DATA CENTER. Best Practices for High Availability Deployment for the Brocade ADX Switch

Transcription

1 DATA CENTER Best Practices for High Availability Deployment for the Brocade ADX Switch

2 CONTENTS Contents... 2 Executive Summary... 3 Introduction... 3 Brocade ADX HA Overview... 3 Hot-Standby HA... 4 Active-Standby HA... 6 Active-Active HA... 9 Summary High Availability for the Brocade ADX Application Delivery Switch Best Practices 2 of 11

3 EXECUTIVE SUMMARY High Availability (HA) in an application delivery network is key to providing business continuity and Service Level Agreements (SLAs) promised to end users. To meet different needs of HA, the Brocade ADX Series supports three HA deployment modes: hot-standby, active-standby, and active-active. This document describes best practices for deploying these HA modes and provides a deployment scenario for each mode. It is assumed that the audience has basic knowledge of the high-availability features of Brocade ADX Series devices. INTRODUCTION In network design, HA is one of the key considerations, among others such as efficiency, flexibility, scalability, and robustness. In general, HA is provided by redundancy of certain resources in a network, such as a component of a device, a path or link, a device, and a site. Component redundancy means you have redundant local components, such as a power supply. Path redundancy means there is an alternate path to the immediate next hop. Device redundancy means there is a backup device for failover. Site redundancy means there is a replica of the entire set of resources in another site. In general, a combination of these redundancy types is utilized to meet the requirements of HA, such as recovery time and the number of tolerable failure points. This document primarily focuses on device redundancy for Server Load Balancing (SLB) features provided by the Brocade ADX Series to meet recovery times within a range of 3 15 seconds with a toleration of one or two failure points. Site Redundancy Device Redundancy Path Redundancy Component Redundancy Figure 1: Redundancy levels BROCADE ADX HA OVERVIEW Usually, Application Delivery Controllers (ADCs) provide proprietary device redundancy mechanisms along with standard-based approaches such as Spanning Tree Protocol (STP) and routing protocols. The proprietary redundancy mechanisms are mainly used to elect a primary device, perform heartbeat monitoring, and replicate sessions to the secondary device for seamless failover. Active-Active Active-Standby Hot-Standby For device redundancy, the Brocade ADX Series provides three distinct HA operation modes: hot-standby, active-standby, and active-active. Hot-standby HA Figure 2: Brocade ADX HA modes provides straightforward, fast failover in a Layer 2 switch environment where the standby device remains completely dormant. The hot-standby HA is the fastest of the three modes in terms of failover time; the standby device can take over in 1 second. The active-standby HA enables you to utilize the standby device by dividing SLB Virtual IPs (VIPs) into both devices in the HA pair. The activeactive HA brings in the ultimate efficiency of the devices by allowing the same SLB VIPs to be processed by both devices. Before describing further details of the best practices for each of the three modes, we will consider some Brocade ADX features that do not involve SLB VIPs and review the terms that are widely used in Brocade ADX manuals. The Brocade ADX Series provides advanced load balancing features other than SLB such as Transparent Cache Switching (TCS), Firewall Load Balancing (FWLB), IP Network Address Translation (NAT), and TCP Synchronization High Availability for the Brocade ADX Application Delivery Switch Best Practices 3 of 11

