Same IP on two PCs?

[Ron Kinner]

We have an application where 20 pcs feed a remote pc with data. (20 pcs > router > firewall > remote pc) The 20 pcs have the ip address of the remote PC hard coded in a config file so changing the ip address is a pain. The remote pc has a back-up with which it is constantly replicating the database. When the main PC fails they would like for the back-up one to somehow accept the packets without changing the config files on the 20 PCs.

Service Guard has been suggested but aside from the cost issue, our hp admins are still in shock from the effort to upgrade the two machines from 10.20 to 11.0 and have flatly refused to even consider it.

My suggestion was to let the router do NAT but it's not our router and it's on the wrong side of the firewall so that got shot down. We are investigating whether the
firewall (Nokia Checkpoint if I remember what they mumbled) can do NAT and whether it can be controlled remotely (we are in FL and the firewall lives in CA) but in the meantime someone is suggesting that we:

"do what MC/ServiceGuard does, but manually:
configure the primary Server box with a logical IP address. With HP-UX11, you can have up to 256 (or so) virtual addresses per NIC. This is a one-line command that can be shell-scripted.
set the input boxes to use this new IP address (one time job)
When there is a need to change the Server, all we have to do is
disable the virtual IP address on the Primary server. If this machine is already down, then this step can be ignored
set the backup name server with the same virtual IP address.
Since the input boxes will be in a re-try mode, they will automatically connect to the new name server box."

My questions:

1. Does this make any sense?

2. If it does can this be done (the switchover) without rebooting?

3. What commands would you use to disable/enable these ip addresses?

4. Would the backup box automatically announce its new mac address to the firewall or would I have to clear the firewall's arp table?

Ron

[Steven Sim Kok Leong]

Hi,

Checkpoint FW-1 does NAT and supports load-balancing of servers behind the firewall. However, you want a standby-failover solution.

I had tested and implemented an in-house standby-failover solution for a pair of servers. What I did was to connect a cross-over cable between the primary and standby nodes. This requires a separate NIC interface (heartbeat interface) on both the primary and secondary nodes. Private IPs are used on these heartbeat interfaces.

At periodic intervals, a cron job on the standby server pings (you can use linkloop as well) the heartbeat interface of the primary node. When the primary node is down (ping failure), the cron job script follows up by activating the standby node's production interface (ifconfig plumb, ifconfig up the production ip address).

The arp table on the router have no problems recognising the new MAC address for the same IP. During peacetimes, the production network interface on the standby node is on deactivated mode. The heartbeat NICs on both nodes however have to be always on-line.

My in-house solution covers only a complete failure of the primary node such as server power failure. You can however enhance the cron script to take care of other forms of failure such as database services unavailable etc.

But my motto is to keep it simple so that it works robustly.

I have tested this solution over a number of failure conditions such as server power failure and server panic and it has worked for me so far.

Hope this helps. Regards.

Steven Sim Kok Leong

[Ron Kinner]

We don't need anything quite as elaborate since we can stand up to 4 hours of outage before things get critical. A little manual intervention is OK.

It looks like if they can live without the Ethernet connection to the firewall from the secondary box then it is just a matter of shutting down the primary and bringing up the secondary. (Both boxes have three NICs so it shouldn't be a problem unless there is something they are not telling me.) Apparently the arp table in the firewall will automatically pick up the new mac? Do I have that right?

Ron

[Steven Sim Kok Leong · Accepted solution]

Hi,

Yes, the firewall will update its arp table correctly with the new MAC address as long as the primary node has been disconnected (physical disconnection or via ifconfig down/unplumb).

Hope this helps. Regards.

Steven Sim Kok Leong