Description

This article discusses two different types of HA Proxies running in CSO HA On-Prem deployment.

Solution

The followings steps are based on CSO 5.1.2 version High availability On-Prem deployment installed on bare metal servers.

  1. CSO HA deployment HA-Proxy process runs in the following servers:
    1. Central proxy
    2. SBLB Proxy (South Bound Load Balancer)
    Note: CSO also runs various loadbalancer services such as nginx, keystone, etc inside Kubernetes cluster which is outside the scope of this article.

  2. As part of CSO HA deployment, a NAT device configured to route traffic either to Central Proxy or SBLB proxy based on the destination ports as shown below:

    Central HA PROXY

    As per the configuration below on NAT device following traffic routed to central HA Proxy

    1. Outbound SSH connection from SDWAN device on 7804 port
    2. PKI Certification Revocation List (CRL) connection on 8060 port
    3. Kibana portal connection on port 5060. 
    root@J16-41> show configuration | display set | match haproxy_confd
set security nat static rule-set cso rule outbound-ssh-7804 then static-nat prefix-name haproxy_confd
set security nat static rule-set cso rule CRL-8060 then static-nat prefix-name haproxy_confd
set security nat static rule-set cso rule kibana-5601 then static-nat prefix-name haproxy_confd

root@J16-41> show configuration security address-book | match haproxy_confd | display set
set security address-book global address haproxy_confd 192.168.10.48/32

    SBLB Proxy

    As per the configuration below on NAT device following traffic routed to SBLB Proxy

    1. System and Security Syslog messages from SDWAN devices on 514 port
    2. Security app-track-log messages from  SDWAN devices on 3514 port.
    3. Contrail config api process running in Contrail Analytics Node (CAN) machine on 8081
    4. Contrail analytics api process running in Contrail Analytics Node (CAN) machine on 8081 
    set security address-book global address haproxy_confd_sblb 192.168.10.49/32
set security nat static rule-set cso rule rsyslog-514 then static-nat prefix-name haproxy_confd_sblb
set security nat static rule-set cso rule syslog-3514 then static-nat prefix-name haproxy_confd_sblb
set security nat static rule-set cso rule syslog-2216 then static-nat prefix-name haproxy_confd_sblb
set security nat static rule-set cso rule can-8081 then static-nat prefix-name haproxy_confd_sblb
set security nat static rule-set cso rule can-8082 then static-nat prefix-name haproxy_confd_sblb

  3. The haproxy process will be running in two types of virtual machines i,e proxy , proxy_sblb as shown below.

    For example, in the below output, Central proxy load balancer IP is 192.168.10.48 and central haproxy process runs on proxy1 and proxy2 virtual machines.
    Similarly, SBLB loadbalancer IP is 192.168.10.49, SBLB haproxy process runs on proxy_sblb1 and proxy_sblb2 virtual machines. 

    root@CSO512HA1:~/Contrail_Service_Orchestration_5.1.2# ./get_vm_details.sh  | egrep -i 'proxy'\|'sblb'\|'haproxy_confd_sblb'\|'haproxy_confd'
    haproxy_confd : 192.168.10.48
    haproxy_confd_sblb : 192.168.10.49
    proxy1 : 192.168.10.40
    proxy_sblb1 : 192.168.10.42
    proxy2 : 192.168.10.41
    proxy_sblb2 : 192.168.10.43


     Verify haproxy process in both of these machines. 

       root@CSO512HA1:~/Contrail_Service_Orchestration_5.1.2# ssh 192.168.10.42

   root@proxy_sblb1:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:5d:e0:4d brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.42/24 brd 192.168.10.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet 192.168.10.49/32 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe5d:e04d/64 scope link
       valid_lft forever preferred_lft forever

   root@proxy_sblb1:~# ps -ef | grep haproxy
root      6172  5168  0 15:44 pts/0    00:00:00 grep --color=auto haproxy
root     15064     1  0  2021 ?        00:01:29 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
haproxy  15071 15064  0  2021 ?        01:11:02 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid


root@CSO512HA1:~/Contrail_Service_Orchestration_5.1.2# ssh 192.168.10.40

root@proxy1:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:6b:00:f6 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.40/24 brd 192.168.10.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe6b:f6/64 scope link
       valid_lft forever preferred_lft forever

root@proxy1:~# ps -ef | grep haproxy
root      7528     1  0  2021 ?        00:01:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
haproxy   7535  7528  1  2021 ?        05:16:19 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
root     30164 30125  0 15:45 pts/0    00:00:00 grep --color=auto haproxy
root@proxy1:~#