Re: preempt not working, master not receiving vrrp advertisements

Hi all,

The procfs settings suggested by Quentin solved my vmac problem.
Implicit in the suggestion is that arp_filter for the vmac interface = 0.
My system default is arp_filter = 1 and seems to be the root of all my
trouble.

Now traffic is flowing smoothly between the VRRP master and the remote
hosts.
But I got a second question.
The master only uses the virtual mac addr to send out advertisements and
arp packets.
Other data packets for the virtual IP addr come in the vmac interface but
always go out the physical interface.

Is this normal, expected behavior?
Some of the concerns:

   1. The arp tables of the neighbours have virtual MAC addr associated
   with the virtual IP addr. But packets from the master have src IP = virtual
   IP addr, sent from a MAC addr different from the neighbours' arp tables.
   Could this be considered by some iptables rule as man-in-the-middle attack?
   2. Could this asymmetry confuse some routers and cause them to associate
   the virtual IP addr with the physical mac addr? It would be bad for our
   system because the physical interface and the virtual interface have
   different sets of firewall rules.
   3. Should I put the physical IP addr in a different network range from
   the virtual IP addr? See below.

My physical IP addr (10.0.0.10) and my virtual IP addr (10.0.0.1) are in
the same segment,
resulting in a dual route situation:

#ip route list
10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.10
10.0.0.1 dev eth0v80  proto kernel  scope link  src 10.0.0.1

I think the dual route is the origin of the headaches in getting macvlan to
work properly in keepalived.
Do people put the physical IP addr in a different network segment to avoid
the routing issue?
In my example, it would be like assigning 192.168.0.x as the physical IP
addrs to my vrrp routers. 10.0.0.1 (the virtual IP) is in the correct
segment expected by remote communicating hosts.

Cheers,
Sial

On Fri, Jul 1, 2016 at 1:40 AM, Quentin Armitage <[email protected]>
wrote:

> The difference between when the lower priority node is master and backup
> is that when it is master it has the virtual IP addresses configured,
> whereas when it is backup it doesn't. That suggests it may be something to
> do with the configuration of the interfaces. Version 1.2.22 sets the
> necessary configuration on both the physical interface and the vmac
> interface, so that is probably the next thing to try (if you do try ver
> 1.2.22 I would suggest getting the latest update from
> www.githib.com/acassen/keepalived since that has some extra fixes).
>
> The settings that needs to be set are:
> On the vmac interface:
>   arp_ignore = 1
>   accept_local = 1
>   rp_filter = 0
> and on the physical interface:
>   arp_ignore = 1
>   arp_filter = 1
>
> The tricky bit is setting the parameters on the vmac interface, since that
> has to be done after the interface is created, so needs to be done in a
> script called via a notify_master configuration entry.
>
> I hope that helps,
>
> Quentin
>

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel