Hi
I've got a setup with haproxy and keepalived in front handling ~10 IP's.
When I was testing my setup (watching with tcpdump etc) I saw a strange behaviour, that I eventually found a solution to a long while ago.
A bit of googling today lead me to answer 2 (answered Mar 16 '11 at 6:12) on this page:
http://serverfault.com/questions/247472/arp-replies-contain-wrong-mac-address
For my setup to work correctly - ie. have the right NIC send out the Gratuitous ARP packet - I'm doing this in my iptables-based firewall script:
for interface in /proc/sys/net/ipv4/conf/*/arp_filter; do
/bin/echo "1" > ${interface}
done
The documentation for arp_filter says that 0 (the default value) "usually makes sense", but in multi-home and failover senarios it does not make sense at all!
Before reading the documentation I had never thought it possible that an arp request comming in through NIC 1 could be answered by NIC 2, but alas..
Before changing that I had a 1-in-6 (I've got 6 NIC's in this machine - 2 bundled for failover to 3 different networks) chance of the GARP-packet beeing sent out correctly and failover working as intended.
Oh, and I should mention that my firewall-script already did contain the mentioned rp_filter "fix".
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
/bin/echo "0" > ${interface}
done
Regards,
Jens Dueholm Christensen
Rambøll Survey IT
-----Original Message-----
From: Willy Tarreau [mailto:
[email protected]]
Sent: Saturday, March 24, 2012 9:51 PM
To: Esteban Torres Rodríguez
Cc:
haproxy@formilux.org
Subject: Re: haproxy with keepalived
On Wed, Mar 21, 2012 at 09:15:16AM +0100, Esteban Torres Rodríguez wrote:
> El día 21 de marzo de 2012 07:39, Willy Tarreau <
[email protected]> escribió:
> > On Mon, Mar 19, 2012 at 08:08:37PM +0100, Esteban Torres Rodríguez wrote:
> >> Maybe I have to ask this in the keepalived list.
> >>
> >> I have 2 servers configured in debian with keepalived and haproxy.
> >>
> >> Today I found that both servers are running.
> >
> > You mean that both servers own the VIP ?
>
> Of the 6 ip, 4 are answered by the master and 2 backup. it is dynamic.
> Ip are exchanged randomly.
Is this what you're observing or what you want ? Also, my concerns were about
finding some IPs at the two places at once, which fortunately is not the case !
> The server has 4 network cards. Is it of significance that has 3 virtual ip?
No, it should be unrelated. Are the NICs on the same network ? If so I wonder
what happens when keepalived receives its own packets via another NIC, maybe
it forces a re-election but I may be wrong, Alex would know that much better
than me !
> vrrp_script chk_haproxy {
> script "killall -0 haproxy"
> interval 2
> weight 2
> }
>
> vrrp_instance VI_1 {
> interface eth0
> state MASTER
> virtual_router_id 51
> priority 101
> virtual_ipaddress {
> 10.239.212.28
> 10.239.212.30
> 10.239.212.58
> 10.239.212.59
> 10.239.212.60
> 10.239.212.77
> }
> track_script {
> chk_haproxy
> }
> }
I really see nothing wrong here, nor anything which could explain how only
some of the addresses would be added to an interface !
Regards,
Willy