Re: "Only 254 prefered allowed"

Dear Theo,

thanks for your help. We changed the braces in the virtual interface
section.  How can I manage during first initialisation of the cluster, that
my strongest server is the one with the working virtual IP. 


Mit freundlichen Grüßen / Best regards

Jens Neumann



Jens Neumann
ZEDA GmbH & Co. KG , Dept. ZDT
Mühlenweg 17-37
D - 42270 Wuppertal
Tel.: +49 202   564-1175
Fax : +49 202   564-1384
Email: [email protected] <mailto:[email protected]> 


	-----Ursprüngliche Nachricht-----
	Von:	Theo E. Schlossnagle [SMTP:[email protected]]
	Gesendet am:	Mittwoch, 16. Juli 2003 16:33
	An:	[email protected]
	Betreff:	Re: [Wackamole-users] "Only 254 prefered allowed"

	Neumann, Jens wrote:
	> Dear Mailinglist,
	> 
	> we try to use spread/wackamole for one of our linux firewalls. We
managed to
	> make both addresses (internel and external of the firewall) to
change even
	> in case of only one interface beeing down, but we still have a
problem to
	> find the right prefered parameter.
	> We do have a class b network on the internal interface and a class
c network
	> on the outside interface . Our conf file looks like this:
	> 
	> Spread = 4803
	> SpreadRetryInterval = 5s
	> Group = wack1
	> Control = /var/run/wack.it
	> 
	> # Die bevorzugte Netzwerkkarte
	> Prefer {
	> 	eth0:172.16.253.49/16
	> 	eth1:193.17.4.200/24
	> }

	You are telling it to prefer every address in those spaces.  You
want /32 on 
	those.  the CIDR format above represents and IP block in all
configuration 
	directives except "VirtualInterface" where it represents the netmask
of the 
	desired interface.

	> # ALLE Virtuellen Interfaces   
	> VirtualInterfaces {
	> 	eth0:172.16.253.51/16
	>         eth1:193.17.4.202/24	
	> }

	There is a much easier way to do router configurations.  Specify
BOTH 
	interfaces in a single virtual interface:

	VirtualInterfaces {
	   {
	     eth0:172.16.253.51/16
	     eth1:193.17.4.202/24
	   }
	}

	Note the extra grouping braces.  This means that each machine will
treat the 
	pair of interfaces as a single virtual interface.  So, it is up
(both) or it 
	is down (both) and never half up, half down.

	This way you don't have the prefer setting -- which you don't want
in the case 
	of a firewall anyway.  If machine A goes down, you want machine B to
take 
	responsibility.  But when A comes back on, there is no reason to
steal back 
	the VIF from B.

	My router config is attached below:

	> Arp-Cache = 90s
	> 
	> # Beim Ausfall werden benachrichtigt
	> Notify {
	> 	# Let's notify our router:
	> 	eth0:172.16.1.1/32
	> 	eth0:172.16.253.50/32
	> 	eth0:172.16.253.44/32
	> 	eth0:195.145.130.24/32
	> 	eth1:193.17.4.201/32
	> 	Arp-cache
	> }
	> 
	> When we start the system we receive hundreds of errormessages
"Only 254
	> prefered allowed"  and no preferation works at all. We need to
define the
	> main firewall as prefered machone to use, because the cpu power on
this box
	> allows us to run an ids system in addition (snort) to the
firewalling
	> activity. In case of using the backup hardware we can't run the
ids, but all
	> other functions will continue to work and this is more than
acceptable for
	> us.
	> 
	> How is the right syntax for this prefered option or are there
other ways to
	> configure this prefered server scenario.
	> 
	> Thanks for your help.
	> 
	> 
	> Mit freundlichen Grüßen / Best regards
	> 
	> Jens Neumann
	> 
	> Jens Neumann
	> ZEDA GmbH & Co. KG , Dept. ZDT
	> Mühlenweg 17-37
	> D - 42270 Wuppertal
	> Email: [email protected] <mailto:[email protected]> 


	On our system, we have two machines on the network.  We give them
normal 
	unchanging IP addresses:
	Machine A: { 10.77.52.2, 66.77.52.2, 63.236.106.103}
	Machine B: { 10.77.52.3, 66.77.52.3, 63.236.106.104}

	These IPs never change.  But they wackamole cover the default routes
on each 
	network which are:
	Routes: { 10.77.52.1, 66.77.52.1, 63.236.106.102}


	wackmole.conf excerpt:

	Spread = 3777
	Group = wack1
	Control = /var/run/wack.it

	Prefer None
	VirtualInterfaces {
	         { fxp2:10.77.52.1/32 fxp1:66.77.52.1/32
fxp0:63.236.106.102/32 }
	}

	arp-cache = 90s
	mature = 5s


	-- 
	Theo Schlossnagle
	Principal Consultant
	OmniTI Computer Consulting, Inc. -- http://www.omniti.com/
	Phone:  +1 410 872 4910 x201     Fax:  +1 410 872 4911
	1024D/82844984/95FD 30F1 489E 4613 F22E  491A 7E88 364C 8284 4984
	2047R/33131B65/71 F7 95 64 49 76 5D BA  3D 90 B9 9F BE 27 24 E7


	_______________________________________________
	wackamole-users mailing list
	[email protected]
	http://lists.backhand.org/mailman/listinfo/wackamole-users