Source IP in TCP header for MCSG Packages

[Jim Turner]

Howdy Y'all,

This thread:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=149302
pretty-well answers my following question, but I'm hoping for some clarification from our forums gurus.

I've got a ServiceGuard package with its own IP address. Nothing unusual there. This package starts a sockets-based process that must communicate through two firewalls (ours and the vendor's). Will the source IP in the TCP header be written as the package IP or the node IP? The thread cited above leads me to believe it will probably be the node IP. As a result, the source IP will be subject to change depending on which node the package is running on.

Does anyone know of a way to make TCP/IP traffic from my process started by ServiceGuard's package use the package IP address as the source IP (which will stay the same regardless of which node is running the package) instead of the node IP?

Thanks,
Jim

[Sridhar Bhaskarla]

Hi Jim,

If your application's 'port' is listening on the floating IP address instead '*.', then the source IP will be the floating IP.

However, I advise our appadmins to configure the firewalls for "stationary IP of the primary, Stationary IP of the secondary and the floating IP" to ensure that nothing breaks.

-Sri

[Prashant Zanwar_4]

Hi,
This is really a application level talk. The way application is designed to run in your cluster environment. You will face major problem if you use Node IP in your application to talk to consequent application running on ohter node or vice versa. Application code should be changed to use the package IP, so that irrespective of where the package is running you will be able to failover and communicate likewise.
Although the IP is floating or virtual in some means, it's main purpose to keep the access to the services running. And it is bind to one of the NIC's whereever the package is running.
So it is your applicaition which should support running in Cluster environment.
Hope I have understood the question correctly. Let me know if I am wrong.

Thanks
Prashant

[Prashant Zanwar_4]

melvyn burnard has answered it perfectly I believe. Firewall configuration to allow floating IP, I havent come across much. But there shall be way definately. Because I have worked in a big environment whrere users use to access the services from remote or countrywide. In this case it becomes necessary that users are not aware of any node name access structure.

Hope it helps
Prashant

[melvyn burnard · Accepted solution]

Unless you have compiled your application to "bind" to the floating ip, then the source ip addres will be the node stationary address.
There is a section in the Managing Serviceguard manula at http://docs.hp.com/hpux/pdf/B3936-90079.pdf
See page 371

[Sundar_7]

Jim,

As noted above, the outgoing traffic will be using the stationary IP of the node, not the virtual/floating Package IP address.

One way to get around is to write your application to bind() to the virtual IP address before creating sockets.

- Sundar.

[rick jones]

As the question is already answered - the appication should be calling bind() - I'll just point-out one nit. There is no IP address in a TCP header. IP addresses are in IP headers. The "address" in a TCP header would be the combination of source and destination port numbers.

[Jim Turner]

We decided to have the firewall folks allow all IPs from nodes and packages for now.