09-High Availability Configuration Guide

HomeSupportSecurityH3C SecPath F5000 FirewallConfigure & DeployConfiguration GuidesH3C SecPath F50X0-D[F5000-AK] Firewalls Series Configuration Guides (V7) (R9620)-6W40109-High Availability Configuration Guide
06-Reth interface and redundancy group configuration

Configuring Reth interfaces

About Reth interfaces

A redundant Ethernet (Reth) interface is a virtual Layer 3 interface that uses two member interfaces to ensure link availability. One member interface is active and the other is inactive. When the active interface fails, the inactive interface becomes active. The member interface switchover does not interrupt traffic.

Operating mechanism

A member interface of a Reth interface can be in either of the following states:

·     Active—The interface can forward packets. A Reth interface can have only one active member interface.

·     Inactive—The interface cannot forward packets.

A Reth interface determines the state of its member interfaces by using the following rules:

·     When the member interfaces are physically up, the member interface with the higher priority is active. The other member interface is inactive. The priority of an interface is user configurable.

·     When the member interfaces are physically down, both interfaces are inactive.

·     When the active member interface goes down physically, the inactive interface automatically becomes active to forward packets.

If the Reth interface is added to a redundancy group, the member interface states are determined by the redundancy group. For more information, see "Configuring redundancy groups."

The switchover between the Reth member interfaces is not visible to the network and does not cause network topology changes. For the upstream and downstream devices, they are connected to the Reth interface and learn only the MAC address of the Reth interface.

Application scenario

The Reth interface feature is typically used with the redundancy group feature. For more information, see "Configuring redundancy groups."

Reth subinterfaces

To transmit and receive VLAN-tagged packets on a Reth interface, you can create subinterfaces for the Reth interface. A Reth subinterface is a Layer 3 logical interface and can be assigned an IP address. Packets from different VLANs can be forwarded by different Reth subinterfaces, which improves the interface efficiency and networking flexibility. For more information about VLAN-tagged packet processing on a Reth subinterface, see VLAN termination in Layer 2—LAN Switching Configuration Guide.

Configuring a Reth interface

Restrictions and guidelines: Reth interface configuration

Supported member interface types

A Reth interface can use the following interfaces and their subinterfaces as member interfaces:

·     Layer 3 Ethernet interfaces.

·     Layer 3 aggregate interfaces.

Member interface configuration

When you configure a Reth interface, follow these restrictions and guidelines:

·     You can assign a maximum of two member interfaces to a Reth interface. The member interfaces must have different priorities.

·     You cannot assign member interfaces to a Reth subinterface.

·     You cannot assign subinterfaces or interfaces that have subinterfaces to a Reth interface if the Reth interface has Reth subinterfaces.

·     You can assign an interface or subinterface to only one Reth interface.

·     As a best practice, assign interfaces of the same type and speed to a Reth interface.

·     If both member interfaces of a Reth interface are subinterfaces, make sure they are on different main interfaces and terminate the same VLAN ID. For more information about VLAN termination, see Layer 2—LAN Switching Configuration Guide.

·     Do not specify a Reth interface as the outgoing interface in IPv6 static neighbor entries if its member interfaces contain subinterfaces. For more information about IPv6 static neighbor entries, see Layer 3—IP Services Configuration Guide.

·     Settings made on the member interfaces of a Reth interface will not take effect until they are removed from the Reth interface.

Member interface deletion

Before you delete a Reth interface, make sure all its member interfaces have been removed.

Configuring basic parameters for a Reth interface

1.     Enter system view.

system-view

2.     Create a Reth interface and enter its view.

interface reth interface-number

By default, no Reth interfaces exist.

3.     Assign a member interface to the Reth interface.

member interface interface-type interface-number priority priority

By default, a Reth interface does not have member interfaces.

4.     (Optional.) Configure the expected bandwidth for the Reth interface.

bandwidth bandwidth-value

By default, the expected bandwidth is 10000 kbps.

