Re: VMAC problems

ITS WORKING!!!

This is what I needed to do:

sysctl -w net.ipv4.conf.all.rp_filter=0
sysctl -w net.ipv4.conf.eth1.rp_filter=0
sysctl -w net.ipv4.conf.vrrp/20.rp_filter=0
sysctl -w net.ipv4.conf.all.arp_ignore=1

"eth1" was my physical interface. "vrrp/20" (vrrp.20) was my virtual
interface. I had to make the rp_filter change at the "all" level before
it had any impact on any of the other interfaces. Apparently they are
doing something like taking the maximum value of "all" and the
interface's value. I'm not sure that the rp_filter had to be '0' at the
physical interface since the virtual IP address falls within the range
that is attached to the physical interface. Since all of the interfaces
were being created with rp_filter=1, because
net.ipv4.conf.default.rp_filter=1, I had to also set it to 0 on the
virtual interface.

"arp_ignore" needs to be set to 1 on the physical and virtual
interfaces, or on all, in order to make sure the virtual mac address
gets sent. This was especially true in my case because I am running
multiple VMACs on a single physical NIC. If you only had a single VIP
then arp_ignore only needs to be set on the physical interface.

I did not need any of the other sysctls that were described in
"doc/NOTE_vrrp_vmac.txt".

On a Debian test system I also had to enable promiscuous mode on the
physical adapter. This was not necessary on the Gentoo system ... but I
think that may be a driver / hardware difference. If it doesn't work
throwing the physical adapter into promiscuous mode may get things going.

I was also not able to get the macvlan driver to work in all cases via
WiFi. But I don't believe this has much impact on this audience.

THX - Jon


Jon Foster wrote:
> "rp_filter" didn't help me either. But then logging martians didn't log
> anything. We are setting up a Gentoo system with kernel v3.12.21 to see
> if it improves things. I will post my results here.
>
> THX - Jon
>
> Juan Pablo Lorier wrote:
>   
>> Hi Ranjith,
>>
>> In my case, rp_filter does not change anything. I'm going to try it on
>> centos 7 now that it's out, but this can take several days before I can
>> set the vm for testing.
>> What I can tell is that I either get the reply with the nic mac address
>> or don't get any reply (all.arp_ignore=1) but I can see the who has
>> comming from the net by using tcpdump (with all.arp_ignore=0):
>>
>> [...]
>>   
>>     
>
>   

-- 
Sent from my Debian Linux laptop -- http://www.debian.org/intro/about

Jon Foster
JF Possibilities, Inc.
[email protected]
541-410-2760
Making computers work for you!

------------------------------------------------------------------------------
Infragistics Professional
Build stunning WinForms apps today!
Reboot your WinForms applications with our WinForms controls. 
Build a bridge from your legacy apps to the future.
http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel