Firewall failure scenarios with keepalived
Adam Gibson <[email protected]>
| Newsgroups | gmane.linux.keepalived.devel |
|---|---|
| Message-ID | <CAGC9Es8kveEiyvEcE843Os6LPTnxiQ38oCYH4Tz1RcxUUnWRmA@mail.gmail.com> |
This scenario is a Linux firewal with 5 or 6 interfaces. No services are hosted on the firewalls. A failure of 1 or more interfaces on a single firewall should cause failover to the other. That is easy and works well. The problem is what if an interface goes down on all firewalls. Ideally at least one would stay MASTER. Currently they all go into FAIL mode. Instead of having a failure of 1 network segment with a single firewall setup, there would be a failure of all networks. I was hoping the VRRP protocol had state info so that the higher priority one would take over as a fail safe when all were in FAIL state. I see that is not the case though according to the RFCs. Another scenario is bringing up a single node because of maintenance or failure of the other node and 1 interface goes down. If the firewall is not receiving announcements from another master then I would like it to stay up as MASTER even if 1 interface is down. Currently it goes into FAIL state so all networks drop. Does anyone know a way to keep at least one firewall MASTER during these scenarios? ------------------------------------------------------------------------------ Dive into the World of Parallel Programming. The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ Keepalived-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/keepalived-devel