1

We have some requirements which explained here. We tried to satisfy them without any success as described. Here is the brief information:

Here are requirements:

  1. High Availability
  2. Load Balancing

Current Configuration:

Server #1: one static (real) IP for each 10.17.243.11 Server #2: one static (real) IP for each 10.17.243.12 Cluster (virtual and shared among all servers) IP: 10.17.243.15

I tried to use CLUSTERIP to have the cluster IP by the following:

on the server #1
iptables -I INPUT -i eth0 -d 10.17.243.15 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:5E:00:00:20 --total-nodes 2 --local-node 1

on the server #2  
iptables -I INPUT -i eth0 -d 10.17.243.15 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:5E:00:00:20 --total-nodes 2 --local-node 2  

When we try to ping 10.17.243.15 there is no reply. And the web service (tomcat on port 8080) is not accessible either. However we managed to get the packets on both servers by using TCPDUMP.

Some useful information:
iptable roules (iptables -L -n -v):

Chain INPUT (policy ACCEPT 21775 packets, 1470K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CLUSTERIP  all  --  eth0   *       0.0.0.0/0            10.17.243.15         CLUSTERIP hashmode=sourceip clustermac=01:00:5E:00:00:20 total_nodes=2 local_node=1 hash_init=0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 14078 packets, 44M bytes)
 pkts bytes target     prot opt in     out     source               destination

Log messages :

... kernel: [    7.329017] e1000e: eth3 NIC Link is Up 100 Mbps Full Duplex, Flow Control: None
... kernel: [    7.329133] e1000e 0000:05:00.0: eth3: 10/100 speed: disabling TSO
... kernel: [    7.329567] ADDRCONF(NETDEV_CHANGE): eth3: link becomes ready
... kernel: [   71.333285] ip_tables: (C) 2000-2006 Netfilter Core Team
... kernel: [   71.341804] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
... kernel: [   71.343168] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
... kernel: [  108.456043] device eth0 entered promiscuous mode
... kernel: [  112.678859] device eth0 left promiscuous mode
... kernel: [  117.916050] device eth0 entered promiscuous mode
... kernel: [  140.168848] device eth0 left promiscuous mode

TCPDUMP while pinging:

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:11:55.335528 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    10.17.243.1 >     10.17.243.15: ICMP echo request, id 16162, seq 2390, length 64
12:11:56.335778 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)              
    10.17.243.1  >     10.17.243.15: ICMP echo request, id 16162, seq 2391, length 64
12:11:57.336010 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    10.17.243.1  >     10.17.243.15: ICMP echo request, id 16162, seq 2392, length 64
12:11:58.336287 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 
    10.17.243.1  >     10.17.243.15: ICMP echo request, id 16162, seq 2393, length 64

ARP Cache:

Address                  HWtype  HWaddress           Flags Mask            Iface
10.17.243.12             ether   00:90:0B:24:CA:58   C                     ETH01
10.17.243.11             ether   00:90:0B:24:CA:68   C                     ETH01
10.17.243.15                     (incomplete)                              ETH01

And there is no ping reply as I said. Does anyone know which part I missed?
Thanks in advance.

UPDATE: To resolve "incomplete" HWaddress for the cluster IP in ARP cache we added manually the entry.

1

Although I followed all instructions on the web which are identical more or less, but apparently there is one missing step. I'm not sure it is because of my system (including software or hardware specifications). Anyway based of the instruction I found on the web by Michael Schwartzkopff (Linxu Magazine), it is necessary to run the following on both machines (at least in my case):

ip addr add 10.17.243.15/24 dev eth0

If you follow the instruction on the web + that extra step, there would be no "incomplete" entry on ARP cache and everything works fine.

Thanks Michael Schwartzkopff :)

0

We want to do the same things as you : have a virtual IP which is assigned to both servers.

We are running on CentOS 7.

So we do this :

  1. Cluster01 : 10.10.10.11
  2. Cluster02 : 10.10.10.12
  3. VirtualIP : 10.10.10.10

On Cluster 01 :

iptables -I INPUT -i ens160 -d 10.10.10.10 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:5E:00:00:20 --total-nodes 2 --local-node 1
ip addr add 10.10.10.10/24 dev ens160

On Cluster 02 :

iptables -I INPUT -d 10.66.66.10 -i ens160  -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:5E:00:00:20 --total-nodes 2 --local-node 2
ip addr add 10.10.10.10/24 dev ens160

We are able to ping the VirtualIP (but only from Cluster01 & Cluster02). We add manually the HW address on arp cache :

arp -i ens160 -s 10.10.10.10 01:00:5E:00:00:20 


# iptables -L -n -v

    Chain INPUT (policy ACCEPT 2221 packets, 151K bytes)
     pkts bytes target     prot opt in     out     source               destination
        0     0 CLUSTERIP  all  --  ens160 *       0.0.0.0/0            10.10.10.10          CLUSTERIP hashmode=sourceip clustermac=01:00:5E:00:00:20 total_nodes=2 local_node=2 hash_init=0

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination

    Chain OUTPUT (policy ACCEPT 1536 packets, 1412K bytes)
     pkts bytes target     prot opt in     out     source               destination

On both servers we have the file /proc/net/ipt_CLUSTERIP/10.10.10.10

From my workstation, I can access to my web page on Cluster01 & Cluster02 but on VirtualIP it doesn't work...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.