Table Of Contents
Configuring Adaptive Session Redundancy
When to Use VIP and Virtual Interface Redundancy
When to Use Box-to-Box Redundancy
Configuring Adaptive Session Redundancy
Configuration Requirements and Restrictions
Upgrading to WebNS Version 7.40 and Higher
Configuring Inter-Switch Communications
Configuring Redundant Services
Configuring Redundant Content Rules
Configuring Redundant Source Groups
Source Group Port-Mapping Behavior in an ASR Configuration
Synchronizing ASR Configurations
Displaying Inter-Switch Communications Ports
Displaying Dormant Flow Information
Displaying ASR Information for Content Rules, Services, and Source Groups
Displaying ASR Status and Global Index Values
Displaying Summary ASR Information
Configuring Adaptive Session Redundancy
This chapter describes how to configure Adaptive Session Redundancy (ASR) for stateful failover on a CSS.
This chapter contains the following major sections:
•
Configuring Adaptive Session Redundancy
Overview of CSS Redundancy
Redundancy helps to ensure:
•
•
A CSS provides three types of redundancy.
•
•
•
The following sections provide information about when (and when not) to use the different types of redundancy.
When to Use VIP and Virtual Interface Redundancy
Typically, you configure VIP redundancy on the public side of CSS peers that are positioned in front of a server farm. You configure virtual interface redundancy on the private-side interfaces attached to the L2 device in front of the servers.
Configure VIP redundancy:
•
•
•
•
Configure interface redundancy:
•
•
•
When to Use ASR
ASR provides session-level redundancy for applications where active flows (including TCP and UDP) must continue without interruption, even if the master CSS fails over to the backup CSS.
Configure ASR:
•
•
When to Use Box-to-Box Redundancy
Configure box-to-box redundancy when you:
•
•
Do not configure box-to-box redundancy when you:
•
•
Configuring Adaptive Session Redundancy
Configure Adaptive Session Redundancy (ASR) on Cisco 11500 series CSS peers in an active-backup VIP redundancy and virtual interface redundancy environment to provide stateful failover of existing flows. ASR ensures that, if the master CSS fails, the backup CSS has the necessary flow-state information to continue any active flows (including TCP and UDP) without interruption when the backup CSS assumes mastership. "Adaptive" means that you can configure ASR on a per content rule basis.
Use ASR for:
•
•
•
In an ASR configuration, CSSs replicate flows that are:
•
•
Note
Note
This section includes the following topics:
•
•
•
•
•
•
•
Stateful Failover
Active flows that match a redundant content rule, service, or source group on the master CSS are replicated as dormant flows on the backup CSS peer. A dormant flow contains all the flow-state information necessary for the backup CSS to take over the flow if the master CSS fails, including the flow ID assigned by the session processor (SP) that created the flow. If the master CSS fails, the dormant flows on the backup CSS become active when the backup CSS assumes mastership of the VIP. In turn, the active flows on the former master CSS transition to a dormant state to fully back up the active flows on the new master CSS.
A master CSS maps a newly activated TCP flow after it receives the first packet for the flow. If it can resolve a single route back to the source address, a CSS attempts to map a UDP flow when it activates the flow. Otherwise, the CSS maps the UDP flow after it receives the first packet of the flow.
Inter-Switch Communications
In an ASR configuration, CSS peers share redundant flow-state information over a maximum of two private Inter-Switch Communications (ISC) links after booting. ISC is a messaging service used by CSSs to exchange flow-state information. Only one ISC link is active at a time. The other ISC link (if configured) remains in backup mode until needed.
To prevent incorrect flow and port mapping information from being replicated to the backup CSS, a CSS does not activate its ISC link if it detects a mismatched chassis configuration with the other CSS. During its discovery phase and before activating the link, the ISC protocol exchanges chassis information between the two CSSs to ensure that:
•
•
For example, Figure 2-1 shows two CSS 11506s with slightly different module installation configurations. Each CSS 11506 has four installed modules, but the CSS-B configuration skips slot 3. As far as ISC is concerned, the configurations match because both CSSs have the same number of SPs with the same weights and installed in the same overall order.