The expected bandwidth is an informational parameter used only by higher-layer protocols for calculation. You cannot adjust the actual bandwidth of an interface by using this command.

5.     (Optional.) Configure the description of the Reth interface.

description text

The default description of a Reth interface is interface-name Interface (for example, Reth1 Interface).

6.     (Optional.) Set the MTU of the Reth interface.

mtu size

By default, the MTU of a Reth interface is 1500 bytes.

7.     Bring up the Reth interface.

undo shutdown

By default, a Reth interface is not manually shut down.

Setting the parameters for retransmitting advertisement messages after a Reth member interface switchover

About this task

After you configure the parameters for retransmitting advertisement messages, a Reth interface performs the following operations when a Reth member interface switchover occurs on it:

1.     Sends advertisement messages (including gratuitous ARP messages and NA messages) to neighbors immediately.

2.     Retransmits the advertisement messages according to the number of retransmissions and the retransmission interval you have configured.

Restrictions and guidelines

If a Reth interface has subinterfaces, the subinterfaces also send advertisement messages upon a Reth member interface switchover. To save CPU resources, the parameters for retransmitting advertisement messages take effect only on Reth interfaces. Reth subinterfaces are not controlled by these parameters.

Procedure

1.     Enter system view.

system-view

2.     Set the parameters for retransmitting advertisement messages to neighbors after a Reth member interface switchover.

reth advertise retransmit times interval seconds

By default, after a Reth member interface switchover, a Reth interface retransmits advertisement messages to neighbors five times at an interval of 1 second.

Configuring a Reth subinterface

About this task

You can create Reth subinterfaces and configure VLAN termination on the Reth subinterfaces to process VLAN-tagged packets.

Restrictions and guidelines

When you configure a Reth subinterface, follow these restrictions and guidelines:

·     To create a Reth subinterface, create the Reth interface first.

·     You cannot create subinterfaces for a Reth interface in any of the following situations:

¡     The members of the Reth interface are Layer 3 Ethernet subinterfaces or Layer 3 aggregate subinterfaces.

¡     A minimum of one subinterface is created on the member interfaces of the Reth interface.

Procedure

1.     Enter system view.

system-view

2.     Create a Reth subinterface and enter its view.

interface reth interface-number.subnumber

By default, no Reth subinterfaces exist.

If the specified Reth subinterface already exists, this command enters the view of the Reth subinterface.

3.     (Optional.) Configure the expected bandwidth for the Reth subinterface.

bandwidth bandwidth-value

By default, the expected bandwidth is 10000 kbps.

4.     (Optional.) Configure a description for the Reth subinterface.

description text

The default description of a Reth subinterface is interface-name Interface (for example, Reth1.1 Interface).

5.     (Optional.) Set the MTU of the Reth subinterface.

mtu size

By default, the MTU of a Reth subinterface is 1500 bytes.

6.     Return to system view.

quit

7.     Enter Reth interface view.

interface reth interface-number

8.     Enable subinterface rate statistics collection on the Reth interface.

sub-interface rate-statistic

By default, subinterface rate statistics collection is disabled on a Reth interface.

After you execute this command, the device periodically refreshes subinterface rate statistics for the Reth interface. The statistics is displayed in the Last 300 seconds input rate and Last 300 seconds output rate fields of the command output from the display interface reth command.

9.     Return to system view.

quit

10.     Enter Reth subinterface view.

interface reth interface-number.subnumber

11.     Bring up the Reth subinterface.

undo shutdown

By default, a Reth subinterface is not manually shut down.

Restoring default settings for a Reth interface or subinterface

Restrictions and guidelines

CAUTION

CAUTION:

The default command might interrupt ongoing network services. Make sure you are fully aware of the impacts of this command when you execute it on a live network..

 

This command might fail to restore the default settings for some commands for reasons such as command dependencies and system restrictions.