4 (SYN) attack mitigation which do not involve SLB VIPs. In general, for these services the Brocade ADX Series provides only the active-active HA mode. In Brocade ADX manuals, the following terms are used when explaining the Brocade ADX HA features. Backup port: Sync and heartbeat port used in the hot-standby setup Symmetric port: Sync port used in the active-standby or active-active setup Active-active port: Sync and heartbeat port used in the active-active IP NAT/TCS/TCP SYN attack mitigation setup. Note that active-active-port is a CLI option to enable the active-active setup for these features. Fw-port: Sync and heartbeat port in the active-active FWLB setup. Note that fw-port is a CLI option to enable the active-active FWLB. Symmetric SLB: A synonym for the active-standby HA Sym-priority: A priority given to an SLB VIP Sym-active SLB: A synonym for the active-active HA. Note that sym-active is a CLI option to enable the active-active SLB. HOT-STANDBY HA Hot-standby HA is the recommended HA mode when a Brocade ADX device runs a switch code. Note that this HA mode is available only in the switch code. In the hot-standby HA, the hot device is the primary Brocade ADX device, which takes all the traffic. The standby device does not take any traffic, but it monitors the health status of the primary device and performs health checks for real servers. Note that the standby device does not even learn MAC addresses on its own for attached nodes on the LAN segment. The hot Brocade ADX device learns MAC addresses and synchronizes them to the standby device. The Brocade ADX device in hot-standby HA mode boots up as the standby device first and listens on the sync port. If no heartbeat is heard for one second, it becomes the hot device and begins generating heartbeats. Therefore, the election of the hot device depends on timing that is, which device came up first or was visible to its peer. Optionally, you can designate a Brocade ADX device as a preferred hot device, using the server backup-preference command. The command must be configured only on the preferred Brocade ADX device. The standby Brocade ADX device takes over if it does not receive a vital sign or a heartbeat over the sync port for 1 second. The standby device also takes over if its number of router/server ports or active SLB VIPs is greater than that of the hot device. In order to provide seamless failover of applications, the hot Brocade ADX device synchronizes the Layer 4 session information and some basic Layer 7 session information to the standby device. It is not allowed to enable or disable the synchronization manually; the session synchronization is always on in the hot-standby HA. In general, the following is recommended and/or mandated for the hot-standby HA configuration. The dedicated sync ports on Brocade ADX devices are mandatory and must be assigned a unique VLAN and STP should not be on the ports. It is recommended that a static link aggregation be used on the sync ports to avoid the single point of failure. Note that Link Aggregation Control Protocol (LACP) is not supported for the sync ports. Do not run STP/RSTP on Brocade ADX devices; you can run it on adjacent devices. It is recommended that physical configuration, including the physical connectivity, of Brocade ADX devices in an HA pair should be symmetric to each other; for example, if port 1/1 on ADX A connects to upstream router A, the same port on ADX B should connect to the same router. Do not configure the same server source-ip addresses on two Brocade ADX devices in the HA pair; it is wrong. Do not be confused with the server source-nat-ip address. The server source-ip address is used High Availability for the Brocade ADX Application Delivery Switch Best Practices 4 of 11

5 for a health check when the subnet of the management IP address of the device is different from that of real server IP addresses. The server source-nat-ip address is used for source-nat, and both devices in the HA pair must share the same source-nat-ip address. Assign a backup-group ID to the HA pair, even though there is only one Brocade ADX pair in the network segment. By default, the standby Brocade ADX device takes over if it does not receive a vital sign from the hot ADX device for 1 second. A period of 3 5 seconds is recommended, depending on the management processor load on the device and the convergence speed of your network. To change the failover time, use the server backup-timer command. Both devices in the HA pair must have the same value for the backup-timer. Figure 3 shows a typical network diagram for hot-standby deployment, and Table 1 shows CLI configurations for the deployment. In the configuration, the source standby-ip command is used to provide the default gateway service for servers. The gateway service is applicable to hosts configured as real servers on the Brocade ADX device. Figure 3. Network diagram for hot-standby. Table 1. Brocade ADX Configuration for Hot-Standby Mode Brocade ADX-A (Hot) Brocade ADX-B (Standby) trunk eth 5 to 6 vlan 1 ip-subnet /24 trunk eth 5 to 6 vlan 1 High Availability for the Brocade ADX Application Delivery Switch Best Practices 5 of 11

6 vlan 10 untag eth 3 eth 4 ip-subnet /24 ip address /24 ip default-gateway # HA identifier server backup-group 1 # Chassis MAC address of one of Brocade ADX devices server backup ethe 5 00e c72 vlan-id 2 # Chassis MAC address of one of ADXs server router-ports eth 1 server router-ports eth 2 # This box is a preferred hot device server backup-preference 5 # is used as a gateway by servers server source-standby-ip / server source-ip server real rs server real rs server virtual v bind 80 rs1 80 rs2 80 ip-subnet /24 vlan 10 untag eth 3 eth 4 ip-subnet /24 ip address /24 ip default-gateway server backup-group 1 server backup eth 5 00e c72 vlan-id 2 server router-ports eth 1 server router-ports eth 2 server source-standby-ip / server source-ip server real rs server real rs server virtual v bind 80 rs1 80 rs2 80 ACTIVE-STANDBY HA The active-standby HA mode allows you to have a certain set of SLB VIPs active on one Brocade ADX device and another set of SLB VIPs active on the other device in the HA pair. You do this by assigning a priority called sympriority to an individual SLB VIP, not to the device. The standby Brocade ADX device actively participates in all necessary Layer 2 and Layer 3 forwarding, including routing protocols. It also actively performs SLB for a VIP for which it has a higher priority than the other device. In general, we recommend the active-standby HA when the Brocade ADX device runs a router code, and we recommend one device to be active for all VIPs, to avoid the complexity of traffic flows. High Availability for the Brocade ADX Application Delivery Switch Best Practices 6 of 11

