Tag Info

Hot answers tagged

10

OpenVPN doesn't support any kind of state sharing between two different daemon instances, so no, you can't have seamless failover. But, you can always configure your clients to handle a server failure gracefully. If this kind of redundancy meets your needs, you can achieve it by combining two features that OpenVPN does actually have: 1) automatically ...


6

No, carp requires three WAN IPs.


4

Are the machines able to ping each other over the external interface? Do you by any chance have another vhid 1 on your external network?


4

Does this assume that the "DSL Router" at the top of the drawing has two physical RJ45 jacks, or a single one that you're splitting via a switch? In the referenced diagram, you should only have one RJ11 for a DSL connection. The authors of the diagram have assumed that the DSL router has two physical ethernet RJ45 ports which are on the same subnet. ...


4

CARP will handle moving the IP from box A to box B (and optionally back again), however it won't do anything else -- If you're absolutely sure you don't need to do anything else (like change a DB from slave to master, Start or Stop some service, etc.) CARP should be adequate for your needs.


3

Although I've played with FT for ages now I've yet to find an actual use for it to be honest. Not only is the single vCPU thing a pain but the shear amount of network traffic generated is astonishing. You really do end up using most of a GigE link just for FT, so you end up throwing your vMotion traffic over another vswitch - making the whole thing quite a ...


2

CARP is really designed to let your hosts detect if the other host's network NIC is offline (which is often the case when the physical host is down, but not necessarily) The advantage of using CARP over VMWare FT would be if VMWare FT behaves differently when the NIC has failed. If you're comfortable with running your firewall on a VM then the only concern ...


2

I'm assuming you're talking about the advertisment packets between ucarp hosts. I haven't used ucarp, but a quick examination of the source makes me think that it's listening via libpcap such that it will be effectively immune to filtering by iptables. The carp_send_ad() function in carp.c seems to be where the advertisment packets are sourced from. I'm ...


2

In addition to what Chris S mentioned, which I agree with, I would also go with CARP because what happens when you're upgrading a firewall or doing any other kind of maintenance requiring a reboot or power down? With FT, you're down while it reboots, with CARP, it's completely transparent. Or if you need to change something on the VM that can't be done while ...


2

Without losing the current session? Anyways you could always use ifstated(8) to sense the a CARP demotion and start the OpenVPN server. Actually I don't know if there would be any issues with the MASTER and SLAVE running at the same time the OpenVPN server.


2

CARP is like VRRP, HSRP and most other routing redundancy protocols, you must have 3 static IPs in the same subnet. That may change at some point in the future, but it's true for the time being.


1

i would try running tcpdump on your gateway 172.16.1.254 (or "debugs" on cisco routers), to make sure traffic is actually getting out correctly, and not being blackholed via route loop or otherwise. i dont think it would be the firewall rules, but you can enable debugging on each rule to make sure and tail -f logs. if a rule is blocking, it will show in logs ...


1

I don't see the ucarp clusters (which i inherited) ever switching back by themselves. They are indeed set to preempt=no.


1

For UCARP, I think the trick is to start it in "neutral" mode using the --neutral flag, so that it doesn't automatically assume the master role or try anything upon start. Looking at one of my setups, here's the full command line. Perhaps --neutral applies because we have upscripts and downscripts applied at startup and shutdown, but it's worth a try. ...


1

You've got the right idea - Set up replication between the two hosts (on non-CARP IPs) and point your clients at the CARP virtual IP. Debug your LDAP replication (syncrepl) first obviously :-) There are other ways to handle this with load balancing (using pf), but that requires more hardware in order to maintain redundancy.


1

Looks like the advskew on the primary is saying that (0|primary) should be MASTER versus (20|secondary) should be BACKUP. Implicating(?) a lack of communications between the two carp0 interfaces. You may already have checked these, but some general diagnostics procedures on OpenBSD. Configuration Files Verify Carp Protocol is allowed in and out of the two ...



Only top voted, non community-wiki answers of a minimum length are eligible