Re: Multi-active condition with AH authentication

On Fri, Sep 11, 2015 at 10:13:41AM +0300, Aleksey wrote:
> Hi guys!
> 

Hi,

> I'm using keepalived 1.2.13 on debian 7.8 (3.16.7 kernel from backports 
> is used) as a VRRP solution. So the cluster consists of two nodes, one 
> VRRP instance. Here are the configs from active:
> 
> vrrp_instance LAN {
> state MASTER
>


I think best practice is that both nodes should have state BACKUP in the configfiles,
and let VRRP figure the MASTER on it's own per the configured priorities. 

See if that helps.

-- Pasi


> interface eth0
> virtual_router_id 7
> priotity 200
> advert_int 2
> garp_master_delay 1
> #nopreempt
> preempt
> preempt_delay 2
> notify_fault "/etc/keepalived/gw_vrrp_master_down"
> notify_backup "/etc/keepalived/gw_vrrp_master_down"
> notify_master "/etc/keepalived/gw_vrrp_master_up"
> authentication {
>          auth_type AH
>          auth_pass 12345678
> }
> virtual_ipaddress {
>          10.1.64.155
> }
> }
> 
> 
> And here are from the standby:
> 
> vrrp_instance LAN {
> state BACKUP
> interface eth0
> virtual_router_id 7
> priority 100
> advert_int 1
> garp_master_delay 1
> nopreempt
> #preempt
> #preempt_delay 2
> notify_fault "/etc/keepalived/gw_vrrp_master_down"
> notify_backup "/etc/keepalived/gw_vrrp_master_down"
> notify_master "/etc/keepalived/gw_vrrp_master_up"
> authentication {
>          auth_type AH
>          auth_pass 12345678
> }
> virtual_ipaddress {
>          10.1.64.155
> }
> }
> 
> The problem is the following - after the failure of one of the nodes 
> (reboot/fail of switch between the nodes/etc) when it comes up again we 
> run into a condition when both nodes consider themselves as the MASTER. 
> And following logs are written on the one that is considered to be 
> MASTER:
> 
> Sep 11 08:51:26 office-02 Keepalived_vrrp[15800]: bogus VRRP packet 
> received on eth0 !!!
> Sep 11 08:51:26 office-02 Keepalived_vrrp[15800]: VRRP_Instance(LAN) 
> Dropping received VRRP packet...
> Sep 11 08:51:27 office-02 Keepalived_vrrp[15800]: VRRP_Instance(LAN) 
> IPSEC-AH : sequence number 944232 already proceeded. Packet dropped. 
> Local(945699)
> 
> And there are a lot of similar messages generated. I know that it is not 
> recommended at all to use AH authentication, but it would be an issue 
> for me if the password will be actually broadcasted in cleartext over my 
> LAN. So actually I need some kind of secure VRRP solution.
> 
> Any ideas? Probably, I've misconfigured something, or there is some kind 
> of workaround, etc.
> 
> Any help will be appreciated. Thanks in advance!
> 
> 
> -- 
> With kind regards,
> Aleksey
> 


------------------------------------------------------------------------------