On 2019-06-10 03:35 AM, Per Jessen wrote:

First thought - just a cross-over cable between two interfaces. Or multiple bonded ditto. That's how we run our storage servers with drbd.

Crossover cables are only needed with 10 & 100 Mb.  Gigabit & 10G use all 4 pairs in both directions. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2019-06-10 08:48 AM, Per Jessen wrote:

James Knott wrote:

...

...

First thought - just a cross-over cable between two interfaces. Or multiple bonded ditto. That's how we run our storage servers with drbd. Crossover cables are only needed with 10 & 100 Mb.  Gigabit & 10G use all 4 pairs in both directions. The latter I knew, but it had not occurred to me that it would eliminate

On 2019-06-10 03:35 AM, Per Jessen wrote: the need for a cross-over cable. Thanks.

Even at 100 Mb, newer equipment can often automagically detect what's at the other end. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/10/2019 12:35 AM, Per Jessen wrote:

Lew Wolfgang wrote:

...

Hi Folks,

I've got an interesting network configuration problem that I'd like to run by you all.

At this time I've got a server that connects to a switch at 1GbE over Cat-6 copper with RJ-45 connections. I don't have admin rights on the switch and it uses MAC address authentication to turn on the port.

The server is rather important and contains about 400-TB of data in multiple RAID-6 arrays.  I've received authorization to purchase a second "mirror" server to act as a warm spare. They will have a private 192.168 subnet via second Ethernet ports, maybe 10GbE, to synchronize the data on a regular basis between the servers. So not a hot standby, more like a backup copy, but always fairly recent?

Yes, maybe sync the deltas from the active box to the standby every six hours or so?  Maybe even daily would work okay.  The really dynamic function being served is Subversion.  Users would still have local checked-out copies of their data if something went wrong.  svnserve has a nifty script that does hot-backups of repositories, and I think it could even be configured to automatically replicate onto a second server.  I'd have to play around with that one.

...

What's the best way to hook these up? First thought - just a cross-over cable between two interfaces. Or multiple bonded ditto. That's how we run our storage servers with drbd.

Yes, the servers have two Ethernet interfaces, one will connect to a back-end subnet for syncing/backups.   There are some other servers back there that never leave the 192.168.4.0/24 subnet.  NAT is not used, there's no IP forwarding going on.

...

I'm thinking of something like an RJ-45 A/B switch to manually connect one or the other server to the upstream switch.  But then, it looks like simple switches just pass through the two back MAC addresses, and I need the A/B switch to present the same MAC to upstream at all times. As you have funding for purchasing a secon d server, might it not be feasible to have the 2nd MAC authorised on the upstream switch?

Yes, a second MAC and port could be used, but then each server would have different IP addresses.  We've got about 100 local users using svnserve, samba, NFS, and direct ssh logins, and we need to be able to quickly switch between the two servers transparently.  A DNS CNAME could be used, but the switch time would depend on caches timing out.  I wouldn't think that switching would happen very often, but it would be nice if it could be locally deterministic. A smooth transition would involved shutting down the active interface on A, then do a delta data-sync to the B via the back-end interfaces, then switch upstream from A to B, then bring up B's interface. I think this could be done with "macchanger", but I've never fiddled with it. Of course, a sudden failure of A, with subsequent switching to B, would be messier and possibly loose data, but such is life.  At least the whole system wouldn't be down for an extended period of time. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 6/10/19 9:12 AM, Dave Howorth wrote:

On Mon, 10 Jun 2019 07:46:30 -0700 Lew Wolfgang wrote:

...

Yes, a second MAC and port could be used, but then each server would have different IP addresses. Not so, it's a lot easier to use the same IP address for the two machines if only one will be connected at any time.

Yes, I agree.  But upstream, over which I have no control, maps IP addresses with MAC addresses.  Also, static IP's aren't allowed, DHCP only.   It's also a dual-stack  v4/v6 network, which complicates things. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 6/10/19 11:01 AM, Per Jessen wrote:

Lew Wolfgang wrote:

...

On 6/10/19 9:12 AM, Dave Howorth wrote:

...

On Mon, 10 Jun 2019 07:46:30 -0700 Lew Wolfgang wrote:

...

Yes, a second MAC and port could be used, but then each server would have different IP addresses. Not so, it's a lot easier to use the same IP address for the two machines if only one will be connected at any time. Yes, I agree.  But upstream, over which I have no control, maps IP addresses with MAC addresses. This is not just ARP I take it?

Correct, not just ARP.

...

Also, static IP's aren't allowed, DHCP only.   It's also a dual-stack v4/v6 network, which complicates things. Presumably you have DHCP clients on your primary ond your standby? That's fine, but if you can't reserve one fixed address, that makes a bit more problematic. The dual stack does not matter.

Yes, the servers run DHCP clients.  I use dnsmasq to control the private subnet behind the servers. Yes, I can't reserve a static IP addy.  MAC addresses are manually entered into an LDAP database which is used to open a switch port when that MAC appears on a port.  The DHCP-dispensed IP addy comes from that same LDAP database. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 6/10/19 11:29 AM, Per Jessen wrote:

Lew Wolfgang wrote:

...

On 6/10/19 11:01 AM, Per Jessen wrote:

...

