测试keepalived主备模式
目的：观察VIP在主备服务器上的切换过程
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
|
一、安装
yum -y
install
ipvsadm keepalived
二、服务配置
【keepalived 主】
[root@LVS_201-1 ~]
# cat /etc/keepalived/keepalived.conf
! Configuration File
for
keepalived
global_defs {
router_id LVS_201-1
}
vrrp_instance VIP_test_1 {
state MASTER
interface em1
virtual_router_id 150
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.201.100
}
}
[root@LVS_201-1 ~]
# service keepalived start
【keepalived 备】
[root@LVS_201-2 ~]
# cat /etc/keepalived/keepalived.conf
! Configuration File
for
keepalived
global_defs {
router_id LVS_201-2
}
vrrp_instance VIP_test_1 {
state BACKUP
interface em1
virtual_router_id 150
priority 50
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.201.100
}
}
[root@LVS_LVS_201-2 ~]
# service keepalived start
三、刚启动时
【keepalived 主】
Mar 31 17:44:23 LVS_201-1 Keepalived[39251]: Starting Keepalived v1.2.13 (10
/15
,2014)
Mar 31 17:44:23 LVS_201-1 Keepalived[39252]: Starting Healthcheck child process, pid=39253
Mar 31 17:44:23 LVS_201-1 Keepalived[39252]: Starting VRRP child process, pid=39254
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Netlink reflector reports IP 10.0.201.1 added
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Netlink reflector reports IP fe80::569f:35ff:fe0f:e098 added
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Registering Kernel netlink reflector
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Registering Kernel netlink
command
channel
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Registering gratuitous ARP shared channel
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Netlink reflector reports IP 10.0.201.1 added
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Netlink reflector reports IP fe80::569f:35ff:fe0f:e098 added
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Registering Kernel netlink reflector
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Registering Kernel netlink
command
channel
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Opening
file
'/etc/keepalived/keepalived.conf'
.
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Configuration is using : 61953 Bytes
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: Using LinkWatch kernel netlink reflector...
Mar 31 17:44:23 LVS_201-1 Keepalived_vrrp[39254]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(10,11)]
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Opening
file
'/etc/keepalived/keepalived.conf'
.
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Configuration is using : 6491 Bytes
Mar 31 17:44:23 LVS_201-1 Keepalived_healthcheckers[39253]: Using LinkWatch kernel netlink reflector...
Mar 31 17:44:24 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) Transition to MASTER STATE
Mar 31 17:44:25 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) Entering MASTER STATE
Mar 31 17:44:25 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) setting protocol VIPs.
Mar 31 17:44:25 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on em1
for
10.0.201.100
Mar 31 17:44:25 LVS_201-1 Keepalived_healthcheckers[39253]: Netlink reflector reports IP 10.0.201.100 added
Mar 31 17:44:30 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on em1
for
10.0.201.100
[root@LVS_201-1 ~]
# ip a s dev em1
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link
/ether
54:9f:35:0f:e0:98 brd ff:ff:ff:ff:ff:ff
inet 10.0.201.1
/8
brd 10.255.255.255 scope global em1
inet 10.0.201.100
/32
scope global em1
inet6 fe80::569f:35ff:fe0f:e098
/64
scope link
valid_lft forever preferred_lft forever
【keepalived 备】
Mar 31 17:44:56 LVS_201-2 Keepalived[39000]: Starting Keepalived v1.2.13 (10
/15
,2014)
Mar 31 17:44:56 LVS_201-2 Keepalived[39001]: Starting Healthcheck child process, pid=39002
Mar 31 17:44:56 LVS_201-2 Keepalived[39001]: Starting VRRP child process, pid=39003
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Netlink reflector reports IP 10.0.201.2 added
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Netlink reflector reports IP fe80::46a8:42ff:fe0b:f805 added
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Registering Kernel netlink reflector
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Registering Kernel netlink
command
channel
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Registering gratuitous ARP shared channel
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Netlink reflector reports IP 10.0.201.2 added
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Netlink reflector reports IP fe80::46a8:42ff:fe0b:f805 added
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Registering Kernel netlink reflector
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Registering Kernel netlink
command
channel
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Opening
file
'/etc/keepalived/keepalived.conf'
.
