Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How is a VIP defined after the cluster is set up?
Short answer
A VIP is a virtual IP that can be moved between the two cluster devices and is used as the listening address of the vServices; it runs on the device where it is Master and moves to the peer device when that device goes out of service. After the cluster is set up, the settings are made on a single device and synchronized automatically to the peer device. Order: if the VIP is on a separate network, a route table is first added on the Route Tables screen and assigned to the interface with Edit Interface; an Interface IP pair with the addresses of the two devices is added to the interface (on a new route table, the default gateway is then set); in the Edit Interface form, this pair is selected as VIP Communication; the VIP is added with Add IP by selecting Ip Type = VIP and Master/Slave; the VIP is selected as the Frontend IP of the vService. The VIP does not become active until the VIP Communication pair is selected.
Problem: A vService Published on an Interface IP Does Not Move to the Peer Device
In a cluster, the Interface IP of each device is specific to that device and is not moved to the peer device during failover. If a vService is published on an Interface IP, it is reachable only on that device; when the device goes out of service, the service does not continue from the peer device. For the vService to run redundantly between the two devices, a VIP shared by the two devices is defined and the vService listens on this address.
Solution: Two Methods
Both methods require the cluster to be set up and in the Synced state (Is TR7 itself a single point of failure; how do I set up Load Balancer redundantly?). One of them is followed depending on the environment.
| Your situation | Suitable method |
|---|---|
| Physical device or virtualization platform; the VIP is on a separate network (new route table) | Method 1, starting from step 1 |
| Physical device or virtualization platform; the interface of the VIP is in DEFAULT or an existing route table | Method 1, starting from step 4 (from step 7 if the interface is in the correct route table) |
| The VIP is on the management (MGMT) interface; the Interface IP pair was created during the cluster setup | Method 1, starting from step 13 |
| Azure | Method 2: VIP on Azure |
Method 1: Defining a VIP with the Web Interface Recommended
- How it works The two devices communicate with VRRP over the Interface IP pair selected as VIP Communication; the VIP is active on the device where it is Master and moves to the peer device when the advertisements from that device stop.
- Where it is openedNetwork → Route Tables · Network → Interfaces · vService form
- Requirement A cluster that is set up and synchronized; on the network where the VIP will be, one address each for the two devices in the same subnet and a separate address for the VIP
- vService type All vService types (HTTP, L7 TCP, Network)
Step-by-Step Configuration
Network settings are synchronized in the cluster; all steps are performed on a single device (e.g. the ID 1 device).
1
Adım 1 Open the route table add form (if the VIP is on a separate network)
On the Network → Route Tables screen, the Add button is clicked. If the network of the VIP requires its own default gateway, a separate route table is used; TR7 comes with the DEFAULT route table, which always exists. If the interface will be moved to an existing route table, steps 1–3 are skipped; if the interface is already in the correct route table (e.g. DEFAULT), steps 1–6 are skipped.
2
Adım 2 Enter the route table name
A unique name is entered in the Route Table Name field (1–15 characters, e.g. RT_DMZ). Dynamic Route Table is unchecked by default; if dynamic routing is not needed, it is left unchecked.
3
Adım 3 Save with Add
The Add button in the form is clicked. The route table is created empty and becomes selectable in the interface, IP and routing forms.
4
Adım 4 Open the Edit Interface form of the interface
On the Network → Interfaces screen, the interface where the VIP will be is right-clicked and Edit Interface is selected.
5
Adım 5 Select the route table
In the Route Table field, the route table to which the interface will be moved is selected. The field appears only while more than one route table is defined; it is locked on interfaces that are bond/LACP members.
6
Adım 6 Save with Edit Interface
The Edit Interface button in the form is clicked. If the interface has IPs or routes, an "Are you sure?" confirmation opens stating that they will be moved together with the table, and it is confirmed.
7
Adım 7 Open the Add IP form
The same interface is right-clicked and Add IP is selected (Ways to add an IP). In the form, it is checked from the IP Interface field that the interface comes selected.
8
Adım 8 Enter the Interface IP pair
Ip Type = Interface IP (default) is left as is. In the IP table, the column headers show the host names of the devices: the address of this device is entered in the first column and the address of the peer device in the second column (e.g. 192.0.2.11 and 192.0.2.12); CIDR (default 24) is entered according to the network. The two addresses must be of the same IP version and in the same subnet; otherwise, the record is rejected with Subnet error. IP Status is left at the default Enabled for both devices.
9
Adım 9 Save with Add IP
The Add IP button is clicked; the addresses appear in the two device columns of the interface list and turn green (Up) when applied.
10
Adım 10 Open the default gateway form (on a new route table)
If a new route table was created in steps 1–3, the pencil icon in the Default Gateway column of the table is clicked on the Network → Route Tables screen. This step is performed after the Interface IPs are added; TR7 matches the gateway with the table IP in the same subnet. If DEFAULT or a route table whose default gateway is already defined is used, steps 10–12 are skipped.
11
Adım 11 Enter the default gateway address
The gateway address of the network is entered in the Default Gateway(IPv4) field (e.g. 192.0.2.254); the matching table IP appears below the field as "Match: …".
12
Adım 12 Save with Set default gateway
The Set Default Gateway button is clicked.
13
Adım 13 Open the Edit Interface form for the VIP
On the Network → Interfaces screen, the interface is right-clicked and Edit Interface is selected.
14
Adım 14 Select the VIP Communication pair
In the VIP Communication field, the pair added in step 8 (on the MGMT interface, the management IP whose two addresses were entered during the cluster setup) is selected in the ip/cidr - peer ip/cidr format; the list contains only the Interface IPs on this interface that have an address for both devices. For an IPv6 VIP, VIP Communication (v6) is also selected. VIP Transition Duration (s) (default 3, range 1–1000) and VIP Transition Method (default Only VRRP), which appear when the pair is selected, are changed if necessary.
15
Adım 15 Save with Edit Interface
The Edit Interface button is clicked. The interface is not recreated; the VIP settings are applied. Once VIP Communication has been selected on an interface, any number of VIPs can be added to that interface.
16
Adım 16 Open the Add IP form
The interface is right-clicked and Add IP is selected.
17
Adım 17 Enter the VIP and select Master/Slave
Ip Type = VIP is selected; the table switches to the IP, Master/Slave and CIDR columns. The address to be shared is entered in the IP field (e.g. 192.0.2.10). In the Master/Slave field, the device on which the VIP will normally run is selected: Master (default) is the device logged in to, and Slave is the peer device (What is the Master/Slave role on a VIP?). CIDR comes as auto; when it is left empty, /32 is assigned for IPv4.
18
Adım 18 Save with Add IP
The Add IP button is clicked. The VIP appears in the two device columns of the interface list with the same address, with the (M) suffix on the Master side and the (S) suffix on the Slave side.
19
Adım 19 Open the vService edit form
On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected (Add for a new vService).
20
Adım 20 Select the VIP as the Frontend IP
The VIP is selected in the Frontend IP list; if there are other Interface IPs on the vService, they are removed since they are not moved during failover.
21
Adım 21 Save with Save
The Save button in the vService form is clicked.
Verification
1VIP statusTR7 side
On the Network → Interfaces screen, the status of the VIP in the two device columns is checked (interface and IP statuses).
Expected
Master VIP is active (green) · Slave VIP (light gray)2vService statusTR7 side
In the Load Balancer vService list, the status circle of the vService split into two halves is checked (vService status).
Expected
Both halves green (OK)3Failover testClient side
In a maintenance window, while requests are being sent to the VIP, the Master device is restarted with Local Services → Reboot the Device; the Network → Interfaces screen is monitored in the web interface of the peer device. Since the cluster connection is also lost while the Master device is restarting, the peer device shows the VIP as Both VIP might be active (yellow) in its own column and as Cluster connection is down in the Master column.
Expected
Both VIP might be active on the peer device's screen · requests are answered from the peer device · Master VIP is active when the device returnsMethod 2: Defining a VIP on Azure
- How it works The VIP is first added in Azure as an IP configuration to the NIC of the first device and then defined in TR7; during failover, TR7 moves this IP to the NIC of the peer device through the Azure API.
- Where it is opened Azure portal · Network → Interfaces · Network → Route Tables
- Requirement A cluster that is set up and failover permissions that are granted (Reader, Network Contributor); the Azure operations are performed on both virtual machines, and the TR7 settings only on the first device
- vService type All vService types
Step-by-Step Configuration
If the VIP will be on an existing interface (e.g. the management interface; its Interface IPs already exist), steps 1–10 and steps 18–20 are skipped and the procedure starts from step 11 (Case A). If the VIP will be on a new NIC, all steps are applied (Case B).
1
Adım 1 Add the new NICs (both virtual machines)
(Azure) The two virtual machines are stopped (deallocate) and one NIC each is added for the network of the VIP; the two NICs must be in the same subnet. The IP that Azure assigns to the NIC becomes the Interface IP of that interface. The virtual machines are started; the new interface appears in TR7 under Network → Interfaces and is recognized from its MAC address (in Azure, NIC → Settings → Properties).
2
Adım 2 Open the route table add form
(TR7, first device) On the Network → Route Tables screen, the Add button is clicked.
3
Adım 3 Enter the route table name
A unique name for the new interface is entered in the Route Table Name field (1–15 characters).
4
Adım 4 Save with Add
The Add button in the form is clicked.
5
Adım 5 Open the Edit Interface form of the interface
(TR7, first device) On the Network → Interfaces screen, the new interface is right-clicked and Edit Interface is selected.
6
Adım 6 Select the route table
The created table is selected in the Route Table field.
7
Adım 7 Save with Edit Interface
The Edit Interface button is clicked.
8
Adım 8 Open the Add IP form
(TR7, first device) The interface is right-clicked and Add IP is selected.
9
Adım 9 Enter the Interface IP pair
Ip Type = Interface IP is left as is; the Azure IPs of the two virtual machines on this NIC and the correct CIDR are entered in the two columns.
10
Adım 10 Save with Add IP
The Add IP button is clicked.
11
Adım 11 Create the VIP in Azure
(Azure, first device) A new IP configuration from the same network is added to the NIC of the first device (Cluster ID 1) on which the VIP will be. If the VIP will be accessed from the internet, a Public IP is added to the same IP configuration.
12
Adım 12 Open the Edit Interface form
(TR7, first device) The interface is right-clicked and Edit Interface is selected.
13
Adım 13 Select the VIP Communication pair
In the VIP Communication field, the two-device Interface IP pair of the interface is selected.
14
Adım 14 Save with Edit Interface
The Edit Interface button is clicked.
15
Adım 15 Open the Add IP form
(TR7, first device) The interface is right-clicked and Add IP is selected.
16
Adım 16 Enter the VIP address
Ip Type = VIP is selected and the address created in Azure in step 11 is entered in the IP field; CIDR does not need to be entered.
17
Adım 17 Save with Add IP
The Add IP button is clicked. The VIP is configured on the first device; during failover, TR7 moves this IP to the second device.
18
Adım 18 Open the default gateway form (new route table)
(TR7, first device) For the new route table, last, after the Interface IPs are added, the pencil icon in the Default Gateway column of the table is clicked on the Network → Route Tables screen.
19
Adım 19 Enter the default gateway address
The first host address of the Azure subnet is entered in the Default Gateway(IPv4) field (e.g. 203.0.113.1 for 203.0.113.0/24) (Azure Default Gateway).
20
Adım 20 Save with Set default gateway
The Set Default Gateway button is clicked.
21
Adım 21 Open the vService edit form
On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.
22
Adım 22 Select the VIP as the Frontend IP
The VIP is selected in the Frontend IP list.
23
Adım 23 Save with Save
The Save button in the vService form is clicked.
Verification
1VIP statusTR7 side
On the Network → Interfaces screen, the status of the VIP is checked.
Expected
Master VIP is active · Slave VIP2Failover testClient side
In a maintenance window, the first virtual machine is restarted; since the VIP is moved on Azure through the Azure API, it may take between a few seconds and half a minute.
Expected
The VIP is moved to the NIC of the second device · requests are answered from the peer deviceCommon Mistakes
The VIP does not become active until VIP Communication is selected
The VIP does not become active until an Interface IP pair that has an address for both devices on the interface it is attached to is selected as VIP Communication, and no warning about this is given during Add IP. Recommended order: Interface IP pair → VIP Communication → VIP.
- Trying to set the default gateway before the Interface IPs. If the table has no IP in the same subnet as the gateway, the record is rejected with the
No network matches default gateway ...error; the default gateway is set after the IPs are added. - Leaving the peer device column of the Interface IP empty. An IP without a peer device address does not appear in the VIP Communication list.
- Trying to select Master/Slave separately on both devices. The role is selected once relative to the device logged in to; the peer device takes the opposite role automatically.
- Converting the management access IP into a VIP. When the management access IP becomes a VIP, the device can be accessed only from the side where the VIP is active (Edit IP).
- Thinking that disabling the vService turns off the VIP. The VIP is independent of the vService; even if the vService is Disabled, the VIP continues to respond on the network. To turn off the VIP, the IP is right-clicked on the Network → Interfaces screen and Disable for or Delete IP is used.
How it is done in the documentation