Figure 2-1 Example of CSS 11506 Matching Module Configurations for ISC
To determine if an ISC link is up, a CSS uses a mechanism called LifeTick. LifeTick sends an asynchronous message that contains information about the selected path. If the CSS does not receive a LifeTick message within two seconds, the CSS considers the ISC link to be down. If a second link is configured, the CSS uses that link for ISC.
Note
The ISC links use the GE ports or the FE ports on the CSS session processors (SPs) to send ISC messages containing flow-state information. Once you configure the ISC ports, those ports are dedicated to ISC and you cannot use those same ports for non-ISC traffic.
Note
For new flows, CSSs exchange flow states in real time over the ISC links. For existing flows, CSSs exchange flow states at bootup and at VIP redundancy failover.
Redundant Indexes
ASR uses unique global redundant indexes to keep track of content rules, services, and source groups configured on the redundant CSS peers. Set up the redundant indexes in rules, services, and groups using the redundant-index command. You must then configure identical redundant content rules, services, and source groups on CSS peers in the ASR configuration.
Each redundant index that you configure on a rule, service, or group must be unique among all rules, services, or groups configured on a redundant pair of CSSs. For example, if you configure a rule with a redundant index of 1 on a pair of CSSs, you cannot configure an index of 1 on another rule. However, you could configure an index of 1 on a group or service if that value has not already been used on a group or a service.
Note
AUG 7 14:12:15 3/1 1124272 SLR-5: Rejected. Redundant global rule index (7) not found.
Configuration Requirements and Restrictions
The following requirements and restrictions apply to both CSS peers in an ASR configuration:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
In case of a failover, no information is available for the nonredundant flows on the backup CSS. Until the server cleans up the nonredundant flow connections, they continue to contribute to the connection limit on the service without the backup CSS having any knowledge of how many such connections exist. Making all flows redundant by imposing the above restrictions eliminates this problem.
•
service CriticalServiceip address 192.168.2.1 keepalive frequency 2 keepalive maxfailure 2 keepalive retryperiod 2 active
Note
•
Source groups selected by ACL-checking always take precedence over other source group matches for a flow. Therefore, if the master and backup CSSs have different ACL definitions, when a flow fails over to the backup and the source group selected on the master is not found on the backup, the CSS rejects the flow. Also, if the flow matches on a different source group through an ACL, that source group takes precedence over the redundant source group that was sent from the master.
•
•
•
•
•
Upgrading to WebNS Version 7.40 and Higher
To maximize the number of ports available for PAT in an ASR configuration, the CSSs must have similar chassis configurations in terms of the total number of session processors (SPs) and their assigned weights. All CSS module types have the same assigned weights, except for the SCM. The SSL module and the backup SCM in a dual SCM configuration are not considered SPs. Therefore, in an ASR configuration, both CSSs must have the same number of SPs.
If you are upgrading from a version of WebNS software earlier than 7.40, be aware of the following ASR configuration restrictions in WebNS software versions 7.40 and higher:
•
•
•
ASR Quick Start
Table 2-1 provides a quick overview of the steps required to configure ASR for each CSS in the redundant configuration. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI command, see the sections following Table 2-1.
Table 2-1 ASR Configuration Quick Start
1.
# config (config)#2.
3.
(config)# interface 1/1(config-if[ 1/1])# isc-port-one(config)# interface 1/2(config-if[ 1/2])# isc-port-two4.
(config)# service server1(config-service[server1])# ip address 192.168.100.100(config-service[server1])# redundant-index 1(config-service[server1])# active5.
(config)# owner arrowpoint(config-owner[arrowpoint])# content rule1(config-owner-content[arrowpoint-rule1]# vip address 192.1.1.100(config-owner-content[arrowpoint-rule1]# protocol tcp(config-owner-content[arrowpoint-rule1]# port 80(config-owner-content[arrowpoint-rule1]# url "/redundant.html"(config-owner-content[arrowpoint-rule1]# add service server1(config-owner-content[arrowpoint-rule1]# redundant-index 5(config-owner-content[arrowpoint-rule1]# active6.