7 In the active-standby HA mode, enable session synchronization when you use Layer 4 SLB or simple Layer 7 content base switching. Otherwise, do not turn on the session synchronization, because the Layer 7 switching decision and state information are not synchronized over to the peer in an HA pair. Having just the Layer 4 session information synced over the standby Brocade ADX device may not help achieve the seamless failover, if an advanced Layer 7 feature for example, HTTP response rewrite and SSL termination is used. However, you might want to enable session synchronization when you have a Layer 4 persistency option such as sticky. Note that in the case of HTTP, the failover delay is barely noticeable because a client can recover very quickly on its own. In the active-standby HA mode, the standby Brocade ADX device does not take any SLB action, even though a received packet matches an SLB session entry. Instead, it forwards the packet using Layer 2 or Layer 3 logics, and the response can be sent to the client directly without going through the active Brocade ADX device. In other words, the active-standby HA cannot handle asymmetric traffic flow. For example, assume that an active Brocade ADX device receives an HTTP request packet to an SLB VIP and performs an SLB operation on it, and then the standby device receives an HTTP response packet. If the active device is not on the path on which the standby device forwards the response packet, the packet will reach the client without proper packet translation, breaking the SLB flow. With a router code, it is straightforward to ensure the symmetric traffic flow. In fact, it is a reason why a router code is recommended, along with Virtual Router Redundancy Protocol Extended (VRRP-E) and the VIP-group, which are described subsequently. The VIP-group and VRRP-E are highly recommended for the active-standby HA. The VRRP-E provides gateway redundancy for servers. Hence, the VRRP-E is tied to the VIP-group, making the SLB VIP ownership follow the VRRP-E ownership; if there is a change in the VRRP-E ownership, it is reflected in the SLB ownership. For example, if Brocade ADX A is the master for the VRRP-E, it becomes the master for all VIPs listed in the VIP-group associated with the VRRP-E. In the active-standby HA mode, the standby Brocade ADX device for an SLB VIP takes over, if for 8 seconds it does not receive a message called sym-pdu from the other device or if the received sym-pdu carries a lower sympriority than the sym-priority configured for the VIP on the local device. If the Brocade ADX device runs a router code, then the status of a VE or a Layer 3 interface on the device that is hosting an SLB VIP may affect the failover decision as well. For example, if VE 1 assigned with IP address /24 is down, the sym-priority of all the VIPs in subnet /24 are lowered to 1, which can trigger a failover of these VIPs. However, the VIP state does not affect failover. For example, even if all the real servers associated with a VIP are down, the VIP priority is not lowered unless you have a special configuration such as dynamic-sym-priority. In general, the following is recommended for the active-standby HA configuration. Dedicate a port on Brocade ADX devices for sym-pdus, and put it in a separate VLAN. Note that a certain type of sym-pdus are still sent on data ports even after you specify a dedicated port for sym- PDUs. When the dedicated link goes down or is not available, the devices automatically choose one of the data ports and carry sym-pdus on it. Assign a symmetric-group ID to an HA pair, so that both Brocade ADX devices in the pair can recognize each other as a partner in the same HA pair. Use VIP-group and VRRP-E. Especially if you have source-nat IP addresses, include all of them in the VIP-group. This ensures that the same device is active for SLB VIPs and source-nat IP addresses. Avoid 1 and 255 as the lowest and highest sym-priority values, respectively. Figure 4 shows a typical network diagram for active-standby HA, and Table 2 shows corresponding Brocade ADX configurations. In general, avoid running STP/RSTP, and instead use a routing protocol. In the table, note that the SLB VIP port translates to another port on the real server; therefore, both ports are configured in global port profiles for session synchronization. High Availability for the Brocade ADX Application Delivery Switch Best Practices 7 of 11

