topic Re: CSS11501 - Unable to Telnet to VRRP backup interface IP in Application Networking

CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Tue, 01 Mar 2011 06:16:39 GMT

Hi,

I have 2 units of Cisco CSS11501 which configured running on VRRP active/standby on 2 different VLAN (Circuit). When unit 1 is master unit, I am able to telnet to its circuit IP address, but unable to telnet to any circuit IP of backup unit.

Active unit configuration:

!************************** CIRCUIT **************************

circuit VLAN145

ip address 172.19.145.182 255.255.255.0

ip virtual-router 1 priority 101

ip redundant-vip 1 172.19.145.184

ip redundant-interface 1 172.19.145.183

circuit VLAN550

ip address 192.168.50.18 255.255.255.0

ip virtual-router 2 priority 101

ip redundant-vip 2 192.168.50.20

ip redundant-interface 2 192.168.50.19

!*************************** OWNER ***************************

owner ***

content ***

vip address 172.19.145.184

port 80

protocol tcp

add service ***

active

!*************************** GROUP ***************************

group ***

vip address 192.168.50.20

active

Backup unit configuration:

!************************** CIRCUIT **************************

circuit VLAN145

ip address 172.19.145.183 255.255.255.0

ip virtual-router 1 priority 90

ip redundant-interface 1 172.19.145.182

ip redundant-vip 1 172.19.145.184

circuit VLAN550

ip address 192.168.50.19 255.255.255.0

ip virtual-router 2 priority 90

ip redundant-vip 2 192.168.50.20

ip redundant-interface 2 192.168.50.18

!*************************** OWNER ***************************

owner ***

content ***

vip address 172.19.145.184

port 80

protocol tcp

add service ***

active

!*************************** GROUP ***************************

group ***

vip address 192.168.50.20

active

Please help!!

Regards,

Danny Lim

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

IAN WHITMORE — Tue, 01 Mar 2011 10:36:16 GMT

Can you ping the backup unit IPs?

Are the routes good?

And the management route?

Is your asr configured correctly?

Have you got an app-session established? In this case you can use rcmd to check the config and connect to the backup CSS.

On another note, can't see any preemption in your vrrp config.

Regards,

Ian

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

Marko Leopold — Tue, 01 Mar 2011 11:12:45 GMT

Your configuration should look like this:

Master

----------

circuit VLAN145

ip address 172.19.145.182 255.255.255.0

ip virtual-router 1 priority 101

ip redundant-vip 1 172.19.145.184

ip redundant-interface 1 172.19.145.181

circuit VLAN550

ip address 192.168.50.18 255.255.255.0

ip virtual-router 2 priority 101

ip redundant-vip 2 192.168.50.20

ip redundant-interface 2 192.168.50.17

Backup

----------

circuit VLAN145

ip address 172.19.145.183 255.255.255.0

ip virtual-router 1 priority 90

ip redundant-interface 1 172.19.145.181

ip redundant-vip 1 172.19.145.184

circuit VLAN550

ip address 192.168.50.19 255.255.255.0

ip virtual-router 2 priority 90

ip redundant-vip 2 192.168.50.20

ip redundant-interface 2 192.168.50.17

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Tue, 01 Mar 2011 14:31:47 GMT

I did not configure the management port, I thought to Telnet any of the circuit IP address. So I think I should make use of management port for Telnet.

I want to have active-backup redundancy with these 2 units of CSS, so I use VIP/Virtual Interface redundancy instead of ASR.

VRRP preemption is not a requirement.

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Tue, 01 Mar 2011 14:34:15 GMT

Hi Marko,

For configuring "ip redundant-interface", I thought the IP addresses to be configured with this command is the physical IP address of another box in the same circuit (VLAN)?

am I wrong?

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

IAN WHITMORE — Tue, 01 Mar 2011 14:36:32 GMT

VRRP preemption is not a requirement.

Sure it's not. Justing making sure you didn't forget it. It's more usual to have preemption in an active-standby topology.

Regards,

Ian

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

Marko Leopold — Tue, 01 Mar 2011 14:40:23 GMT

yes. redundant-interface is the interface that you want to have redundant. They not mean the peer interface. Its like the alias-address. With redundant-vip you also configure the vip, which should be redundant on both CSS.

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Tue, 01 Mar 2011 14:40:52 GMT

Hi Ian,

Thanks and noted. It is not a requirement because I do not want to have another failover happened again when the preempted unit comes alive. Anyway, your comments is noted.

I should have used management port with another IP for Telnet to manage the box, am I right?

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

IAN WHITMORE — Tue, 01 Mar 2011 14:52:49 GMT

Well you can (I like to) but its a matter of choice. Its good for out of band management to another switch...but it's not necessary. You should be able to telnet to your other interfaces though and to be honest telnet doesn't use much in the way of bandwidth.

You might want to consider the app_session commands though. They are really smart and then you can use the comit_Vip_redundancy scripts to automatically backup your config from your primary to secondary CSS. It's a built in script and saves a lot of time. You can even program it using expect or something to do a nightly backup/copy.

Also, like I said the rcmd command is great if you are connected to one of the CSS and want to issue a command on the other...no need to open up another putty session...but thats just being lazy

Regards,

Ian

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Tue, 01 Mar 2011 14:54:13 GMT

Hi Marko,

That means I could not to configure redundant-interface as I have redundant-vip configured already?

Actually the topology is:

VLAN550 is connecting to server farm

VLAN145 is where user sitting

my current config :

circuit VLAN145

ip address 172.19.145.182 255.255.255.0

ip virtual-router 1 priority 101

ip redundant-vip 1 172.19.145.184

ip redundant-interface 1 172.19.145.183

ip critical-service 1 PING_DEFAULT_GATEWAY

circuit VLAN550

ip address 192.168.50.18 255.255.255.0

ip virtual-router 2 priority 101

ip redundant-vip 2 192.168.50.20

ip redundant-interface 2 192.168.50.19

ip critical-service 2 PING_DEFAULT_GATEWAY

!*************************** OWNER ***************************

owner HLRLDAP

content VIP_LDAP_16611

vip address 172.19.145.184

port 16611

protocol tcp

add service KPG-HV30-3

add service KPG-HV30-6

active

!*************************** GROUP ***************************

group Redundant_Server

vip address 192.168.50.20

active

So, I should have change my config like this:

CSS1

---------

circuit VLAN145

ip address 172.19.145.182 255.255.255.0

ip virtual-router 1 priority 101

ip redundant-vip 1 172.19.145.184

ip redundant-interface 1 172.19.145.181

ip critical-service 1 PING_DEFAULT_GATEWAY

circuit VLAN550

ip address 192.168.50.18 255.255.255.0

ip virtual-router 2 priority 101

ip redundant-interface 2 192.168.50.20

ip critical-service 2 PING_DEFAULT_GATEWAY

CSS2

-----------

!************************** CIRCUIT **************************

circuit VLAN145

ip address 172.19.145.183 255.255.255.0

ip virtual-router 1 priority 90

ip redundant-interface 1 172.19.145.181

ip redundant-vip 1 172.19.145.184

ip critical-service 1 PING_DEFAULT_GATEWAY

circuit VLAN550

ip address 192.168.50.19 255.255.255.0

ip virtual-router 2 priority 90

ip redundant-interface 2 192.168.50.20

ip critical-service 2 PING_DEFAULT_GATEWAY

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Tue, 01 Mar 2011 14:58:41 GMT

Hi Ian,

I hit the problem which I only able to Telnet the IP address of circuit VLAN145 in master VRRP box. I can ping the IP address of the circuit VLAN145 in backup VRRP box, but not to Telnet. I am not sure if I configured wrongly ...

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

Marko Leopold — Tue, 01 Mar 2011 15:19:49 GMT

The redundant configuration on your circuit means, which virtual ip-address you want to failover if your master VRRP device is having a failure. This means you can configure which VIP(s) you want to have redundant and which alias interface ip-address(es) you want to have redundand. This config you provide now should work and you should be able to reach CSS1 with 172.19.145.182 and CSS with 172.19.145.183. 172.19.145.181 is the alias ip-address which is not reachable through telnet. Just checked it as we have the same configuration here.

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Wed, 02 Mar 2011 10:28:01 GMT

Hi Marko,

Currently the loadbalancing and VRRP seem working fine, but I have problem to telnet to 172.19.145.183 which is the backup VRRP unit. I can ping to it but not telnet.

Anyhow, I will fine tune the VRRP configuration like I posted here earlier, and configure the management port with IP address and give a try again. Will update you guys later!!

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

Marko Leopold — Wed, 02 Mar 2011 10:51:24 GMT

Actually there should be no problem with this configuration and you should be able to reach both devices. So i consider you have another problem in your configuration. To use the management port will help maybe, but it will not solve the problem.

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

pablo.nxh — Wed, 02 Mar 2011 18:29:49 GMT

Hi,

Check if ACLs are enabled on the box, perhaps the ACL for that circuit is not properly configured/applied.

Have you tried SSH on that circuit? If ping works then you should check if the command "restrict telnet" is not configured on slave CSS.

HTH

__ __

Pablo

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Thu, 03 Mar 2011 05:29:33 GMT

Hi Pablo,

I have no ACL configured and also no command "restrict telnet" is configured.

I can only telnet to the master CSS whichever holding the VRRP master role, the slave CSS is always only can be PING but not telnet ... weird!!

Re: CSS11501 - Unable to Telnet to VRRP backup interface IP

danny2125 — Wed, 23 Mar 2011 03:56:12 GMT

The problem was solved, I am now able to telnet to active and backup interface IP.

This was due to I did configure the VRRP wrongly like what we discussed earlier.

Thanks everyone for helping!! Cheers!