To resolve this issue:

1.     Use the display this command in interface view to identify these commands.

2.     Use their undo forms or follow the command reference to restore their default settings.

3.     If the restoration attempt still fails, follow the error message instructions to resolve the issue.

Procedure

1.     Enter system view.

system-view

2.     Enter a Reth interface or subinterface view.

interface reth { interface-number | interface-number.subnumber }

3.     Restore the default settings for the Reth interface.

default

Displaying and maintaining Reth interfaces

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display Reth interface traffic statistics.

display counters { inbound | outbound } interface [ reth [ interface-number ] ]

Display traffic rate statistics for Reth interfaces in up state during the most recent statistics polling interval.

display counters rate { inbound | outbound } interface [ reth [ interface-number ] ]

Display Reth interface or subinterface information.

display interface [ reth [ interface-number | interface-number.subnumber ] ] [ brief [ description | down ] ]

Display information about the member interfaces of a Reth interface.

display reth interface interface-type interface-number

Clear statistics for Reth interfaces.

reset counters interface [ reth [ interface-number ] ]

 


Configuring redundancy groups

About redundancy groups

A redundancy group works on IRF fabrics. It allows traffic to enter and leave an IRF fabric through the same member device.

Operating mechanism of a redundancy group

As shown in Figure 1, a redundancy group has two redundancy group nodes. Each node is bound to an IRF member device.

A redundancy group node is a collection of objects on its bound IRF member device. The objects include member interfaces of Reth interfaces, CPUs of failover groups, and individual physical Ethernet interfaces. The state of the objects is consistent with the state of the node.

In a redundancy group, one node is in primary state, and the other node is in secondary state. Only the primary node forwards traffic. When the primary node fails, the redundancy group switches over to the secondary node. This mechanism ensures path symmetry for traffic.

As shown in Figure 1, a redundancy group performs a switchover as follows:

1.     When both IRF member devices are operating correctly, the redundancy group forwards traffic through Node 1 (Device A) and backs up services and data (such as NAT) to Node 2 (Device B).

2.     When the upstream interface on Device A fails, the redundancy group shuts down the downstream interface on Device A and switches traffic over to Device B.

Figure 1 Redundancy group operating mechanism

 

Redundancy group node states

A redundancy group node can act as the primary or secondary node. Only the primary node can forward traffic.

When both nodes are operating correctly, the primary node is selected in the following order:

1.     The node with higher node priority.

2.     The node with smaller ID if the two nodes have the same priority.

When the primary node fails, the secondary node takes over the primary role to forward traffic. For more information about the state monitoring and switchover mechanisms, see "Redundancy group switchover."

Redundancy group members

Application scenarios of redundancy group members

Redundancy group members can be physical Ethernet interfaces, Reth interfaces, and failover groups that are located on the IRF member devices bound to the group's nodes.

You can assign physical Ethernet interfaces or Reth interfaces to a redundancy group for symmetric traffic forwarding, as shown in Table 1.

Table 1 Application scenarios of physical Ethernet interfaces and Reth interfaces

Member type

Application scenarios

Supported interfaces

Physical Ethernet interfaces

Dynamic routing protocols run between the IRF fabric and its upstream and downstream devices.

Layer 2 Ethernet interfaces.

Later 3 Ethernet interfaces.

Reth interfaces

No dynamic routing protocol runs between the IRF fabric and its upstream and downstream devices.

A Reth interface can use the following interfaces and their subinterfaces as member interfaces:

·     Layer 3 Ethernet interfaces.

·     Layer 3 aggregate interfaces.

 

You can assign failover groups to a redundancy group for service backup between CPUs. For more information about failover groups, see High Availability Configuration Guide.

Using physical Ethernet interfaces in a redundancy group

You assign physical Ethernet interfaces to a redundancy group by binding them to their respective redundancy group nodes.

For symmetric traffic switchover, you must bind a minimum of one downlink interface and a minimum of one uplink interface with each node of the redundancy group.

