What will be happen to live and existing connections when failover HA BIG IP active-standby

Question

Good morningI have a little question, when we create HA configuration with active-standby mode, with Mac Masquerade configuration. What will be happen to live and existing connections? They will be disrupted when we do failover? or will the network device immediately find the standby device that has the same masquerade mac and floating ip without any timeout process first?Thank you

akonu · Answer

Zen_Y .To maintain active connections when a failover occurs, you will need to configure connection mirroring.&nbsp;
I found some information that could help answer your questions on our myf5 portal, please click on the links below .K84303332: Overview of connection and persistence mirroring (13.x - 16.x)https://my.f5.com/manage/s/article/K84303332
Manual Chapter : Managing Connection Mirroringhttps://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-device-service-clustering-admin-11-5-0/9.htmlOn the other hand MAC masquerade optimizes the flow of traffic during failover events
K13502: Configuring MAC masquerade (11.x - 17.x)https://my.f5.com/manage/s/article/K13502.
I hope this helps.

zen_y · Answer

Hi akonu&nbsp;This is interesting, I have read several articles about mirroring connections, but in the implementation in reality, I have not implemented this. Is there any information about the impact of this implementation? such as increasing cpu, memory, network load or even certain bugs that must be avoided on both active and standby devices?And when we do not implement a mirroring connection, will the existing connection time out before it finds a new active device?

paulius · Answer

This is dependent on how the application handles a no response. I would say from a TCP perspective, the connection would time out, it would inform the user of the connection loss and you would have to refresh the connection or resend the request.

zen_y · Answer

doesn't a timeout event occur when a network device doesn't find the appropriate IP and MAC address to send data? while when we do a failover with the same IP vs, IP data, and MAC address recognized by the server side and client side, will they also fail to find a new device without going through the timeout process?when failover, I once tried to do a ping test, I don't know if this will be relevant to real traffic or not, but there was no timeout status. Doesn't this mean that the network device can receive a new IP and MAC on a previously inactive device, and immediately flow traffic there?

paulius · Answer

ICMP traffic is not an active flow that requires an established connection such as TCP. Would this failover be a manual failover or a failover due to a device fault? If this is a manual failover you probably wouldn't notice any drops if any, if the device has a fault then you would most definitely notice the failover because the device in good health would have to run through the entire failover timeout before failing over. If your business can afford some testing I would schedule failover testing during low traffic period and run through different failures to see what happens. You should test continuous ICMP as well as copying data to and from something being load balanced. I would do the following tests.

Issue a manual failover from unit 0 to unit 1 and then back after 10 minutes.
Reboot the active unit, wait for it to come back up completely, reboot the new active unit and wait the same amount of time.
On the active unit unplug an interface but not the management interface. Repeat this for each interface less the management interface on each unit after you wait for 5 minutes after plugging the interface back in.

For number 3 you would bounce back and forth between the units. As an example, if you had 2 interfaces plugged in less the management interface you would do the following assuming Unit 0 is the active unit.

Unit 0 unplug interface 1.
Wait 5 minutes then Unit 1 unplug interface 1.
Wait 5 minutes then Unit 0 unplug interface 2.
Wait 5 minutes then Unit 1 unplug interface 2.

Make sure you clearly record each step of connectivity testing so you know exactly how the device will behave. You should test each unique application such as email load balancing, http, ftp, and so on. You do not have to test multiple of each unless they have something that makes then drastically different.

Forum Discussion

What will be happen to live and existing connections when failover HA BIG IP active-standby

Recent Discussions

Switch ssl profile based on weak cipher detection via IRULE

ports are showing open on online scanning tool

F5 DDOS Solution

iRule for public IP access to specific section of my URL

APM RDP custom parameters

Related Content

F5 Active Standby Node Configuration

When Active/Standby failover send mail

add core guest step by step on active standby guest

VLAN Failsafe failover settings change on STANDBY device - affect ACTIVE device?

Site-to-Site Connectivity in F5 Distributed Cloud Network Connect – Reference Architecture

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS