Geo Redundancy Requirements

This chapter contains the following topics:

Crosswork Cluster Requirements

Geo redundancy solution requires double the number of VMs required for a regular Crosswork Cluster installation. For more information, see Installation Prerequisites for VMware vCenter.

Important Notes

  • While preparing inventory file, you must flush out details of cluster constituents along with connectivity information.

  • Setup the DNS server for your setup. The DNS server should resolve the unified multi-cluster FQDN domain (for example, *.cw.cisco) you want to use and be reachable from both the clusters, Crosswork Data Gateway, NSO, and SR-PCE. For more information on DNS setup procedure, see the Cisco Prime Network Registrar Caching and Authoritative DNS User Guide.

  • The DNS server should forward any outside domains to the external DNS servers.

  • You should concurrently bring up the active and standby clusters using the existing installer mechanism. Make sure to use the previously identified DNS server in the installation of Crosswork cluster, Crosswork Data Gateway, and NSO.

  • You can optionally install applications on both the clusters, but devices, providers, or destinations must be onboarded only on the active cluster.

  • Before enabling geo redundancy mode, you are recommended to make a backup of the active and standby cluster that will be used in the geo redundancy setup.

  • Once the geo redundancy mode is set up, it cannot be undone as the certificates are regenerated using common root CA. To revert to non-geo redundancy mode, you can restore the backup made prior to enabling the geo redundancy mode.

  • The NSO in HA mode requires provider connectivity onboarding via an L3 VIP or FQDN in the Crosswork Network Controller.

Port Requirements

As a general best practice, any unused ports should be disabled. To identify all open listening ports after installing and activating the applications, log in as a Linux CLI admin user on any Crosswork cluster VM and run the netstat -aln command:


Note

All IP addresses (including Virtual IP addresses) between Crosswork Cluster, Crosswork applications, and Crosswork Data Gateway must be reachable (to be pinged to/from) between each other.

Figure 1. Communication flow between Crosswork and different components

The key processes involved in the replication and accessibility between the sites:

  • The Crosswork VM intercluster checks are performed, with replication occurring over the eth0 management links between the two sites.

  • The NSO replication occurs over the management links between both sites.

  • The Crosswork Data Gateway on each site must be accessible to both the devices and the active CW cluster from either site.

  • Replication for the Crosswork cluster is a periodic process.

  • NSO replication is synchronous.

  • The Crosswork Network Controller NBI is accessible through its DNS FQDN.

The TCP/UDP port numbers must be allowed through any external firewall or access control list (ACL) deployed by the data center administrator. Depending on the NIC deployment, these ports may be applicable to only one or both NICs.

Table 1. Two NICs Crosswork communication with Crosswork Data Gateway: Comparison of traffic types across sites

Traffic Type

Ports Used

Site 1 (Active)

Site 2 (Standby)

The eth0 interfaces on both the Active and Standby Crosswork devices exchange bidirectional traffic with each other.

30651 and 30652

Crosswork eth0 (Management)

Crosswork eth0 (Management)

The eth0 interface on Crosswork Data Gateway (Active and Standby) and eth0 on Crosswork (Active) exchange bidirectional traffic with each other.

The ports are used for these purposes:

  1. 30607: REST API calls to download the collector images, system resource, and custom resource bundle.

  2. 30607: Sending the Crosswork Data Gateway vitals to Crosswork.

  3. 30608: Handling the gRPC communication to send Crosswork Data Gateway’s heartbeat.

Crosswork Data Gateway eth0 (Management)

Crosswork Data Gateway eth0 (Management)

The eth1 interface on Crosswork Data Gateway (Active) and eth1 Crosswork (Active) exchange bidirectional traffic with each other.

The ports are used for these purposes:

  1. 30607: Handling the gRPC communication with Crosswork's Magellan service.

  2. 30993, 30994, and 30995: Kafka ports used to distribute data across Crosswork's Kafka or gRPC destinations.

Crosswork Data Gateway eth1

(Northbound Data)

Crosswork Data Gateway eth1

(Northbound and Southbound Data)

The eth1 interface on Crosswork Data Gateway (Active) and device exchange bidirectional traffic with each other.

The ports are used for these purposes:

  1. 1062: SNMP trap.

  2. 9514, 9898, and 6514: Syslog UDP, TCP, and TLS.

Crosswork Data Gateway eth1

(Northbound Data)

Crosswork Data Gateway eth1

(Northbound and Southbound Data)
Table 2. Two NICs Crosswork communication with three NICs Crosswork Data Gateway: Comparison of traffic types across sites

Traffic Type

Ports Used

Site 1 (Active)

Site 2 (Standby)

The eth0 interfaces on both the Active and Standby Crosswork devices exchange bidirectional traffic with each other.

30651 and 30652

Crosswork eth0

Crosswork eth0

The eth0 interface on Crosswork Data Gateway (Active and Standby) and eth0 on Crosswork (Active) exchange bidirectional traffic with each other.

The ports are used for these purposes:

  1. 30607: REST API calls to download the collector images, system resource, and custom resource bundle.

  2. 30607: Sending the Crosswork Data Gateway vitals to Crosswork.

  3. 30608: Handling the gRPC communication to send Crosswork Data Gateway’s heartbeat.

Crosswork Data Gateway eth0 (Management)

Crosswork Data Gateway eth0 (Management)

The eth1 interface on Crosswork Data Gateway (Active) and eth1 Crosswork (Active) exchange bidirectional traffic with each other.

The ports are used for these purposes:

  1. 30607: Handling the gRPC communication with Crosswork's Magellan service.

  2. 30993, 30994, and 30995: Kafka ports that are used to distribute data across Crosswork's Kafka or gRPC destinations.

Crosswork Data Gateway eth1

(Northbound Data)

Crosswork Data Gateway eth1

(Northbound Data)

The eth2 interface on Crosswork Data Gateway (Active) and device exchange bidirectional traffic with each other.

The ports are used for these purposes:

  1. 1062: SNMP trap.

  2. 9514, 9898, and 6514: Syslog UDP, TCP, and TLS.

Crosswork Data Gateway eth2

(Southbound Data)

Crosswork Data Gateway eth2

(Southbound Data)

Unified Endpoint Requirements

  • Unified endpoint is used to hide multiple instances in high availability for the various components.

  • DNS allows endpoints to be referred via Fully Qualified Domain Name (FQDN) which should point to the active instance IP. User will need domain zone provisioning under which Crosswork components would have IP addresses mapped to FQDN. The DNS authoritative server must have A or AAAA entry for the IP address from the user for the domain zone dedicated to Crosswork components.