The state of the member physical Ethernet interfaces changes with the state of the redundancy group nodes. Only the member interfaces on the primary node can forward traffic.

As shown in Figure 2, Interface A1 and Interface A2 are on Node 1, and Interface B1 and Interface B2 are on Node 2. When Node 1 is in primary state, Interface A1 and Interface A2 are up to forward traffic, while Interface B1 and Interface B2 do not forward traffic.

When Interface A1 goes down, the Reth module places Node 1 in secondary state. Node 2 changes to the primary state, and Interface B1 and Interface B2 take over to forward traffic, as shown in Figure 3.

Figure 2 States of the member interfaces when both nodes are operating correctly

 

Figure 3 States of the member interfaces after a switchover

 

Using Reth interfaces in a redundancy group

To use Reth interfaces for symmetric forwarding, you must assign two Reth interfaces to a redundancy group: one for uplink traffic and the other for downlink traffic. The Reth interfaces must meet the following requirements:

·     The Reth interface for uplink traffic contains one uplink port on each redundancy group node.

·     The Reth interface for downlink traffic contains one downlink port on each redundancy group node.

·     The high-priority member of each Reth interface belongs to the high-priority node.

 The state of each Reth interface's members depends on the state of the redundancy group nodes.

·     When the high-priority node is in primary state, the high-priority member is active.

·     When the low-priority node is in primary state, the low-priority member is active.

As shown in Figure 4, redundancy group 1 contains Reth 1 for uplink traffic and Reth 2 for downlink traffic. Reth 1 contains Interface A1 (on Node 1) and Interface B1 (on Node 2). Reth 2 contains Interface A2 (on Node 1) and Interface B2 (on Node 2).

When Node 1 is in primary state, Interface A1 in Reth 1 and Interface A2 in Reth 2 are active to forward uplink and downlink traffic, respectively.

When Interface A1 fails, the Reth module places Node 1 in secondary state and shuts down Interface A2, as shown in Figure 5. Node 2 changes to the primary state, and Interface B1 and Interface B2 become active to forward uplink and downlink traffic.

Figure 4 States of each Reth interface's members when both nodes are operating correctly

 

Figure 5 States of each Reth interface's members after a switchover

 

Using failover groups in a redundancy group

A failover group can be used by a service module (for example, NAT) to provide service backup between CPUs.

A failover group contains one primary CPU and one secondary CPU. If you are assigning a failover group to a redundancy group, configure the CPU on the high-priority redundancy node as the primary CPU in the failover group.

In a redundancy group, the states of the CPUs in a failover group change in consistency with the redundancy group nodes when both CPUs are operating correctly.

·     When the high-priority node is in primary state, the primary CPU processes services and the secondary CPU backs up services.

·     When the low-priority node is in primary state, the secondary CPU processes services and the primary CPU backs up services.

Redundancy group switchover

Switchover types

Redundancy group switchovers include automatic switchovers and manual switchovers.

Automatic switchover timers

Timers for automatic switchovers include the hold-down timer and the preemption delay timer.

·     Hold-down timer—The hold-down timer specifies the minimum interval between two switchovers to prevent frequent switchovers. The timer starts when a switchover is finished. The redundancy group can perform the next switchover only after the hold-down timer expires.

·     Preemption delay timer—The preemption delay timer specifies the delay for a switchover back to the high-priority node. The preemption delay timer starts when the switchover is triggered. The redundancy group performs the switchover only after the timer expires. The delay allows the system to process events (such as interface state changes) required for the switchover.

Automatic switchover

A redundancy group cooperates with the Track module to monitor link and interface status for automatic switchovers.

A redundancy group node has a weight of 255 (not configurable). Each redundancy group node is associated with one or multiple track entries that have a user-configurable weight decrement rate. When the state of a track entry changes, the weight of the associated node is reduced or increased, as follows:

·     When the track entry changes to the NotReady or Negative state, the node weight is reduced by the weight decrement rate of the track entry.