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Configuration is using : 61951 Bytes
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: Using LinkWatch kernel netlink reflector...
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Entering BACKUP STATE
Mar 31 17:44:56 LVS_201-2 Keepalived_vrrp[39003]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(10,11)]
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Opening
file
'/etc/keepalived/keepalived.conf'
.
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Configuration is using : 6489 Bytes
Mar 31 17:44:56 LVS_201-2 Keepalived_healthcheckers[39002]: Using LinkWatch kernel netlink reflector...
[root@LVS_201-2 ~]
# ip a s dev em1
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link
/ether
44:a8:42:0b:f8:05 brd ff:ff:ff:ff:ff:ff
inet 10.0.201.2
/8
brd 10.255.255.255 scope global em1
inet6 fe80::46a8:42ff:fe0b:f805
/64
scope link
valid_lft forever preferred_lft forever
四、停止主
【keepalived 主】
Mar 31 17:45:47 LVS_201-1 Keepalived[39252]: Stopping Keepalived v1.2.13 (10
/15
,2014)
Mar 31 17:45:47 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) sending 0 priority
Mar 31 17:45:47 LVS_201-1 Keepalived_vrrp[39254]: VRRP_Instance(VIP_test_1) removing protocol VIPs.
[root@LVS_201-1 ~]
# ip a s dev em1
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link
/ether
54:9f:35:0f:e0:98 brd ff:ff:ff:ff:ff:ff
inet 10.0.201.1
/8
brd 10.255.255.255 scope global em1
inet6 fe80::569f:35ff:fe0f:e098
/64
scope link
valid_lft forever preferred_lft forever
【keepalived 备】
Mar 31 17:46:16 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Transition to MASTER STATE
Mar 31 17:46:17 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Entering MASTER STATE
Mar 31 17:46:17 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) setting protocol VIPs.
Mar 31 17:46:17 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on em1
for
10.0.201.100
Mar 31 17:46:17 LVS_201-2 Keepalived_healthcheckers[39002]: Netlink reflector reports IP 10.0.201.100 added
Mar 31 17:46:22 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on em1
for
10.0.201.100
[root@LVS_201-2 ~]
# ip a s dev em1
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link
/ether
44:a8:42:0b:f8:05 brd ff:ff:ff:ff:ff:ff
inet 10.0.201.2
/8
brd 10.255.255.255 scope global em1
inet 10.0.201.100
/32
scope global em1
inet6 fe80::46a8:42ff:fe0b:f805
/64
scope link
valid_lft forever preferred_lft forever
五、再次启动主
【keepalived 主】
Mar 31 17:46:18 LVS_201-1 Keepalived[39282]: Starting Keepalived v1.2.13 (10
/15
,2014)
Mar 31 17:46:18 LVS_201-1 Keepalived[39283]: Starting Healthcheck child process, pid=39284
Mar 31 17:46:18 LVS_201-1 Keepalived[39283]: Starting VRRP child process, pid=39285
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Netlink reflector reports IP 10.0.201.1 added
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Netlink reflector reports IP fe80::569f:35ff:fe0f:e098 added
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Registering Kernel netlink reflector
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Netlink reflector reports IP 10.0.201.1 added
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Netlink reflector reports IP fe80::569f:35ff:fe0f:e098 added
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Registering Kernel netlink
command
channel
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Registering Kernel netlink reflector
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Registering Kernel netlink
command
channel
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Registering gratuitous ARP shared channel
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Opening
file
'/etc/keepalived/keepalived.conf'
.
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Opening
file
'/etc/keepalived/keepalived.conf'
.
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Configuration is using : 6491 Bytes
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Configuration is using : 61953 Bytes
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: Using LinkWatch kernel netlink reflector...
Mar 31 17:46:18 LVS_201-1 Keepalived_vrrp[39285]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(10,11)]
Mar 31 17:46:18 LVS_201-1 Keepalived_healthcheckers[39284]: Using LinkWatch kernel netlink reflector...
