Clarification: role of VIP in circuit commnd & redundancy issue

[emilyharris]

I'm in the process of configuring redundant load balancers of the 11503 variety using active/backup virtual interface redundancy + ASR, as recommended by Cisco's CSS Redundancy Configuration Guide. My load balancer is in production - I'm setting up the new one off-line which will become the active CSS, after which the production one will become the backup CSS.

Here's my question: the setup instructions talk about the VIP IP on the circuit. Our configuration does NOT use a global VIP in the circuit configuration. All our VIPs are assigned to content rules, and we have one outgoing VIP.

Here are the circuits for my existing load balancer (IPs have been changed):

circuit VLAN96

ip address 10.1.1.8 255.255.255.0

circuit VLAN172

ip address 172.18.50.1 255.255.0.0

The "10.1.1.8" address is the uplink to our network. The "172.18.50.1" address is the internal IP, and therefore the servers' GW address.

Do I *need* a circuit-VIP to configure redundancy? What happens if I do not issue the "ip redundant-vip" command on the load balanced CSSes? What is the ROLE of that VIP, when all my VIPs are configured on the content rules specifically?

Thank you - any advice and clarification would be EXTREMELY helpful.

[emilyharris]

I *think* I answered my own question (it pays to browse all the docs). But I'm still seeking clarification.

The docs say you must configure the redundant VIP on the circuit. However, the VIP IP MUST be the same IP as a VIP on a content rule.

Does this mean that the only flows which will maintain connectivity are the ones that use that main VIP? What about all my other VIP addresses assigned to individual content rules?

Again, any help would be appreciated.

[diro]

You are using active/backup trough vrid redundancy. This means that both css boxes will stay live. So they should know which box should respond to which arp request of which vip. That's why you need to create vrid's coupled to a circuit, and then couple your redundant vip to the vrid on the cicuit. Now why that complex binding? because you can run multiple vrid's where some off them are in active state on box 1 and others our active on box 2. Meaning that both boxes can be operational for diffrent vip's when one box fails the other one takes over the vips of the failed one. So every vip should be bound to a vrid!

[emilyharris]

That's what I thought - my sticking point is that I cannot find a configuration example. Is it as simple as assigning mulitple VRIDs to a circuit, in addition to the multiple VIPs?

For example:

circuit VLAN2

ip address 192.1.1.1 255.255.255.0

ip virtual-router 5 priority 101 preempt

ip redundant-vip 5 192.1.1.100

ip redundant-interface 5 192.1.1.254

ip critical-service 5 uptream_downstream

ip virtual-router 10 priority 101 preempt

ip redundant-vip 10 192.1.1.99

ip redundant-interface 10 192.1.1.253

ip critical-service 10 upstream_downstream

Does that make sense? Is that how it is done?

[diro · Accepted solution]

you can assign multiple redundant vips to the same virtual router. In your example i asume that both vrids will be the active ones on that css: then it doesn't add any extras in creating more than one vrid. If you want all vips active on one css then you can also use box-to-box redundancy.

[diro]

here you can find an example

http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a0080157898.html#1015553

[emilyharris]

That example is only one VIP. I am looking for a concrete example of multiple VIP redundancy.

In your previous post, you said I did *not* need to use multiple VRIDs, but I could assign multiple redundant VIPs. Does that mean that the configuration would look like this:

circuit VLAN2

ip address 192.1.1.1 255.255.255.0

ip virtual-router 5 priority 101 preempt

ip redundant-vip 5 192.1.1.100

ip redundant-vip 5 192.1.1.99

ip redundant-vip 5 192.1.1.98

ip redundant-interface 5 192.1.1.254

ip critical-service 5 uptream_downstream

[diro]

yes

[skumar1969]

You wouldn't need this command under the Client VLAN circuit, "ip redundant-interface 5 192.1.1.254"

Use of such command make more sense when used under the Server VLAN circuits, where the servers pointing their DG to this ip.

eg. ip redundant-interface 10 172.18.50.1

thanks