(config)# group group1(config-group[group1])# vip address 192.1.1.100(config-group[group1])# add service server1(config-group[group1])# redundant-index 4(config-group[group1])# active7.
For example, on one CSS peer, enter:
(config)# global-portmap base-port 3000 range 30000On the other CSS peer, enter:
(config)# global-portmap base-port 33100 range 300008.
9.
# show session-redundant all
The following running-config example shows the results of entering the commands in Table 2-1 (in bold text) and the commands used to configure VIP and virtual interface redundancy (see Chapter 1, Configuring VIP and Virtual Interface Redundancy).
!*************************** GLOBAL ***************************global-portmap base-port 3000 range 30000!************************* INTERFACE *************************interface 1/1isc-port-oneinterface 1/2isc-port-twointerface 2/1bridge vlan 2!************************** CIRCUIT **************************circuit VLAN1ip address 10.1.1.1 255.255.255.0ip virtual-router 1 priority 101 preemptip redundant-interface 1 10.1.1.254ip critical-service 1 upstream_downstreamcircuit VLAN2ip address 192.1.1.1 255.255.255.0ip virtual-router 2 priority 101 preemptip redundant-vip 2 192.1.1.100ip critical-service 2 upstream_downstream!************************** SERVICE **************************service server1ip address 10.1.1.50redundant-index 1activeservice upstream_downstreamip address 192.1.1.50keepalive type script ap-kal-pinglist "192.1.1.20 10.1.1.20"keepalive frequency 2keepalive maxfailure 2keepalive retryperiod 2active!*************************** OWNER ***************************owner arrowpointcontent rule1vip address 192.1.1.100protocol tcpport 80url "/redundant.html"add service server1redundant-index 5active!*************************** GROUP ***************************group group1vip address 192.1.1.100add service server1redundant-index 4activeConfiguring Inter-Switch Communications
Inter-Switch Communications (ISC) is a messaging service that CSS peers use to exchange flow-state information in an ASR configuration. If the master CSS fails, the backup CSS already has the flow-state information necessary to continue the current flows without interruption. Using ISC, CSSs exchange state information:
•
•
To prevent incorrect flow and port mapping information from being replicated to the backup CSS, the CSS does not bring up the ISC link if it detects a mismatched chassis configuration with the other CSS. During the discovery phase, the ISC protocol exchanges chassis information between the two CSSs and ensures that both chassis have the same number of SPs before bringing up the link.
To enable ISC between two CSSs in an ASR configuration, use the isc-port-one and isc-port-two commands in interface configuration mode. You can configure a maximum of two ISC ports on each CSS. The two ports must be of the same type (Gigabit Ethernet or Fast Ethernet) and must be on the same module in the CSS 11503 or CSS 11506 or on the same CSS 11501. When you configure two ISC ports, the first port is active and the second port remains in a backup state. The backup link is used only if the active link fails. For best results, we recommend that you configure ISC on the GE ports.
The CSS 11501 does not support redundant GE ISC links for ASR because that CSS model includes only one GE port.
You must connect the ISC ports directly to the two CSSs. You cannot use Layer 2 devices on the ISC links between the two CSSs. Also, the ISC links must be dedicated to passing only ISC traffic.
For example, to enable both ISC ports on a CSS 11506, enter:
(config)# interface 1/1(config-if[ 1/1])# isc-port-one(config-if[ 1/1])# interface 1/2(config-if[ 1/2])# isc-port-twoTo disable both ISC ports on a CSS 11506, enter:
(config)# interface 1/1(config-if[ 1/1])# no isc-port-one(config-if[ 1/1])# interface 1/2(config-if[ 1/2])# no isc-port-twoConfiguring Redundant Services
To configure the global service index for a redundant service, use the redundant-index command. A CSS uses the global service index to keep track of redundant services and associated flow-state information.
The syntax for this service configuration mode command is:
redundant-index index
The variable index is a unique number you assign to a redundant service. Enter a unique integer from 0 to 32767, where a value of 0 disables ASR for a service. The default is 0, but it does not appear in the running-config even if you configure it explicitly.
