Keepalived + VRRP Routing problem

vad3r · Posted: Thu Feb 08, 2007 4:23 pm Post subject: Keepalived + VRRP Routing problem

Hi all,

i just installed a router/firewall cluster to handle our complete internal traffic. The two nodes are configured as a active/active routing cluster
and share the responsibility for a couple of VLAN's.

Host-A responsible for VLAN's: 10 12 14 16 18 20
Host-B responsible for VLAN's: 11 13 15 17 19

The whole failover works quite well but there's still a problem to be solved. Our Monitoring system needs to monitor the GW addresses for all the
VLANS. If the monitoring hosts has it's gateway on Host-A it can't ping any of the VIP's on the other node. It even can't ping the other cluster node's
real IP.
All the hosts that reside on the remote network can be reached without any problem. I think this is because the gateway for the monitoring host can access
the target host directly and has no problem transporting the answer to the monitoring host.

The only routes added to the system are:

- the network routes (for every nic)
- some more network rules to remote locations

Any suggestions?

Thanks in advance

Daniel

think4urs11

If i understood correct you have one dedicated machine which monitors the both vrrp members and all their ip addresses, both physical and virtual?
So this machine (lets say in vlan 10) should have the vip for vlan10 as default gw, not one of the members ip nor should dedicated routes be needed.
With that it should be possible to monitor all virtual ips in all vlans as all member ips for every vlan.
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

vad3r · Posted: Fri Feb 09, 2007 10:11 am Post subject:

Thanks for your answer. The default gw for the monitoring server is the VRRP address. None of the "real" addresses is used.

The strange problem is that the monitoring can reach all the host in all VLAN's. It just can't reach all the VRRP Adresses. It has to be some kind of routing issue on the routers.

I fixed the problem temporarily by making one of the routers the master for all addresses. Now the problem disappeared and the monitoring host can reach all hosts + the VRRP addresses but that's not the way it should be. We need the ability to share the traffic between the nodes.