"What's the Specialist?" Samantha says.
"The Specialist wears a hat," says the babysitter. "The hat makes noises."
She doesn't say anything else.
Kelly Link, _The Specialist's Hat_
From [EMAIL PROTECTED] Thu Jan 23 16:45:11 2003
From: [EMAIL PROTECTED] (Clifton Royston)
Date: Thu Jan 23 21:45:13 2003
Subject: [f-nsp] ServerIron config question - can this be done?
In-Reply-To: <[EMAIL PROTECTED]>;
from [EMAIL PROTECTED] on Wed, Jan 22, 2003 at 11:14:27AM -1000
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
On Wed, Jan 22, 2003 at 11:14:27AM -1000, Clifton Royston wrote:
...
> Are you talking about just adding the "server source-ip
> [IP-in-their-netblock]" globally, with a usual "server real foo"
> definition, and "port http dsr" on the virtual server, and that that
> should do it all? I've never tried this particular permutation, but if
> it should work, I'll give it a shot!
This seems to be working fine; thanks for all the help!
We are running into some minor problems on their servers, because the
Linux kernel is insisting on proxy-arping for the virtual IP and
causing some ARP conflicts.
<http://www.linuxvirtualserver.org/docs/arp.html>
This is a Linux bug or serious misfeature IMHO, but there is a patch
the customer will apply for it as they have built a custom kernel
anyway.
Apart from this, the solution is working fine even in the VLAN
environment, and has saved us having to dedicate a physical ServerIron
switch port to them.
-- Clifton
--
Clifton Royston -- LavaNet Systems Architect -- [EMAIL PROTECTED]
"If you ride fast enough, the Specialist can't catch you."
"What's the Specialist?" Samantha says.
"The Specialist wears a hat," says the babysitter. "The hat makes noises."
She doesn't say anything else.
Kelly Link, _The Specialist's Hat_
From [EMAIL PROTECTED] Thu Jan 23 22:53:38 2003
From: [EMAIL PROTECTED] (jeffrey.arnold)
Date: Thu Jan 23 23:07:00 2003
Subject: [f-nsp] ServerIron config question - can this be done?
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
<[EMAIL PROTECTED]> <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
On Thu, 23 Jan 2003, Clifton Royston wrote:
:: We are running into some minor problems on their servers, because the
:: Linux kernel is insisting on proxy-arping for the virtual IP and
:: causing some ARP conflicts.
::
:: <http://www.linuxvirtualserver.org/docs/arp.html>
::
:: This is a Linux bug or serious misfeature IMHO, but there is a patch
:: the customer will apply for it as they have built a custom kernel
:: anyway.
::
I agree this is a horrible linux bug, and have yet to see a reasonable
argument why it has become the default behavior for loopback interfaces
in the 2.4 kernel. Anyone?
-jba
__
[EMAIL PROTECTED] :: analogue.networks.nyc :: http://analogue.net