·     When the track entry changes to the Positive state, the node weight is increased by the weight decrement rate of the track entry.

When the node weight decreases to 0 or a lower value, a switchover request is triggered.

·     Switchover to the low-priority node occurs when the hold-down timer expires.

·     Switchover to the high-priority node occurs when the preemption delay timer expires.

Manual switchover

You can issue a manual switchover request in one of the following situations:

·     An automatic switchover to the high-priority node cannot be performed when no tracked interfaces are excluded from the shutdown action by the Reth module.

·     Switchovers are required when both redundancy group nodes operate correctly. For example, component replacement is required on the high-priority node.

Automatic switchover to the high-priority node is not allowed if the preemption delay timer is set to 0, even when both nodes are operating correctly. You can perform only manual switchover.

Redundancy group configuration tasks at a glance

To configure a redundancy group, perform the following tasks:

1.     Creating a redundancy group

2.     Configuring a redundancy group node

3.     Assigning members to the redundancy group

¡     Assigning physical Ethernet interfaces to a redundancy group

This task is applicable to the network scenario where a dynamic routing protocol runs between the IRF fabric and its upstream and downstream devices.

¡     Assigning Reth interfaces to a redundancy group

This task is applicable to the network scenario where no dynamic routing protocol runs between the IRF fabric and its upstream and downstream devices.

¡     Assigning failover group

4.     Configuring the switchover timers

5.     (Optional.) Performing a manual switchover

6.     (Optional.) Performing a manual switchover back to the high-priority node

7.     (Optional.) Enabling SNMP notifications for redundancy groups

Creating a redundancy group

Restrictions and guidelines

Before you delete a redundancy group, you must remove all its Reth interfaces, redundancy group nodes, and failover groups.

Procedure

1.     Enter system view.

system-view

2.     Create a redundancy group and enter its view.

redundancy group group-name

By default, no redundancy groups exist.

Configuring a redundancy group node

Restrictions and guidelines

You can configure a maximum of two nodes for a redundancy group. Nodes in different redundancy groups can use the same ID.

You can bind a redundancy group node to one IRF member device. An IRF member device cannot be bound to multiple redundancy group nodes. You cannot change the binding for a node if it has member interfaces or is associated with track entries.

When you associate a track entry with a redundancy group node, follow these restrictions and guidelines:

·     You cannot associate a track entry with both nodes in a redundancy group.

·     For correct interface state recovery, you must exclude a tracked interface from the shutdown action by the Reth module if the interface has one of the following roles:

¡     Member interface in the redundancy group.

¡     Member of a Reth interface in the redundancy group.

·     On the high-priority node, do not exclude a subinterface from the shutdown action by the Reth module if its main interface has one of the following roles:

¡     Member interface of the redundancy group.

¡     Member of a Reth interface in the redundancy group.

When the Reth module shuts down the main interface, the subinterface is also shut down. The shutdown subinterface cannot recover automatically to trigger an automatic switchover.

Prerequisites

Before you associate a track entry with a redundancy group, you must configure the track entry. For more information about configuring track entries, see "Configuring Track."

Procedure

1.     Enter system view.

system-view

2.     Enter redundancy group view.

redundancy group group-name

3.     Create a redundancy group node and enter its view.

node node-id

By default, no redundancy group nodes exist.

4.     Set the priority of the redundancy group node.

priority priority

By default, the priority of a redundancy group node is 1.

5.     Bind the redundancy group node with an IRF member device.

bind chassis chassis-number

By default, a node is not bound with an IRF member device.

6.     Associate an existing track entry with the redundancy group node.

track track-entry-number [ reduced weight-reduced ] [ interface interface-type interface-number ]

By default, a node is not associated with track entries.

Assigning physical Ethernet interfaces to a redundancy group

Restrictions and guidelines

For symmetric traffic switchover, you must bind a minimum of one uplink interface and a minimum of one downlink interface with each node of the redundancy group.