Mar 31 17:46:19 LVS_201-1 Keepalived_vrrp[39285]: VRRP_Instance(VIP_test_1) Transition to MASTER STATE
Mar 31 17:46:19 LVS_201-1 Keepalived_vrrp[39285]: VRRP_Instance(VIP_test_1) Received lower prio advert, forcing new election
Mar 31 17:46:20 LVS_201-1 Keepalived_vrrp[39285]: VRRP_Instance(VIP_test_1) Entering MASTER STATE
Mar 31 17:46:20 LVS_201-1 Keepalived_vrrp[39285]: VRRP_Instance(VIP_test_1) setting protocol VIPs.
Mar 31 17:46:20 LVS_201-1 Keepalived_vrrp[39285]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on em1
for
10.0.201.100
Mar 31 17:46:20 LVS_201-1 Keepalived_healthcheckers[39284]: Netlink reflector reports IP 10.0.201.100 added
【keepalived 备】
Mar 31 17:46:47 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Received higher prio advert
Mar 31 17:46:47 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Entering BACKUP STATE
Mar 31 17:46:47 LVS_201-2 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) removing protocol VIPs.
Mar 31 17:46:47 LVS_201-2 Keepalived_healthcheckers[39002]: Netlink reflector reports IP 10.0.201.100 removed
六、防火墙
注意：严格的防火墙会阻塞vrrp实例之间的通信，从而导致master和backup不能互相识别，从而backup也升级为master角色。
例如，在backup上有个防火墙策略：
[root@LVS_201-2 ~]
# iptables-save >/root/rc.firewall.txt
[root@LVS_201-2 ~]
# cat /root/rc.firewall.txt
# Generated by iptables-save v1.4.7 on Wed Apr 15 11:41:15 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [352:25516]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Apr 15 11:41:15 2015
如果打开防火墙（service iptables start），则会从backup转换成master状态：
Mar 31 17:50:42 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Transition to MASTER STATE
Mar 31 17:50:42 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Entering MASTER STATE
Mar 31 17:50:43 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) setting protocol VIPs.
Mar 31 17:50:44 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on eth0
for
10.0.201.100
Mar 31 17:50:45 LVS_201-22 Keepalived_healthcheckers[39003]: Netlink reflector reports IP 10.0.201.100 added
Mar 31 17:50:45 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Sending gratuitous ARPs on eth0
for
10.0.201.100
因为iptables过滤了vrrp协议，它不属于任何端口，像icmp一样，需要单独放行。
-A INPUT -p vrrp -j ACCEPT
例如，在上面的配置文件中，增加到rc.firewall.txt中，icmp那条策略后
-A INPUT -p icmp -j ACCEPT
-A INPUT -p vrrp -j ACCEPT <- 这是增加的一条策略
-A INPUT -i lo -j ACCEPT
【具体操作】
检查当前生效的策略：
iptables -nL
保存：
iptables-save >rc.firewall.txt
修改
sed
-i
'/-A INPUT -p icmp -j ACCEPT /a\-A INPUT -p vrrp -j ACCEPT'
rc.firewall.txt
应用新策略：
iptables-restore
/root/rc
.firewall.txt
检查当前生效的策略：
iptables -nL
确认无误后保存
service iptables save
Mar 31 17:55:32 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Received higher prio advert
Mar 31 17:55:32 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) Entering BACKUP STATE
Mar 31 17:55:32 LVS_201-22 Keepalived_vrrp[39003]: VRRP_Instance(VIP_test_1) removing protocol VIPs.
Mar 31 17:55:32 LVS_201-22 Keepalived_healthcheckers[39003]: Netlink reflector reports IP 10.0.201.100 removed
确认无误，记得保存防火墙：
[root@LVS_201-2 ~]
# service iptables save
同样的防火墙操作，记得在master上也更新一下。
|
本文转自 pcnk 51CTO博客，原文链接：http://blog.51cto.com/nosmoking/1627051，如需转载请自行联系原作者
