LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: LVS-DR, Cisco switch, and ARPtables

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: LVS-DR, Cisco switch, and ARPtables
Cc: Brett Simpson <Simpsonb@xxxxxxxxxxxxxxxxxxxxxx>
From: Graham Purcocks <grahamp@xxxxxxxxxxxxx>
Date: Fri, 03 Dec 2004 10:04:05 +0000
Yes noarp is simple to use, and you difficult to get wrong. Why fight what has already been fixed?

You need noarp 1.x for RHES3 which is a 2.4 kernel.

Eric - Linux wrote:
i´m have instaled the RedHat Advanced Server 3 and try to use the arptables
for three monthys and dont resolved.

More with noarp my problems accomplished

good luck!


----- Original Message ----- From: "Brett Simpson" <Simpsonb@xxxxxxxxxxxxxxxxxxxxxx>
To: <linux@xxxxxxxxxx>; <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Sent: Thursday, December 02, 2004 4:24 PM
Subject: Re: LVS-DR, Cisco switch, and ARPtables


I tried the noarp module but it won't compile on my RHEL ES 3 servers.
Besides ArpTables comes with RHEL ES 3.

Thanks,
Brett


linux@xxxxxxxxxx 12/2/2004 2:17:36 PM >>>

why dont use the noarp in direct servers?

----- Original Message ----- From: "Brett Simpson" <Simpsonb@xxxxxxxxxxxxxxxxxxxxxx>
To: <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Sent: Thursday, December 02, 2004 3:22 PM
Subject: Re: LVS-DR, Cisco switch, and ARPtables


Or can my director do LVS Localnode and Direct route?


simpsonb@xxxxxxxxxxxxxxxxxxxxxx 12/2/2004 7:25:48 AM >>>

On Wednesday 01 December 2004 20:22, Con Tassios wrote:

I've used the following arptables configuration on RHEL v.3 real servers

in

a LVS-DR configuration to handle the ARP problem and allow hosts on the
same subnet to connect to the VIP.

arptables -F
arptables -A IN -d $VIP -j DROP
arptables -A OUT -s $VIP -j mangle --mangle-ip-s $RIP
service arptables_jf save
chkconfig arptables_jf on



I see you have your arptables OUT entry different than mine. I went ahead
and
changed mine to match yours on both Real Servers. I'm assuming the $RIP is
the IP local to the server?
This worked on all of my subnets until a couple hours later. At that time I
could only ping 172.27.21.210 from a client on the 172.27.21.x subnet. Any
other subnet wouldn't ping ok until I removed, re-added, and sent a
Gratuitous arp for 172.27.21.210 on my LVS Director.

Configuration details:
172.27.21.210 - LVS Director IP on Proxy1
172.27.21.211 - Proxy1
172.27.21.212 - Proxy2

[root@proxy1 root]# arptables -L -n
Chain IN (policy ACCEPT)
target     source-ip            destination-ip       source-hw
destination-hw     hlen   op         hrd        pro
DROP       0.0.0.0/0            172.27.21.210        00/00
00/00
any    0000/0000  0000/0000  0000/0000

Chain OUT (policy ACCEPT)
target     source-ip            destination-ip       source-hw
destination-hw     hlen   op         hrd        pro
mangle     172.27.21.210        0.0.0.0/0            00/00
00/00
any    0000/0000  0000/0000  0000/0000 --mangle-ip-s 172.27.21.211

[root@proxy2 root]# arptables -L -n
Chain IN (policy ACCEPT)
target     source-ip            destination-ip       source-hw
destination-hw     hlen   op         hrd        pro
DROP       0.0.0.0/0            172.27.21.210        00/00
00/00
any    0000/0000  0000/0000  0000/0000

Chain OUT (policy ACCEPT)
target     source-ip            destination-ip       source-hw
destination-hw     hlen   op         hrd        pro
mangle     172.27.21.210        0.0.0.0/0            00/00
00/00
any    0000/0000  0000/0000  0000/0000 --mangle-ip-s 172.27.21.212

[root@proxy1 root]# ipvsadm -L -n
IP Virtual Server version 1.0.8 (size=65536)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.27.21.210:0 dh persistent 3600
  -> 172.27.21.212:0              Route   1      0          0
  -> 172.27.21.211:0              Local   1      0          0

[root@proxy2 root]# ipvsadm -L -n
IP Virtual Server version 1.0.8 (size=65536)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.27.21.210:0 dh persistent 3600
  -> 172.27.21.212:0              Local   1      0          1
  -> 172.27.21.211:0              Route   1      0          0


Brett
_______________________________________________
LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://www.in-addr.de/mailman/listinfo/lvs-users

_______________________________________________
LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://www.in-addr.de/mailman/listinfo/lvs-users

_______________________________________________
LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://www.in-addr.de/mailman/listinfo/lvs-users

_______________________________________________
LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://www.in-addr.de/mailman/listinfo/lvs-users




<Prev in Thread] Current Thread [Next in Thread>