VRRP packets with duplicate AH sequence number
Aleksey <[email protected]> Fri, 24 Mar 2017 12:49:13 +0200
| Newsgroups | gmane.linux.keepalived.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi guys!
I have strange behavior of my keepalived running only as VRRP daemon.
Sometimes it sends advertisements with the same sequence number and then
errors on log appear:
11:03:44.993382 IP 10.1.64.156 > 224.0.0.18:
AH(spi=0x0a01409c,seq=0x10f9e47): VRRPv2, Advertisement, vrid 7, prio
200, authtype ah, intvl 1s, length 20
11:03:44.993393 IP 10.1.64.156 > 224.0.0.18:
AH(spi=0x0a01409c,seq=0x10f9e47): VRRPv2, Advertisement, vrid 7, prio
200, authtype ah, intvl 1s, length 20
11:03:44.993414 IP 10.1.64.156 > 224.0.0.18:
AH(spi=0x0a01409c,seq=0x10f9e47): VRRPv2, Advertisement, vrid 7, prio
200, authtype ah, intvl 1s, length 20
11:03:44.993422 IP 10.1.64.156 > 224.0.0.18:
AH(spi=0x0a01409c,seq=0x10f9e47): VRRPv2, Advertisement, vrid 7, prio
200, authtype ah, intvl 1s, length 20
Mar 24 11:03:44 Zero-white Keepalived_vrrp[17338]: bogus VRRP packet
received on eth0 !!!
Mar 24 11:03:44 Zero-white Keepalived_vrrp[17338]: VRRP_Instance(LAN)
Dropping received VRRP packet...
Mar 24 11:03:44 Zero-white Keepalived_vrrp[17338]: VRRP_Instance(LAN)
IPSEC-AH : sequence number 17800775 already proceeded. Packet dropped.
Local(17800812)
Mar 24 11:03:44 Zero-white Keepalived_vrrp[17338]: bogus VRRP packet
received on eth0 !!!
Mar 24 11:03:44 Zero-white Keepalived_vrrp[17338]: VRRP_Instance(LAN)
Dropping received VRRP packet...
Mar 24 11:03:44 Zero-white Keepalived_vrrp[17338]: VRRP_Instance(LAN)
IPSEC-AH : sequence number 17800775 already proceeded. Packet dropped.
Local(17800813)
These are just samples, so don't mind the "Local" sequence number stated
in logs - I've got plenty of them. Though number stated on tcpdump and
"already processed number" in logs matches.
The problem is floating - but happens frequently (couple of times per
day). I can't figure out what triggers it and why does keepalived
consider it's own sent packets as received (I can see them received on
my box in iptables raw table when doing trace - however tcpdump doesn't
show them as received).
I've noticed this problem a couple of weeks ago, was nothing similar
before. If to talk about what was done with the box recently - I
installed openvpn server on it. Later I tried searching the web and
found some info that keepalived is not really capable of working with
openvpn on one box cause it doesn't like hotplugging interfaces which
openvpn does (tun interfaces). However even if I stop openvpn server the
problem still persists. Is this really so and openvpn can't be used on
the same box with keepalived?
I'm using keepalived 1.2.13 on Debian 7 with 3.16 kernel from backports.
Openvpn version is 2.3.2 (if it is important).
My keepalived is below:
vrrp_instance LAN {
state BACKUP
interface eth0
virtual_router_id 7
priority 200
advert_int 1
garp_master_delay 1
#nopreempt
preempt
preempt_delay 2
notify_fault "/etc/keepalived/gw_vrrp_master_down"
notify_backup "/etc/keepalived/gw_vrrp_master_down"
notify_master "/etc/keepalived/gw_vrrp_master_up"
authentication {
auth_type AH
auth_pass 12345
}
virtual_ipaddress {
10.1.64.155
}
}
Any help is appreciated. Thanks in advance.
--
With kind regards,
Aleksey
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot