Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a VIP, and when is it needed?
Short answer
A VIP (Virtual IP) is the IP address shared by the two TR7 devices in a cluster. The address is active on only one device at a time: if the device selected as Master in the Add IP form fails or is taken into maintenance, the VIP passes automatically to the peer device, and when the Master device comes back up, it returns to it on its own. When vServices are published on a VIP, clients always connect to the same address, and the service continues even if one device goes down. A VIP is needed in a two-device cluster setup; in a single-device setup there is no VIP, and the vService listens on the device's own Interface IP.
How Does It Work?
- The two devices monitor each other. The devices in the cluster communicate continuously with VRRP over the Interface IP pair selected as VIP Communication on the interface.
- The VIP is on the Master device. For each VIP, the Master/slave selection in the Add IP form determines on which device the VIP will normally be active; that device receives the client traffic. Different VIPs can be Master on different devices.
- It passes over in a failure. If nothing is heard from the Master device for the VIP Transition Duration (s) (3 seconds by default), the VIP passes to the peer device. Since the address that clients connect to does not change, nothing is done on the DNS or client side.
- It returns when the device comes back. When the Master device comes back up and VIP communication is established, the VIP returns to it on its own; no manual action is required.
Clients → VIP 203.0.113.10
TR7-A · Master
VIP active on this device
Takes the VIP back when it returns
TR7-B · Slave
Takes over the VIP if A fails
Releases the VIP when A returns
What Is Seen in Failover and Failback?
| Moment | VIP status in the Interfaces list | vService |
|---|---|---|
| Normal operation | Master VIP is active (green); the address with the (M) suffix on the Master side | Serves from the Master device |
| The Master failed, the VIP passed to the peer device | Slave VIP is active (green) | Serves from the peer device with the same address |
| The Master came back | Master VIP is active again | Serves from the Master device |
| Both devices see the VIP as active (VIP communication misconfigured) | Both VIP is active | Address conflict; the VIP communication setting is checked |
The events that trigger the transition are selected with the interface's VIP Transition Method field: Only VRRP (default), TR7 Link Check, TR7 GW Check or TR7 Link and GW Check. VIP transitions are delivered to the administrators as e-mail and interface notifications with the VRRP Notification profile that comes ready under Settings → General Settings → Notification Management.
When Is It Needed?
| Situation | VIP |
|---|---|
| Single TR7 device | Not needed; the vService listens on the device's Interface IP |
| Two-device cluster, redundant publishing required | Needed; vServices are published on a VIP |
| A service to be served from only one device in the cluster | An Interface IP is enough (if that device goes down, the service goes down too) |
In TR7
- Adding: While the cluster is on, the interface is right-clicked on the Network → Interfaces screen and Add IP is selected; VIP is selected as the Ip Type; in the row, the address, on which device the VIP will normally be active (Master/slave) and the CIDR are entered. The record is made with Add IP.
- Prerequisite: The Interface IP pair of the two devices must be selected for VIP Communication in the interface's Edit Interface form; for an IPv6 VIP, VIP Communication (v6) is selected separately.
- Synchronization: In a cluster, the VIP definition is synchronized to the peer device with the Network area; with the default auto-sync it is sent automatically, and if Manual Sync Mode is on, it is sent with Synchronize.
- Monitoring: The status of the VIPs appears in the Interfaces list, and the (M) / (S) suffixes appear in the IP column of the vService list.
Common Misconceptions
- "A VIP distributes load between the servers." A VIP provides redundancy between two TR7 devices; the distribution between the servers is done by the vService.
- "Adding a VIP is enough." If no VIP communication pair is selected, the VIP does not become active.
- "The DNS has to be changed in a failure." The address does not change; the VIP passes to the peer device.
- "When the Master device comes back, the VIP has to be taken back manually." It does not; the VIP returns to the device selected as Master on its own.
How it is done in the documentation
