[
https://issues.apache.org/jira/browse/CLOUDSTACK-10074?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16165217#comment-16165217
]
Tim Gipson commented on CLOUDSTACK-10074:
-----------------------------------------
I started the manual failover shortly after 14:40 so that should help when
grepping the logs.
> VR Failover causes failed VPC routers
> -------------------------------------
>
> Key: CLOUDSTACK-10074
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10074
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: Virtual Router
> Affects Versions: 4.8.2.0
> Environment: CentOS 7 for management, KVM hypervisors
> Reporter: Tim Gipson
> Attachments: iptables_broken.txt, iptables_working.txt,
> management-server20170913-2pm.log, VR_backup_cloud.log, VR_master_cloud.log
>
>
> I’ve found what I think could be a possible issue with the redundant VPC
> router pairs in Clousdstack. The issue was first noticed when routers were
> failing over from master to backup. When the backup router became master,
> everything continued to work properly and traffic flowed as normal. However,
> when it failed from the new master back to the original master the virtual
> router stopped allowing traffic through any network interfaces and any
> failover after that resulted in virtual routers that were not passing traffic.
> I can reproduce this behavior by doing a manual failover (logging in and
> issuing a reboot command on the router) from master to backup and then back
> to the original master. From what I can tell, the iptables rules on the
> router are somehow modified during the failover (or a manual reboot) in such
> a way as to make them completely nonfunctional. I did a side-by-side
> comparison of the iptables rules before and after a failover (or a manual
> reboot) and there are definite differences. Sometimes rules are changed,
> sometimes they are duplicated, and I’ve even found that some rules are
> missing completely out of iptables.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
