Layer 2 (VMAC) Network Redundancy Options for Linux

Question

With heartbeat and keepalived, the redundancy options I have always used work by moving a virtual IP address to a new machine (A layer 3 solution). The new machine sends out a gratuitous arp to tell machines on the network its MAC address is the new MAC for that IP.

Are there any current network redundancy options that use a virtual MAC address (layer 2) that gets moved between machines as well as the virtual IP? This would be useful for certain operating systems that don't understand GARP requests. I did find this keepalivd thread (from a Server Fault user it so happens) but it is back from 2005. Does anyone know the current state of virtual mac failover in Linux?

Answer 1

VRRP (RFC2338 for VRRPv2, RFC5798 for VRRPv3 which added IPv6 support) uses a virtual MAC address for each instance's virtual router, but still sends gratuitous ARP on a switchover.

While the keepalived VRRP implementation ignores this part of the specification and simply uses the interface MAC, VRRPd is capable of using the virtual MAC.

However, the concept of a virtual MAC doesn't play well with the Linux concept of a network interface; the VRRPd process must change the interface's MAC address to the virtual MAC when it takes over, which prevents running multiple VRRP virtual routers on a given interface.

Answer 2

Certainly HP's various 'VirtualConnect' products allow you to use a preconfigured MAC or range of MACs that you then map to a specific server as required. I've used this extensively and it works a treat, although we use it to pre-define new server's ethernet and FC environment before the physical server arrives on site but it could be used in the manner you describe.

This is entirely OS-gnostic btw, it's a virtual hardware thing, I'm not aware of a Linux-specific way of doing this other than via some form of scripting.

Answer 3

CARP uses a virtual MAC addreses (in a manner similar to VRRP, but not patent-encumbered) for each IP redundancy group. The master host in the group responds with the virtual MAC. When failover occurs the MAC doesn't change. I've used ucarp on Linux and been very pleased with it.

Edit:

This isn't going to help you (everybody, downvote away!). The Linux CARP implementation I linked to, ucarp, doesn't actually use a virtual MAC address. The original OpenBSD implementation does, but the Linux implementation does not. Everything worked as I wanted in my deployment so I never dug down into it (until this morning) to see that it isn't doing anything useful at layer 2 for Kyle's needs.

I am seeing some discussion on the Linux HA list about using ifconfig to assign virtual MAC addresses to interfaces at failover-time. That doesn't sound like a tremendously bad option, especially if you're using virtual hardware and can afford to "spend" a virtual NIC on it.