You can bind a physical Ethernet interface with only one redundancy group node.

You cannot bind a member of a Reth interface with a redundancy group node.

Procedure

1.     Enter system view.

system-view

2.     Enter redundancy group view.

redundancy group group-name

3.     Enter redundancy group node view.

node node-id

4.     Bind a physical Ethernet interface with the redundancy group node.

node-member interface interface-type interface-number

By default, a physical Ethernet interface is not bound with a redundancy group node.

Assigning Reth interfaces to a redundancy group

Restrictions and guidelines

To use Reth interfaces for symmetric forwarding, you must assign two Reth interfaces to a redundancy group: one for uplink traffic and the other for downlink traffic. The Reth interfaces must meet the following requirements:

·     The Reth interface for uplink traffic contains one uplink port on each redundancy group node.

·     The Reth interface for downlink traffic contains one downlink port on each redundancy group node.

·     The high-priority member of each Reth interface belongs to the high-priority node.

Procedure

1.     Enter system view.

system-view

2.     Create a Reth interface and enter its view.

interface reth interface-number

3.     Assign a member interface to the Reth interface.

member interface interface-type interface-number priority priority

By default, a Reth interface does not have member interfaces.

Repeat this step to assign two member interfaces to the Reth interface. Assign a higher priority for the priority argument to the member interface on the high-priority redundancy node.

4.     Return to system view.

quit

5.     Enter redundancy group view.

redundancy group group-name

6.     Assign the Reth interface to the redundancy group.

member interface reth interface-number [ quick-fallback ]

By default, a redundancy group does not contain Reth interfaces.

Assigning failover groups to a redundancy group

Restrictions and guidelines

Make sure the CPUs in the failover group are on the IRF member devices bound with the redundancy group nodes.

Configure the CPU on the high-priority redundancy group node as the primary node.

Prerequisites

Create and configure the failover group before you assign it to a redundancy group. For more information about failover group configuration, see "Configuring failover groups."

Procedure

1.     Enter system view.

system-view

2.     Enter redundancy group view.

redundancy group group-name

3.     Assign an existing failover group to the redundancy group.

member failover group group-name

By default, a redundancy group does not contain failover groups.

Configuring the switchover timers

1.     Enter system view.

system-view

2.     Enter redundancy group view.

redundancy group group-name

3.     Set the hold-down timer for the redundancy group.

hold-down-interval second

By default, the hold-down timer is 1 second.

4.     Set the preemption delay timer for the redundancy group.

preempt-delay seconds sec

By default, the preemption delay timer is 1 minute (60 seconds).

 

If you set this timer to 0 seconds, automatic switchover to the high-priority node is disabled. You can perform only manual switchover.

Performing a manual switchover to the low-priority node

1.     Enter system view.

system-view

2.     Enter redundancy group view.

redundancy group group-name

3.     Request a switchover to the low-priority node.

switchover request

Performing a manual switchover back to the high-priority node

1.     Enter system view.

system-view

2.     Enter redundancy group view.

redundancy group group-name

3.     Request a switchover back to the high-priority node.

switchover reset

Enabling SNMP notifications for redundancy groups

About this task

This feature enables SNMP notifications for the following events:

·     A manual switchover is performed.

·     An interface goes down.

·     A faulty interface is recovered.

To send the event notifications to an NMS, you must also configure SNMP as described in Network Management and Monitoring Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enable SNMP notifications for redundancy groups.

snmp-agent trap enable rddc

By default, SNMP notifications are enabled for redundancy groups.

Displaying and maintaining redundancy groups

Execute display commands in any view.

 

Task

Command

Display redundancy group information.

display redundancy group [ group-name ]

 

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become A Partner
  • Partner Policy & Program
  • Global Learning
  • Partner Sales Resources
  • Partner Business Management
  • Service Business
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网