2 Replies Latest reply on Feb 25, 2013 10:08 PM by Jon Scholten

    Changing VRRP Settings in a MWG HA-Cluster environment - supported?


      Hi all,

      has anyone a hint for me? Does anyone know if this is supported? We want to change the VRRP behavior of MWG VRRP.


      Problem: If MWG is rebooted or a MWG service is not running the appliance gets traffic anyway. When rebooting the system the appliance gets webtraffic redirected until the IP is not reachable.


      Therefore my question: Is it possible to change the VRRP settings on MWG so listen to the MWG services? If possible, is it supported?


      Goal shout be: If there is any service not running, stopping and so on the system should not get any traffic to handle.




        • 1. Re: Changing VRRP Settings in a MWG HA-Cluster environment - supported?

          This kinda scares me, I was told that Proxy HA 'was' process and load aware...and I am currently building two boxes to form ours up into twin HA deployments.

          • 2. Re: Changing VRRP Settings in a MWG HA-Cluster environment - supported?
            Jon Scholten

            Hi Troja,


            The MWG will perform a port health check to see if the defined proxy ports are listening.


            So for your "Port redirects" that you defined when you setup ProxyHA, are the same proxy ports that MWG uses to check and determine if a node should be included in the HA cluster (to be a scanning or director node).


            I have had many customers misconfigure the port redirects, they would add 9090, and 2121 (FTP proxy was disabled). This would cause the node to stand down as a whole because one of the proxy port definitions was not reachable.


            So in essence, I would imagine what you are saying should happen. If the MWG services are off, there shouldnt be any listeners, therefore the MWG should not be ready to accept traffic and be apart of the proxy HA cluster.


            To test this you can run the following command on each node while the services are stopped (or in varying states):

            mfend-lb -s

            (i may be wrong)


            However, there may be a short period of time while the VIP is transferred from one director to the backup-director (in the case of a reboot), during this time the gratuitous ARP should be propigating through the network.