Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 2 subscribers
  • Views 7466 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to tell which Node is hosting a EIP in a Cluster on AWS

ZP.

Hi there

 

This is probably a really stupid question, but 

 

1) In a H/A Deployment of UTM on AWS, how do I tell which node is hosting the EIP from inside the WebUI of the UTM, and if there are multiple EIPs how do I tell this also? And can I tell this from AWS Console also if both Nodes already have their own Extertnal IPs showing from the Instance Manager inside of AWS EC2

 

Thanks  



This thread was automatically locked due to age.
  • 0

    Also. When I restart a device, with the devices in a Warm Failover configuration, as per the template online here (https://community.sophos.com/kb/hu-hu/122202)  ... The EIP does not move from the primary node to the second. I would expect on a restart, that the EIP should move, as it does on Brocade Traffic Manager , near instantly (few seconds etc).. However on my setup, the EIP stays bound to the node which is restarting. Is that normal behaviour, and is it customisable?

     

    Thanks 

  • 0 in reply to ZP.

    Zak, if you did any configuration of the second instance, this is broken.  The EIP should transfer over.  The fact that it doesn't and that you're having other issues probably means you need to start over.  You should be able to restore from backup after you create the new instance.  Was that the issue?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thanks Bob, appreciate the reply

     

    Yep , no configuration after deployment , basically just testing pure fail over and no go. Have deployed multiple VPCs from the Warm standby template and still the issue persists. Sophos Support mention to contact AWS support..

     

    Abit of a shame really. The only time the IP will move, is if the machine is shutdown, or the machine manually terminated, then it will move.

     

    THanks for the help

  • 0 in reply to ZP.

    "The only time the IP will move, is if the machine is shutdown" - In "Hot" Standby with physical devices, the only time there's a fail over is when the device fails or one of the monitored interfaces fails.  What are you doing to test the behavior?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thank you Bob.

     

    Is this the case on AWS as well? I am just restarting the device and expecting it to fail over the EIP.. If i shutdown the device however, the EIP moves accross to the other firewall, as it spawns a new instance.

    It doesnt seem right that the EIP doesnt fail over on a restart. In the physical world that would be the case or as virutal appliances with a sync interface..I run a Brocade load balancer cluster and that will fail over a EIP on restart.

     

    I have deployed about different Cloudformation warm failover templates and its the case on all 4. Just wanted to make sure I wasnt doing anything wrong. On some of these deployments I made no changes just to ensure it wasnt something I was doing.

     

    Thanks for the help

     

  • 0 in reply to ZP.

    I've not yet moved anyone to HA in AWS because I don't think the template for moving existing AWS instances to HA is reliable at this point, so I don't have any direct experience.

    You're describing "hot" fail over with the load balancer, and this is "warm" fail over.  I suspect that disabling the interface in the running instance would cause fail over to the "Warm Standby" instance and that the EIP would follow.  Does it work like that?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Ok thanks for the reply.

     

    So I timed it all, it takes about 10minutes from stopping one instance, to having the Elastic IP moved to the second instance, and a new isntance spawned. So its pretty slow.

     

    At this point I think Sophos need to look into better adjusting their cloud template to allow for the move EIP command to be done sooner. 

     

    I found a command, that I can manually move the EIP between two nodes in different availibility zones, with just 2 ping drop outs, which is quite a cool thing. 

  • 0 in reply to ZP.

    Cool!  Please share, Zak.

     

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0

    To move EIP from one Node , to another : 

    aws ec2 associate-address --instance-id i-xxxxxxxxx --allocation-id eipalloc-xxxxxxxx

     

    Use the AWS CLI

     

    Another question

     

    I am trying to bind multiple EIPs to a single interface..

     

    I can add multiple private IPs with no issue, eg eth0  10.0.0.5 , 10.0.0.6, howver I can only add one EIP to each interface it seems. In this case, 10.0.0.5 having a EIP no problem, but if I try add a EIP to 10.0.0.6, which is on teh same interface, it just removes the exisitng EIP, and replaces with the new EIP I am trying to add.

     

    Is anyone aware of how to get around this?

     

    Also, you can see from the AWS console, which node is hosting an EIP , so if it is in a cluster, click on your running Sophos UTM instance, and it will show you what EIP it is hosting.

     

    Hope that helps / hope someone can help me 

     

    Thanks 

Unfiltered HTML