What is your real servers default route?<br><br><div><span class="gmail_quote">On 7/10/06, <b class="gmail_sendername">Paul Raj Khangure</b> <<a href="mailto:foundry-nsp@digitaljunkie.net">foundry-nsp@digitaljunkie.net</a>
> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">G'day all,<br><br>I'm trying to get a SI GT with the router image on it to function as an SLB.
<br><br>The router image is due to needing the "advertise-vip-route" command<br>(it advertises the VIP IP via dynamic routing protocol if health checks<br>have the VIP as up) which isn't available on the switching image.
<br><br>I'd prefer the SLB to work in DSR mode, but I currently can't get the<br>SLB function working at all in any mode with the router image!<br><br>The SLB can see the real server, it's doing health checks (to the<br>dummy address on the SMT Port), and marking the real as active. It then
<br>advertises the Virtual via OSPF, as desired. I can telnet to the real<br>server on port 25 from the SLB and it responds with the SMTP prompts.<br><br>I can ping the Virtual IP fine from externally when it's advertised via
<br>OSPF, but if I try and telnet to the virtual IP on the SMTP port, I dont<br>see anything at all in a tcpdump on the real server.<br><br>The stats on the SLB don't show any connection attempts to that real<br>either:<br>
<br>telnet@ica-grafton-slb1#sh serv real mail1<br>Real Servers Info<br>========================<br>State(St) - ACT:active, ENB:enabled, FAL:failed, TST:test, DIS:disabled,<br> UNK:unknown, UNB:unbind, AWU:await-unbind, AWD:await-delete
<br><br>Name: mail1 State: Active Cost: 0 IP:<a href="http://10.200.41.1">10.200.41.1</a>: 1<br>Mac: 0014.5e31.59e6 Weight: 0 MaxConn: 1000000<br>SrcNAT: not-cfg, not-op DstNAT: not-cfg, not-op Serv-Rsts: 0
<br>tcp conn rate:udp conn rate = 0:0, max tcp conn rate:max udp conn rate = 0:0<br><br>Port St Ms CurConn TotConn Rx-pkts Tx-pkts Rx-octet Tx-octet Reas<br>---- -- -- ------- ------- ------- ------- -------- -------- ----
<br>default UNB 0 0 0 0 0 0 0 0<br>smtp ACT 0 0 0 0 0 0 0 0<br><br>Server Total 0 0 0 0 0 0 0
<br><br>telnet@ica-grafton-slb1#<br><br>>From a linux box well outside the network, I can ping the VIP:<br><br>--- 203.x.y.x ping statistics ---<br>3 packets transmitted, 3 packets received, 0% packet loss<br>round-trip min/avg/max =
127.9/147.2/167.7 ms<br><br>But a telnet reports no route to host:<br><br>> telnet 203.x.y.x 25<br>Trying 203.x.y.z...<br>telnet: Unable to connect to remote host: No route to host<br>><br><br>>From the next hop from the SLB (where the route is being advertised via
<br>OSPF) I can again ping the device:<br><br>#ping 203.x.y.z<br><br>Type escape sequence to abort.<br>Sending 5, 100-byte ICMP Echos to 203.x.y.z, timeout is 2 seconds:<br>!!!!!<br>Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms
<br>#<br><br>But again, can't telnet on the SMTP port:<br><br>#telnet 203.x.y.z 25<br>Trying 203.x.y.z, 25 ...<br>% Connection timed out; remote host not responding<br><br>#<br><br>Again, no change to the stats for mail1 - it's not showing the
<br>connection attempt, and the server itself sees nothing via tcpdump.<br><br>The route is definitely there and learned by OSPF though:<br><br>#sh ip route 203.x.y.z<br>Routing entry for 203.x.y.z/32<br> Known via "ospf 253", distance 110, metric 10, type extern 2, forward metric 10
<br> Last update from <a href="http://10.200.253.250">10.200.253.250</a> on Vlan253, 03:00:48 ago<br> Routing Descriptor Blocks:<br> * <a href="http://10.200.253.250">10.200.253.250</a>, from <a href="http://10.200.40.250">
10.200.40.250</a>, 03:00:48 ago, via Vlan253<br> Route metric is 10, traffic share count is 1<br><br>#<br><br>I've tried various combinations of source nat, dest nat, and dsr without<br>any avail.<br><br>I've tried removing the advertisment via OSPF and statically routing the
<br>Virtual IP via <a href="http://10.200.253.250">10.200.253.250</a> or <a href="http://10.200.254.15">10.200.254.15</a> with no luck.<br><br>I've also tried removing the ve41 interface, and changing vlan 41 to:<br><br>vlan 41 name Untrusted2 by port
<br> tagged ethe 3/1<br> ip-subnet <a href="http://10.200.41.0">10.200.41.0</a> <a href="http://255.255.255.0">255.255.255.0</a><br>!<br><br>With no avail (health checks no longer work if I don't have the ve41 on<br>the <a href="http://10.200.41.0/24">
10.200.41.0/24</a> subnet).<br><br>I also notice that in the router image, I don't have the "server<br>source-ip" command available which I would normally use with the above<br>ip-subnet configuration.<br><br>It's as if it's not making it to the SLB layer at all.
<br><br>Any help with this would be greatly appreciated as I'm running out of<br>hair.<br><br>Version and config included below.<br><br>Cheers,<br><br>prk.<br><br><br>Version:<br><br>#sh ver<br> SW: Version 09.3.00aTD4 Copyright (c) 1996-2003 Foundry Networks, Inc.
<br> Compiled on Apr 25 2005 at 21:02:19 labeled as WXR09300a<br> HW: ServerIronGT E-1 Router, SYSIF version 21, Serial #: Non-exist<br>==========================================================================<br>SL 1: B0GMR WSM2 Management Module, SYSIF 2, M6, ACTIVE
<br> Serial #: CHxxxxxxxx<br> 0 MB SHM, 1 Application Processors<br>16384 KB BRAM, SMC version 5, BM version 21<br> SW: (1)09.3.00aTF2<br>==========================================================================
<br>SL 3: J-B2404CF JetCore Slave Module, SYSIF 2 (Mini GBIC)<br> Serial #: CXxxxxxxxx<br> 4096 KB BRAM, JetCore ASIC IPC+IGC version 49, BIA version 8a<br>32768 KB PRAM and 2M-Bit*1 CAM for IPC 8, version 1848<br>
32768 KB PRAM and 2M-Bit*1 CAM for IGC 9, version 0449<br>==========================================================================<br>Active management module:<br> 1.0 GHz Power PC processor 750GX (version 7002/0101) 66 MHz bus
<br> 512 KB boot flash memory<br>16384 KB code flash memory<br> 512 KB SRAM<br> 512 MB DRAM<br>The system uptime is 6 hours 29 minutes 29 seconds<br>The system : started=warm start reloaded=by "reload"<br><br>
<br>Config:<br><br>!<br>ver 09.3.00aTD4<br>!<br>module 1 bi-0-port-wsm2-management-module<br>module 3 bi-jc-2404-slave-module<br>!<br>global-stp<br>global-protocol-vlan<br>!<br>!<br>!<br>!<br>!<br>!<br>!<br>server ping-interval 5
<br>server predictor response-time<br>server syn-limit 2000<br>server sticky-age 15<br>server tcp-age 2<br>server udp-age 2<br>!<br>server port 25<br> tcp keepalive 60 2<br>server icmp-message<br>server reset-message<br>server router-ports ethernet 3/1
<br>!<br>!<br>!<br>!<br>server real mail1 <a href="http://10.200.41.1">10.200.41.1</a><br> port smtp<br> port smtp clear-all-seesion-on-port-up<br> port smtp keepalive<br>!<br>server virtual mail-backend 203.x.y.z<br> predictor least-conn
<br> advertise-vip-route<br> port smtp<br> port smtp dsr<br> port smtp reset-on-port-fail<br> bind smtp mail1 smtp<br>!<br>!<br>vlan 1 name DEFAULT-VLAN by port<br>!<br>vlan 254 name Admin by port<br> tagged ethe 3/1<br> router-interface ve 254
<br>!<br>vlan 41 name Untrusted2 by port<br> tagged ethe 3/1<br> router-interface ve 41<br>!<br>vlan 253 name External_SLB by port<br> tagged ethe 3/1<br> router-interface ve 253<br>!<br>hostname blah<br>ip dns domain-name
<a href="http://blah.com">blah.com</a><br>ip dns server-address <a href="http://1.2.3.4">1.2.3.4</a><br>ip route <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://10.200.254.254">10.200.254.254
</a><br>!<br>logging buffered 200<br>!<br>router ospf<br> area 253<br> redistribution static<br> log adjacency<br>!<br>interface ethernet 3/1<br> port-name uplink<br>!<br>interface ve 41<br> ip address <a href="http://10.200.41.250">
10.200.41.250</a> <a href="http://255.255.255.0">255.255.255.0</a><br>!<br>interface ve 253<br> ip address <a href="http://10.200.253.250">10.200.253.250</a> <a href="http://255.255.255.0">255.255.255.0</a><br> ip ospf area 253
<br>!<br>interface ve 254<br> ip address <a href="http://10.200.254.15">10.200.254.15</a> <a href="http://255.255.255.0">255.255.255.0</a><br>!<br>!<br>end<br><br>_______________________________________________<br>foundry-nsp mailing list
<br><a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a><br><a href="http://puck.nether.net/mailman/listinfo/foundry-nsp">http://puck.nether.net/mailman/listinfo/foundry-nsp</a><br></blockquote></div>
<br>