Re: IP Filter and IPMP on Solaris 10 (ipf 3.0.4, pfil 2.1.4)

Thanks Jeff,

We've traditionally just used both interfaces in the IPF rules (Sol
9),
but sometimes sessions seem to hang - not sure if that's the app
or IPF+IPMP when the "other" interface is not standby, or when
a failover occurs. Rules have "flags S keep state" or similar.

We'll play around a bit more with if_mpadm -d and -r ...


What I'm concerned about is whether the state table recognises
that both interfaces are effectively the same from the point
of view of the failover virtual address(es). So it's okay if packets
on an established TCP session with 'flags S/xxx keep state'
are coming in on another port in the same group (similarly,
if the other NIC is not in standby mode, then outgoing packets
may be loadbalanced out the other NIC).

Many of our interfaces are active/standby, but where there are
more than one virtual IP in use over IPMP these are generally
spread across the NICs in an active/active configuration.


As another way of looking at it, what's this for, if it's not
needed or not used:
ndd -set /dev/pfil qif_ipmp_set virtual=phys0,phys1
ndd -get /dev/pfil qif_ipmp_status

Meantime, we're also trying ipfilter 4.1.15 on Solaris 10.
(&tried "find|grep" for qif_ipmp through 4.1.15 code, no luck?!)

Rgds, Stuart.


>>>
From: "Jeff A. Earickson" <jaearick@colby.edu>
To: Stuart Remphrey <stuart.remphrey@rmit.edu.au>
Date: 30-Nov-06 6:52 am
Subject: Re: IP Filter and IPMP on Solaris 10 (ipf 3.0.4, pfil
2.1.4)

CC: <ipfilter@coombs.anu.edu.au>
Stuart,

Attached are my notes on how to configure link-based (not probe-based)
IPMP for Solaris 10. There is nothing special that you have to do
with ipfilter other than create rules for both interfaces, eg bge0
and bge1.

Jeff Earickson
Colby College

On Wed, 29 Nov 2006, Stuart Remphrey wrote:

> Date: Wed, 29 Nov 2006 15:21:50 +1100
> From: Stuart Remphrey <stuart.remphrey@rmit.edu.au>
> To: ipfilter@coombs.anu.edu.au
> Subject: IP Filter and IPMP on Solaris 10 (ipf 3.0.4, pfil 2.1.4)
>
> G'day all,
>
> Trying to get Solaris IPMP (IP MultiPathing) group recognised by IP
> Filter,
> using the ipf & pfil as supplied with Solaris 10 (currently 6/06).
>
> I can define the IPMP groups as something like:
>
> ndd -set /dev/pfil qif_ipmp_set ipmp0=ce0,ce1
> (it seems names besides ipmp can also be used, such as "db", "web",
> whatever)
>
> Then see them with:
>
> ndd -get /dev/pfil qif_ipmp_status
>
> Now, am I supposed to then use "on ipmp0" in a rule, something like:
>
> pass in log first quick on ipmp0 from X to Y port = 22 flags S keep
> state
> (or S/SA, S/SAFR, whatever)
>
>
> Incoming SSH does not match this rule, but if I change to "on ce0"
> it works as before (however then I'm concerned it may not track
> the state across to ce2 if the link or switch on ce0 fails).
>
> Rgds, Stuart.
>
>
> Stuart Remphrey
> RMIT ITS Infrastructure Services - Unix Systems
> Phone (03) 992 55 070 (or extension 55070)
>