Re: Isolating VRRP traffic

On Wed, 2017-05-24 at 11:02 +0200, Roman Serbski wrote:
> Hello,
> 
> Sorry if this is the wrong mailing list to ask (can't find any users- group).
> 
> Three VMs running Debian Jessie with keepalived 1.2.13-1 installed
> from packages (VRRP states are MASTER/BACKUP/BACKUP). Each VM has two
> NICs (eth0 and eth1) with eth0 used for data traffic, and eth1 used
> for VRRP advertisements only. The VLAN where eth1 is connected to is
> isolated and non-routable.
> 
> Do you think this is a good idea to split it in such way? I understood
> that 'auth_type PASS' doesn't really contribute to the security, and
> for 'auth_type AH' to work I need to have groups of two?
> 
> Thanks in advance. My config is below (just in case).
> 
> global_defs {
>         lvs_id QSRV01
> }
> 
> vrrp_sync_group SyncGroup01 {
>         group {
>                 QTEST
>         }
> }
> 
> vrrp_script check_haproxy {
>         script "/bin/pidof haproxy"
>         interval 2
> }
> 
> vrrp_instance QTEST {
>         state MASTER
>         interface eth1
>         virtual_router_id 10
>         priority 150
>         advert_int 1
>         mcast_src_ip 172.16.10.12
>         authentication {
>                 auth_type PASS
>                 auth_pass xxx
>         }
>         virtual_ipaddress {
>                 10.9.12.12 dev eth0
>         }
>         track_script {
>                 check_haproxy
>         }
> }


I'll start with a few comments on your configuration:
1. There is no keyword lvs_id
2. virtual_router_id should be router_id
3. There is no point in having a sync group with only 1 member

You mention that auth_type PASS doesn't realy contribute to security.
In 2004 authentication was removed altogether from the VRRP RFC as not
providing any benefit. keepalived still supports authentication, and
you can use AH authentication with more than 2 vrrp instances if you
want to.

I think there is one disadvantage of running the VRRP protocol over a
different interface from the interface you want to have the virtual IP
address. If eth0 were to go down on the master, it would still continue
to be master but the virtual IP address would no longer be usable. If
you run VRRP over the same interface on which the virtual IP address is
configured, which is the standard way of running it, then you won't
have that problem.

The version of keepalived that you are using is extremely old and there
have been many bug fixes and enhancements since, so it might be worth
upgrading to a more recent version.

Quentin Armitage

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel