Pablo,
Pablo Neira Ayuso wrote:
Yoann Juet wrote:
Pablo Neira Ayuso wrote:
As you can see, this TCP connection is present:
root@fw1-irt:~# conntrack -L |grep 34189
conntrack v0.9.10 (conntrack-tools): 14 flow entries has been shown.
tcp 6 10581 ESTABLISHED src=172.18.244.10 dst=193.52.101.32
sport=34189 dport=5222 packets=63 bytes=12039 src=193.52.101.32
dst=172.18.244.10 sport=5222 dport=34189 packets=58 bytes=22146
[ASSURED] mark=0 secmark=0 use=1
This is weird, look like some problem in your scripts or the commit is
not working in node fw1-irt. The packet counters of the entry above show
that this is the old entry which is stuck in the cache after the second
failover. This should be deleted when fw1-irt's script issues the commit
(conntrackd -c). Does the log file tells that the commit was successful?
I confirm that "conntrackd -c" is executed on FW1-IRT on the second
failover. FYI, my LSB script executes the following instructions (start=
new active node ; stop = new passive node):
...
case "$1" in
start)
conntrackd -c -C /etc/conntrackd.conf
conntrackd -f -C /etc/conntrackd.conf
conntrackd -R -C /etc/conntrackd.conf
exit 0
;;
stop)
#conntrackd -t -C /etc/conntrackd.conf
conntrackd -n -C /etc/conntrackd.conf
exit 0
;;
Before the second failover, does conntrackd -e in FW1-IRT (now in backup
mode) show, at least, one entry that talks about the TCP connection that
is in trouble? I think that it will not show any (but it should show
one, so I think that I have found the problem ;). Please, confirm this
and I'll get back to you with a possible solution soon.
You're right, the external cache on FW1 is empty before the second failover.
BTW, why your script does not invoke the '-t', did you notice any
problem? That schedules the cleanup of the kernel conntrack table after
PurgeTimeout seconds when a node enters backup mode.
I was just testing with and without this instruction that was not
available on conntrackd 0.9.6.
Thanks for your patience.
Thanks for your assistance !
begin:vcard
fn:Yoann Juet
n:Juet;Yoann
org;quoted-printable:;DSI Universit=C3=A9 de Nantes
adr;quoted-printable:BP92208;;2, rue de la Houssini=C3=A8re;Nantes;;44322;France
email;internet:yoann.juet@xxxxxxxxxxxxxx
title;quoted-printable:Ing=C3=A9nieur s=C3=A9curit=C3=A9 & r=C3=A9seau
tel;work:02.51.12.53.93
tel;fax:02.51.12.58.60
x-mozilla-html:FALSE
version:2.1
end:vcard