Lew Wolfgang wrote:

...

On 6/10/19 9:12 AM, Dave Howorth wrote:

...

On Mon, 10 Jun 2019 07:46:30 -0700 Lew Wolfgang wrote:

...

Yes, a second MAC and port could be used, but then each server would have different IP addresses. Not so, it's a lot easier to use the same IP address for the two machines if only one will be connected at any time. Yes, I agree.  But upstream, over which I have no control, maps IP addresses with MAC addresses. This is not just ARP I take it? Correct, not just ARP.

...

...

Also, static IP's aren't allowed, DHCP only.   It's also a dual-stack v4/v6 network, which complicates things. Presumably you have DHCP clients on your primary ond your standby? That's fine, but if you can't reserve one fixed address, that makes a bit more problematic. The dual stack does not matter. Yes, the servers run DHCP clients.  I use dnsmasq to control the private subnet behind the servers.

Yes, I can't reserve a static IP addy.  MAC addresses are manually entered into an LDAP database which is used to open a switch port when that MAC appears on a port.  The DHCP-dispensed IP addy comes from that same LDAP database. Okay, so the usual method is out.

Hmm, any reason why you couldn't put a box between the upstream and your two servers? I am thinking of using LVS, but you're going to need to a fixed address. Unless you would want to redefine the LVS setup on every change of address. Actually, that could work. Put a box between upstream and your two storage boxes. This box gets a DCHP address from upstream, your storage boxes have fixed IPs, private network. The LVS setup has to be reconfigured if the address changes, but that's doable.

Now that's a thought,  I'll have to stew on that one.  I've never used LVS and will have to brush up a bit. Thanks Per. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2019-06-10 03:16 PM, Dave Howorth wrote:

or the MAC addresses for that matter?

I believe the OP mentioned switch port security, where only specific MAC addresses are allowed on a given port.  That's to keep people from plugging foreign devices into the network. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Lew Wolfgang wrote:

On 06/10/2019 12:35 AM, Per Jessen wrote:

...

Lew Wolfgang wrote:

...

Hi Folks,

I've got an interesting network configuration problem that I'd like to run by you all.

At this time I've got a server that connects to a switch at 1GbE over Cat-6 copper with RJ-45 connections. I don't have admin rights on the switch and it uses MAC address authentication to turn on the port.

The server is rather important and contains about 400-TB of data in multiple RAID-6 arrays.  I've received authorization to purchase a second "mirror" server to act as a warm spare. They will have a private 192.168 subnet via second Ethernet ports, maybe 10GbE, to synchronize the data on a regular basis between the servers. So not a hot standby, more like a backup copy, but always fairly recent?

Yes, maybe sync the deltas from the active box to the standby every six hours or so?  Maybe even daily would work okay. 

Much depends on the purpose of the standby - how up-to-date the information has to be.

Yes, a second MAC and port could be used, but then each server would have different IP addresses. 

Not necessarily - as in a high-availability setup, you could assign a 2nd IP address that moves between the primary and the standby. So you might have 192.168.123.1 (primary) and 192.168.123.2 (standby) and 192.168.123.99 as server address.

We've got about 100 local users using svnserve, samba, NFS, and direct ssh logins, and we need to be able to quickly switch between the two servers transparently. 

I would say a moving IP address is what you need. -- Per Jessen, Zürich (17.4°C) http://www.cloudsuisse.com/ - your owncloud, hosted in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

10.06.2019 20:24, Lew Wolfgang пишет:

On 6/10/19 9:33 AM, Per Jessen wrote:

...

...

We've got about 100 local users using svnserve, samba, NFS, and direct ssh logins, and we need to be able to quickly switch between the two servers transparently. I would say a moving IP address is what you need.

But that would require those 100 users to change their various client configurations to track which server is on-line.

No, it won't. They will continue to use the same IP address. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Lew Wolfgang wrote:

On 6/10/19 10:27 AM, Andrei Borzenkov wrote:

...

10.06.2019 20:24, Lew Wolfgang пишет:

...

On 6/10/19 9:33 AM, Per Jessen wrote:

...

...

We've got about 100 local users using svnserve, samba, NFS, and direct ssh logins, and we need to be able to quickly switch between the two servers transparently. I would say a moving IP address is what you need. But that would require those 100 users to change their various client configurations to track which server is on-line. No, it won't. They will continue to use the same IP address.

But the well-known IP address is tied to only one of the server's via its MAC.  The upstream network maps IP's to MAC's, so to have a static IP I'd need a static MAC. I've got only low-level web-based access to the DNS system, which limits my options.

"The upstream network maps IP's to MAC's," - what does that mean? You have two static MAC addresses, each has a fixed address, and one address can move between them, by way of ARP. It's a perfectly normal HA setup.

The most reliable method would have users not using IP's or A-record hostnames, but only a CNAME that can be changed as needed. 

What is wrong with giving your users a servername = lew.example.com = 192.168.123.99 As the address is assigned on the primary, they go to the primary. When the address is assigned on the standby .... It sounds like there is a restriction in your network that we don't know about? -- Per Jessen, Zürich (15.8°C) http://www.cloudsuisse.com/ - your owncloud, hosted in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org