Anycast. Implementing a High-Availability Web-Based Service with Anycast: A Success Story. Merit Networking 2013 December 12, 2013

Transcription

1 Anycast Implementing a High-Availability Web-Based Service with Anycast: A Success Story Merit Networking 2013 December 12, 2013 Pete Hoffswell Davenport University

2 Abstract "Implementing a High-Availability Web-Based Service with Anycast: A Success Story" Pete Hoffswell, Network Manager, Davenport University Abstract: Davenport University has successfully developed and implemented a high-availability single sign-on system using Anycast and a cloud-based data center. We will revisit Adi Aditya's presentation on the subject of high availability HTTPS from last year s summit and discuss the details of a successful high-availability deployment. You will come away with a roadmap for deploying Anycast to allow for system redundancy and/or load-balancing.

3 The Challenge University Central Authentication Service (CAS) 1 CAS server Several Apps Blackboard Google Others HTTP/S Applications and Load-Balancing for Networking Folks -And Network Load-Balancing for HTTP/S Application Admins R.P. (Adi) Aditya, University of Michigan CAS

4 Anycast IP Overview How do I get to ? Check Routing Table. Choose Best. Server A a Data Center 1 User Router Server A a Data Center 2 ping ping ping ?

5 Anycast Example 12-Warren 9-CORE a LAN a ping

6 Anycast Example - Site 9 9-CORE#show run int lo202 interface Loopback Warren 9-CORE ip address CORE#show ip route Routing entry for /32 Known via "connected", distance 0, metric 0 (connected, via interface) Redistributing via eigrp 1 Routing Descriptor Blocks: * directly connected, via Loopback202 Route metric is 0, traffic share count is 1 39-LAN

7 Anycast Example - Site LAN#show run int lo202 interface Loopback Warren 9-CORE ip address CORE#show ip route Routing entry for /32 Known via "connected", distance 0, metric 0 (connected, via interface) Redistributing via eigrp 1 Routing Descriptor Blocks: * directly connected, via Loopback202 Route metric is 0, traffic share count is 1 39-LAN

8 Anycast Example - Site 12 view 12-Warren#show ip route Routing entry for /32 Known via "eigrp 1", distance 90, metric , type internal 12-Warren 9-CORE Redistributing via eigrp 1 Last update from on Vlan22, 00:08:25 ago Routing Descriptor Blocks: * , from , 00:08:25 ago, via Vlan22 Route metric is , traffic share count is 1 Total delay is 5100 microseconds, minimum bandwidth is Kbit Reliability 255/255, minimum MTU 1500 bytes Loading 1/255, Hops 1 39-LAN

9 Anycast Example - Site 12 view Router 9 9-CORE(config)#int lo CORE(config-if)#shut 12-Warren 9-CORE Router Warren#show ip route Routing entry for /32 Known via "eigrp 1", distance 90, metric , type internal Redistributing via eigrp 1 Last update from on Vlan22, 00:00:02 ago Routing Descriptor Blocks: * , from , 00:00:02 ago, via Vlan22 Route metric is , traffic share count is 1 Total delay is 5120 microseconds, minimum bandwidth is Kbit Reliability 255/255, minimum MTU 1500 bytes Loading 1/255, Hops 3 39-LAN

10 Anycast impractical Example - NTP 12-Warren(config)#ntp server Warren 9-CORE 12-Warren#show ntp status Clock is synchronized, stratum 4, reference is nominal freq is Hz, actual freq is Hz, precision is 2**20 ntp uptime is 400 (1/100 of seconds), resolution is 4000 reference time is D651B436.79F0A238 (10:39: EST Tue Dec ) clock offset is msec, root delay is msec root dispersion is msec, peer dispersion is msec loopfilter state is 'CTRL' (Normal Controlled Loop), drift is s/s system poll interval is 128, last update was 2 sec ago. 12-Warren#show ntp associations address *~ ref clock st when poll reach delay offset disp * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured 39-LAN

11 Anycast impractical Example - NTP Ab b Res y No rma u l t Don s! l Any t do t his c a st i! NO s TS TAT EFU L! 12-Warren(config)#ntp server Warren 9-CORE 12-Warren#show ntp status Clock is synchronized, stratum 4, reference is nominal freq is Hz, actual freq is Hz, precision is 2**20 ntp uptime is 400 (1/100 of seconds), resolution is 4000 reference time is D651B436.79F0A238 (10:39: EST Tue Dec ) clock offset is msec, root delay is msec root dispersion is msec, peer dispersion is msec loopfilter state is 'CTRL' (Normal Controlled Loop), drift is s/s system poll interval is 128, last update was 2 sec ago. 12-Warren#show ntp associations address *~ ref clock st when poll reach delay offset disp * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured 39-LAN

12 The Challenge University Central Authentication Service (CAS) 1 CAS server Several services Blackboard Google Others Don t ever take the CAS Server Down. CAS

13 CAS Failover Backup CAS HTTP/HTTPS Internet-based User Internet Backup LDAP Cloud DC Firewall HTTP/HTTPS Internal User DU Net Prod LDAP Prod CAS DU DC

14 Complex Routes Backup LDAP EC2 Private Subnet /24 vdcsso.davenport.edu VDCWeb sso.davenport.edu a LDAP VPN Tunnel ASA2 Firewall Router dcsso.davenport.edu lum4pprd sso.davenport.edu a Internet EC2 Public Subnet /24 Virtual Data Center Amazon VPC /16 DU Networks /8 et al User can SSO to: - (answered by DC server) - (answered by VDC Server) - (answered by either server)

15 Controlling anycast routes Route Advertisements From Server (Quagga) ip sla and track Manual Switch a. Adjust Route on Core b. Adjust Route/NAT on Firewall c. Script it SSO SSO FW Router

16 What Next? Experiment Find a Need (DNS?) Design, plan, deploy, test! Warren 9-CORE Questions? Pete Hoffswell - Davenport University [email protected] 39-LAN