Virtual IP and Gratuitous ARP

[Dimitry_1]

Hi,

I am running

1. HP PortAggregation software on
1000Base-T FC/GigE Combo card.
2. and a veritas cluster which migrates VIP from host a to host b in case of a failover.

Host c is the server that is trying to connect to the VIP ( either
on host a or host b ). Host a and host b are on the same subnet, and host c is behind a CISCO
Pix firewall. So, the problem I am having is :
whenever the VIP fails over from a to b, PIX
arp caches the failed card on host a, and doesn't update arp cache for VIP to point to host b's card.
Only when arp cache is cleared on PIX, will the
communication between b and c get restored.

The question I have is two-fold :
1. Does the HP interface send a gratuitous ARP when a virtual ( no unplumb/plumb ) IP is brought up on it ?
2. Except lowering arp cache expiration timeout on PIX, can I force the host b's HP card to send the gratuitous arp when VIP fails over?

I would appreciate if someone can help.
Thanks.
-dimitry.

[Duncan Edmonstone]

I'm fairly sure in a Serviceguard cluster its Serviceguard that generates the gratuitous arp rather than just the networking software - I suspect it would be too presumptive for ifconfig to do this every time an interface is setup on it - thats probably why serviceguard uses its own command (cmmodnet) rather than ifconfig.

I would expect VCS to do the same - have you spoken to Veritas?

HTH

Duncan

[Dimitry_1]

Veritas uses a perl script which essentially uses ifconfig command to bring VIP up.
What I wanted to know if this is an expected networking behavior when VIP comes up to notify
others of it's existence.

On a side note, if nothing else works, I will have to write an c program to pick MAC up from a running machine and send broadcast ARP out every time the failover happens as a part of a
pre-exec, so to speak.

Thanks.
Dimitry

[Ron Kinner]

It's odd that they don't assign a virtual MAC to go with the virtual IP address. That's what they do with HSRP and the like just to prevent problems like you are seeing.

Any chance you could manually do it by playing with the hpbtlanconf file?

Ron

[Xianjie Zhang]

Normally "ifconfig lanX IP_ADDR" will trigger one gratuitous ARP message. This message may be lost.
You can aslo add a "ifconfig lanX down" and "ifconfig lanX up" pair to force a ARP message.

Regards,

Xianjie

[rick jones]

I believe that indeed gratuitous ARPs may be sent. You can check that easily enough with a packet trace using tcpdump or the like on the HP-UX systems where the VIP is being migrated.

I have dimm recollections of Cisco kit having very long ARP cache refresh times, and an unwillingness to update its ARP cache on the reciept of any-old ARP message. You might look into any ARP settings for the PIX.

[rick jones]

I was feeling bored, so installed tcpdump from the HP Internet Express bits on an 11.23 system. While tcpdump was running against an interface (lan3) I did a pair of ifconfigs:

# ifconfig lan3 192.168.4.5
# ifconfig lan3:1 192.168.5.6

and this is what appeared in the tcpdump trace:

16:59:39.641958 arp who-has 192.168.4.5 (Broadcast) tell 192.168.4.5
16:59:49.445548 arp who-has 192.168.5.6 (Broadcast) tell 192.168.5.6

I then did an ifconfig lan3 0.0.0.0 and another ifconfig lan3:1:
# ifconfig lan3:1 0.0.0.0
# ifconfig lan3:1 192.168.6.7

and this line was added to the tcpdump output
17:02:14.261149 arp who-has 192.168.6.7 (Broadcast) tell 192.168.6.7

so, on 11.23 at least, when one ifconfig's a logical interface (lanN:M, no plumbing) there is indeed a gratuitous ARP emitted.

I suspect you may need to beat the PIX with a PIXie stick or something.