FTP via package IP

[chindi]

Hi guys,

We are using 11iv3 servers , SG 11.20 , when we ftp some file from our server to target its going via physical IP , Our network guy saying can you change it such that the traffic must go via package IP ?

Is it possible in HPUX ?

If yes then how can we achieve it ?

P.S. This thread has been moved from Networking to HP-UX > Serviceguard. - Hp Forum Moderator

[Bill Hassell]

For Service Guard nodes, there is a local IP address that is reserved for maintenance only. The package IP is tied to the package and remains unchanged regardless of which node in the cluster is running the package. Always use the package IP address for package data. The node IP addresses should be used only for cluster changes, never for package data.

[chindi]

Hi Bill,

 I got solution for this reqmnt in one of forum , but its not working for us.

You are initiating a FTP session from a cluster node running the package. You want the target to think the FTP session is coming from the "package" IP instead of the permenant IP on the node. Correct?

What we did to work around this was to add a route specific to the target system.

/usr/sbin/route add host target-ip gateway-ip

The target is the system you want to connect to, the gateway would be your package IP. This made it appear to the target system that the connection came from the package IP and not the permenant IP.

Our ftp to destination server gets completely blocked.

[Bill Hassell · Accepted solution]

OK. The FTP session must be initiated by the package. This is a case where the program (FTP) needs to call bind() in order to associate the source as a specific IP address, but standard ftp doesn't have this option. This has been discussed a lot but I haven't seen an official HP Service Guard solution yet. The best discussion is in the gray paper by Olivier S. Massé a few years ago:

Understanding HP-UX Routing gray paper

However, the best solution would be to use scp/sftp as it has the BindAddress option. scp/sftp also encrypts the data which is an important security feature, one that ftp does not have:

sftp -o BindAddress=12.34.56 user_name@target_IP