Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Use Cisco CSS 11503 to load balance (or primary/secondary) MySQL databases port 3306

Posted on 2008-11-12
8
Medium Priority
?
2,609 Views
Last Modified: 2012-06-21
I'm looking for an example config, to use the Cisco CSS 11503 load balancer to send traffic TCP on port 3306 to 2 different MySQL databases. In other words, to load balance between two MySQL servers.

I'd also maybe even prefer to send all traffic to DB1 unless it's down, then send traffic to DB2 instead.

0
Comment
Question by:ldorazio
  • 4
  • 2
  • 2
8 Comments
 
LVL 3

Accepted Solution

by:
H_Harry earned 1000 total points
ID: 22943898
Have you a basic understanding of how to do it? (So I know how much detail to go in to).
Basically you need to create the circuit (VLAN),  the services which define the relevant IP addresses and port number, then apply them to a rule and point it to the VIP.

**** GLOBAL ****
ip route 0.0.0.0 0.0.0.0 X.X.X.X <- Your Default gateway
 
**** CIRCUIT ****
circuit VLAN1
ip address X.X.X.X 255.255.255.0 <- Subnet for VLAN with correct maske
 
**************** SERVICE ****************
service SQLServer1
ip address X.X.X.X <- IP Address of first SQL server
port 3306
protocol TCP <- Or UDP Dependant on the traffic
active
service SQLServer2
ip address X.X.X.X <- IP Address of second SQL Server
port 3306
protocol TCP <- Or UDP
active
**************** OWNER ******************
owner L3-Owner
content L3-Rule
add service SQLServer1
add service SQLServer2
vip address X.X.X.X <- Virtual IP address to use.
balance
aca active  
 
 
 
If there is no valid config on the device when you logon to it, it will run an automated config script with prompts asking for the relevant data - select Layer 3 load balancing and simply answer the relevant questions when prompted and it will auto-generate most of the configuration for you.
 
 
0
 
LVL 8

Assisted Solution

by:Nothing_Changed
Nothing_Changed earned 1000 total points
ID: 22944069
assuming your circuits nad interfaces and all are configured, this content configuration would accomplish your goal. Your database servers need to be "behind" the CSS for this to work, in other words there can be no network path to the database servers from the clients other than through the CSS.

This will use IP address of 10.1.1.0/24 for the services, 10.1.2.0/24 for the VIP, change these to match your address scheme. The keepalives will be a TCP connect to port 3306 terminated with a RST, they will run every 10 seconds, two failures will mark the server as dead, the wait 10 seconds before retrying the keepalive again.

This config will balance between the two servers equally via round robin, and stick clients to a server once they balance there.

service db1
  ip address 10.1.1.11
  protocol tcp
  port 3306
  keepalive type tcp
  keepalive frequency 10
  keepalive maxfailure 2
  keepalive retryperiod 10
  active

service db2
  ip address 10.1.1.12
  protocol tcp
  port 3306
  keepalive type tcp
  keepalive frequency 10
  keepalive maxfailure 2
  keepalive retryperiod 10
  active

owner MYSQL
  content MYSQL-database
    vip address 10.1.2.11
    port 3306
    protocol tcp
    add service db1
    add service db2
    advanced-balance sticky-srcip  
    active



This config will balance to one server only, roll clients over to the secondary server if the first one tanks, and moves clients back to the primary server once it is back up for 20 seconds. If you want to manually move clients instead of automatically, remove the two persistence commands. Moving clients back to the primary would require suspending the second server, then deactivating and reactivating the content rule.

persistence reset remap

service db1
  ip address 10.1.1.11
  protocol tcp
  port 3306
  keepalive type tcp
  keepalive frequency 10
  keepalive maxfailure 2
  keepalive retryperiod 20
  active

service db2
  ip address 10.1.1.12
  protocol tcp
  port 3306
  keepalive type tcp
  keepalive frequency 10
  keepalive maxfailure 2
  keepalive retryperiod 10
  active

owner MYSQL
  content MYSQL-database
    vip address 10.1.2.11
    port 3306
    protocol tcp
    add service db1
    advanced-balance sticky-srcip  
    no persistent
    primarySorryServer db2
    active




 


 
0
 
LVL 8

Expert Comment

by:Nothing_Changed
ID: 22944074
doh, didnt see the other response since i was typing, sorry.
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 

Author Comment

by:ldorazio
ID: 22944825

This one with the "Sorry Server" looks like it might be perfect, I hadn't thought at all about using that....

I don't completely understand this however:
  "Your database servers need to be "behind" the CSS for this to work... no network path... other than through the CSS."

My web servers are: 10.7.2.101 and 10.7.2.102
My DB servers are: 10.3.3.201 and 10.3.3.202

Currently the web servers can get to 10.3.3.x through the firewall...

I THINK it would be the VIP would be within the web server network (like 10.7.2.200) and then the services would point at 10.3.3.201 and 202, but I'm not sure?

Do I have to "turn off" access to 10.3.3.x through the firewall also?

Thanks.

0
 
LVL 3

Expert Comment

by:H_Harry
ID: 22948290
Hi,
"I don't completely understand this however:
  "Your database servers need to be "behind" the CSS for this to work... no network path... other than through the CSS."

It means that you have to ensure that all the traffic comes through the CSS and there is no other path for the data to take i.e. Via another router, switch etc - which will obviously negate the load balancer.
If the web server can get to the DB server through the firewall and bypass the CSS then yes you would need to prevent this and re-think the topology to prevent the data circumventing the CSS. (assuming the traffic coming from the web servers to the DB server is what you want load balanced)
 
 
0
 
LVL 8

Expert Comment

by:Nothing_Changed
ID: 22951924
yep, you need to ensure that the css stays in path between your db servers and the clients or app servers using them. typically, people use the CSS as a layer three boundary (as a router essentially) between two VLANs, one that contains the servers being balanced, and the other one  being either a transit to the rest of the network, or where your client nodes reside.

Reason being that the CSS balances with destination NAT. It takes a connection in and NATs it back out to one of the services configured for the content rule. If the service has another path back to the client other than thru the CSS, he will try to answer the client directly. But the client has no clue he is talking to that actual service, he thinks he is talking to a host with the IP address of the VIP in the content rule, so he ignores the response. Almost like a broken assymetrical route, sort of.

So, keeping the CSS "between" the clients and servers is the simple solution. If that's not possible, you can artificially engineer that path to be taken anyway using source groups, however that takes a lot more CPU resources on the CSS, and isn't as efficient network-wise.
0
 

Author Comment

by:ldorazio
ID: 22957310
Thank you, I will have to setup another VLAN / subnet to test this. I have the problem now that it gets to and through the CSS, but then it's going straight back to the web from DB just as you both said.

This probably won't get to be tested until next week now...
0
 
LVL 8

Expert Comment

by:Nothing_Changed
ID: 23035101
Any luck so far?
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I see many questions here on Experts Exchange regarding switch port configurations and trunks. This article is meant for beginners in the subject to help to get basic knowledge about Virtual Local Area Network (VLAN (http://en.wikipedia.org/wiki/Vir…
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses
Course of the Month20 days, 18 hours left to enroll

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question