For example:
(config-service[server1])# redundant-index 5To disable ASR for a service, enter:
(config-service[server1])# no redundant-index
Note
For more information on configuring services, refer to the Cisco Content Services Switch Content Load-Balancing Configuration Guide.
Configuring Redundant Content Rules
To configure the global content index for a redundant content rule, use the redundant-index command. A CSS uses the global content index to keep track of redundant content rules and associated flow-state information.
The syntax for this content configuration mode command is:
redundant-index index
The variable index is a unique number you assign to a redundant content rule. Enter a unique integer from 0 to 32767, where a value of 0 disables ASR on a content rule. The default is 0, but it does not appear in the running-config even if you configure it explicitly.
For example:
(config-owner-content[arrowpoint-rule1]# redundant-index 1To disable ASR on a content rule, enter:
(config-owner-content[arrowpoint-rule1]# no redundant-index
Note
For more information on configuring content rules, refer to the Cisco Content Services Switch Content Load-Balancing Configuration Guide.
Configuring Redundant Source Groups
If you configured source groups in ACLs, you must configure those source groups as redundant. Otherwise, ASR does not require source groups. To configure the global source group index for a redundant source group, use the redundant-index command. A CSS uses the global source group index to keep track of redundant content rules and associated flow-state information.
The syntax for this group configuration mode command is:
redundant-index index
The variable index is a number you assign to a redundant source group. Enter a unique integer from 0 to 32767, where a value of 0 disables ASR for a source group. The default is 0, but it does not appear in the running-config even if you configure it explicitly.
For example, to enable ASR for a source group:
(config-group[group1])# redundant-index 4To disable ASR for a source group, enter:
(config-group[group1])# no redundant-index
Note
For more information on configuring source groups, refer to the Cisco Content Services Switch Content Load-Balancing Configuration Guide.
Source Group Port-Mapping Behavior in an ASR Configuration
Because Adaptive Session Redundancy (ASR) requires that both CSSs have the same number of SPs in each chassis, each CSS uses the same port-selection algorithm in an ASR configuration as in a non-ASR configuration. This behavior means that ASR imposes no further restrictions on source group port mapping. For more information about source groups and port mapping, refer to the Cisco Content Services Switch Content Load-Balancing Configuration Guide.
Synchronizing ASR Configurations
You must synchronize configurations on both CSS peers to ensure that the ASR-specific configurations on the master CSS and the backup CSS are the same. This is critical to the proper functioning of ASR.
For ASR, you must manually configure on each peer:
•
•
•
•
Displaying ASR Information
Use the commands described in the following sections to display information for:
•
•
•
Displaying Inter-Switch Communications Ports
Use the show isc-ports command to display the following information:
•
•
•
Table 2-2 describes the fields in the show isc-ports output.
Displaying Dormant Flow Information
To display information about the current dormant flows on the backup CSS in an ASR configuration, use the show dormant flows command. Dormant flows are flows on the backup CSS that become active if the master CSS fails and the backup CSS becomes the master.
The syntax for this command is:
show dormant flows {source_address {destination_address}}
The optional variables for this command are:
•
•
Table 2-3 describes the fields in the show dormant flows output.
To display summary information about redundant dormant flows, use the flow statistics dormant command.
Table 2-4 describes the field in the flow statistics dormant output.
Displaying ASR Information for Content Rules, Services, and Source Groups
The following sections describe how to display ASR information specific to content rules, services, and source groups.
Displaying ASR Status and Global Index Values
To display information about ASR status and global redundant indexes, use the following commands:
•
•
•
The relevant fields in the output of these commands are:
•
•
For complete details on the show rule, show service, and show group commands, refer to the Cisco Content Services Switch Content Load-Balancing Configuration Guide.
Displaying Summary ASR Information
To display summary ASR information about redundant content rules, services, and source groups, use the show session-redundant command.
The syntax for this global configuration mode command is:
show session-redundant [rule|service|group|all]
The optional keywords are:
•
•
•
•
For example, to view summary ASR information for redundant content rules, enter:
(config)# show session-redundant ruleTable 2-5 describes the fields.