8 Figure 4. Network diagram for active- standby. Table 2. Brocade ADX Configurations for Active-Standby Mode Brocade ADX-A (Active) trunk eth 1 to 2 vlan 10 tagged eth 1 eth 2 router-inter ve 10 vlan 20 tagged eth 1 eth 2 router-inter ve 20 vlan 30 untag eth 3 int ve 10 ip address /24 ip ospf area 10 int ve 20 ip address /24 ip ospf passive ip ospf area 10 ip vrrp-e vrid 10 Brocade ADX-B (Standby) trunk eth 1 to 2 vlan 10 tagged eth 1 eth 2 router-inter ve 10 vlan 20 tagged eth 1 eth 2 router-inter ve 20 vlan 30 untag eth 3 int ve 10 ip address /24 ip ospf area 10 int ve 20 ip address /24 ip ospf passive ip ospf area 10 ip vrrp-e vrid 10 High Availability for the Brocade ADX Application Delivery Switch Best Practices 8 of 11

9 backup priority 200 ip-add vip-group 10 enable router vrrp-extended router ospf server symmetric-group 1 # HA identifier server symmetric-port eth 3 vlan-id 30 # Sync port server vip-group 10 vip server session-sync server 80 session-sync server real rs server real rs server virtual v sym-priority 200 bind 80 rs rs backup priority 110 ip-add vip-group 10 enable router vrrp-extended router ospf server symmetric-group 1 server symmetric-port eth 3 vlan-id 30 server vip-group 10 vip server session-sync server 80 session-sync server real rs server real rs server virtual v sym-priority 110 bind 80 rs rs ACTIVE-ACTIVE HA The active-active HA mode is used when you want the same SLB VIP to be processed by both Brocade ADX devices in an HA pair. In this HA mode, the traffic can often flow and be processed asymmetrically. For example, a client request and the server response can come to different Brocade ADX devices and be processed properly. Also, requests from different clients heading to the same SLB VIP can land on different Brocade ADX devices. Therefore, session synchronization is a must, and active-active HA is recommended only when using Layer 4 SLB. Especially if you need advanced Layer 7 SLB features such as response rewrite, SSL termination and Brocade OpenScript active-standby HA is preferable, because session synchronization is not available. In the active-active HA mode, each SLB VIP is assigned a sym-priority and configured as sym-active. Like a device in the active-standby HA mode, the Brocade ADX device that has a VIP with a higher sym-priority will respond to an ARP request for the VIP and to a ping request. Note that the difference between the active-standby and active-active High Availability for the Brocade ADX Application Delivery Switch Best Practices 9 of 11

10 modes is that either of the devices that receives a packet in the HA pair may perform the SLB operation in activeactive mode. The VIP-group and VRRP-E are highly recommended for active-active HA, just as for active-standby HA, and the other recommendations for active-standby mode hold true for active-active HA mode as well. Also, the failover conditions for active-active HA are the same as those for active-standby HA, as described in the earlier section. The typical network diagram and Brocade ADX configurations for active-active HA mode are the same as for activestandby HA mode (as shown in Figure 4 and Table 2, respectively), except that the sym-active option is configured in the VIP as follows: server virtual v sym-priority 200 sym-active Lastly, if you choose the active-active HA, you might want to know how to pull the traffic destined to the same VIP to both Brocade ADX devices. To do this, you should not put the VIP subnet on the interface that is adjacent to the routers. The routers will perform Equal Cost Multipath (ECMP) forwarding across both devices to reach the VIP. SUMMARY As a general rule, when the Brocade ADX Series runs a switch code, you should stay with hot-standby mode. In this case, note that the configuration becomes complicated if you need many subnets for servers and SLB VIPs. A router code is then recommended, and you have to move away from the hot-standby HA. When the Brocade ADX Series runs a router code, the active-standby HA is recommended. If you want the same VIP to be served by both devices in the HA pair, determine whether Layer 4 SLB is enough for your applications; if Layer 4 SLB is enough, go ahead with the active-active HA with a router code. If you run a router code and need Layer 7 features, choose active-standby HA. Also, do not forget VRRP-E and VIP-group when you choose active-standby or active-active modes. High Availability for the Brocade ADX Application Delivery Switch Best Practices 10 of 11

11 2012 Brocade Communications Systems, Inc. All Rights Reserved. 10/12 GA-BP ADX, Brocade, Brocade Assurance, Brocade One, the B-wing symbol, DCX, Fabric OS, ICX, MLX, MyBrocade, SAN Health, VCS, and VDX are registered trademarks, and AnyIO, HyperEdge, NET Health, OpenScript, and The Effortless Network are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be trademarks of their respective owners. Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning any equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to this document at any time, without notice, and assumes no responsibility for its use. This informational document describes features that may not be currently available. Contact a Brocade sales office for information on feature and product availability. Export of technical data contained in this document may require an export license from the United States government. High Availability for the Brocade ADX Application Delivery Switch Best Practices 11 of 11