User Tools

Site Tools


middleware:lb:foundry

Foundry Server Irons

CNS provides Middleware's load balancing solution, which is a pair of Foundry Server Iron 450s. (wsm6-ssl module)

Connecting

The Server Irons are accessible via SSH at isb-118-si-1.cns.vt.edu and isb-118-si-2.cns.vt.edu.
Access is provided via PID/Password.
Configuration changes are replicated between these two nodes, so it does not matter which one you connect to.

Useful Commands

For all these commands the id param is optional. If not provided all data is displayed and must be paged through.

  • To view binding between virtuals and reals:
    show server bind <mw.webapp-dev>
  • To view statistics for each virtual:
    show server virtual <mw.webapp-dev>
  • To view statistics for each real:
    show server real <mw.webapp-dev-1>
  • To view health check URL:
    show running-config
  • Health status for hosts with connection tracking:
    sh hc-track-group-state | i <ash.cas-dev-1>

Micro Subnets

In order for services to resolve the correct IP address of other services on the load balanced network each service must be quarantined into it's own subnet.
These micro subnets take the form of /29 networks:

Network IP Address
Gateway 198.82.163.1
Real 1 198.82.163.2
Real 2 198.82.163.3
MLX 198.82.163.4
VRRP 198.82.163.5
VRRP 198.82.163.6
Broadcast 198.82.163.7

The consequence of this design is that each service consumes 7 IP addresses.
It is possible to use both Reals, but take caution that these servers will not be able to correctly resolve the other's IP address.

Heath Checks

Layer 3

  • ICMP ping
    • Default interval is 2 seconds
    • 4 failures marks the real inactive

Layer 4

  • TCP 3 way handshake
    • no ack marks the real inactive
  • UDP data
    • no response keeps the real active
    • unreachable response marks the real inactive

Layer 7

  • HTTP
    • inspect status code, 404 marks the real inactive
  • DNS
  • FTP
  • LDAP
  • SMTP
  • SSL
  • Telnet

Inband Health Checks

these checks perform packet inspection

  • Off by default
  • Default is 21 failures to mark the real inactive
  • 1 success clears the counter

Pings to Virtuals Don't Respond

In our configuration there are 2 SLOBs. For each virtual, only one SLOB is active. If your ping goes to the inactive SLOB, you'll get no request. This is not indicative of a server being down.

Short version: It's because the load balancers are POS's.

middleware/lb/foundry.txt · Last modified: 2015/06/01 12:02 (external edit)