Configuring Redundancy Parameters

You can perform redundancy-related configuration tasks on Solace PubSub+ appliances.

The event broker redundancy facility must be turned off before any commands other than the release-activity or auto-revert Redundancy CONFIG commands are run. The event broker redundancy facility is turned off by default.

Config-Sync will not automatically synchronize the objects/properties discussed in this section. Therefore, you must manually configure these objects/properties on each high-availability (HA) PubSub+ event broker.

To determine whether an object/property is synchronized by Config-Sync, look up the command used to configure the object/property in the CLI Command Reference or type the command in the Solace CLI, ending the command with "?". You can use the help to determine whether the object/property is synchronized.

Enabling Auto-Revert

The auto-revert option controls what happens when the primary appliance comes back online after a failover has occurred.

When auto-revert isn't enabled (which is the default and recommended state), the primary appliance stays as a standby after it comes back online, allowing the backup appliance to remain active. In this case, the primary appliance becomes active only if the backup appliance fails or gives up activity. For more information, see Forcing Backups to Give Up Activity to Primaries.

If auto-revert is enabled, as soon as the primary appliance comes back online, it becomes active and switches the backup appliance from active to standby.

It's recommended that you don't enable auto-revert on a Solace PubSub+ appliance. For example, a manual switch over is recommended so that you can determine why the failure occurred, and take action if required before the primary appliance takes activity again.

To enable auto-revert, enter the following CONFIG commands:

solace1# configure
solace1(configure)# redundancy
solace1(configure/redundancy)# auto-revert

To disable auto-revert, enter the following CONFIG commands:

solace1# configure
solace1(configure)# redundancy
solace1(configure/redundancy)# no auto-revert

It's recommended you set the same auto-revert state for both appliances in an HA pair.

Configuring a Mate Appliance Name

To configure the name of the mate appliance for the given appliance, which allows messages within the network to be redirected to the mate in the event of an activity switch, enter the following commands:

solace# configure
solace(configure)# redundancy
solace(configure/redundancy)# mate-router-name <name>

Where:

<name> is the router name of the mate appliance. Router names can contain up to 64 characters, composed of alphanumeric characters 0 to 9, a to z, A to Z, underscore '_', dot '.', and hyphen '-'. Note that '_', '.' and '-' cannot be used at the beginning or end of a router name. Router names must be unique among all configured event brokers.

The no version of this command, no mate-router-name deletes the given name from the mate appliance.

You can only run this command with event broker redundancy and routing shutdown.
If the mate router-name is changed, a restart is required for the change to take effect.

Releasing Activity

To surrender activity from the given appliance to its mate for both the primary and backup virtual router VRIDs (provided the mate appliance is available, otherwise an error message is received), enter the following CONFIG commands:

solace# configure
solace(configure)# redundancy
solace(configure/redundancy)# release-activity

The no version of this command, no release-activity, causes the appliance to return the priorities of the VRIDs to their normal values and to take activity back for the local VRID.

Executing a no release-activity after a release-activity on an appliance can take back activity from its mate (regardless of the mate’s auto-revert setting) if the no release-activity is executed before the mate becomes fully active.

Assigning a Redundancy Interface

Redundancy interfaces are one or more message backbone appliance interfaces that you specify should be used for redundancy. You can assign up to two interfaces, effectively providing each appliance with multiple VRRP interfaces.

The interfaces you decide to assign should depend on your intended network topology. For example, a typical Solace appliance use case is a deployment in a demilitarized zone with separate north and southbound interfaces configured as LAGs.

Solace PubSub+ Appliance Deployed in a Demilitarized Zone

With only a single redundancy interface assigned on each appliance (e.g. LAG1), if the other interface (LAG2) goes down, the active appliance continues to provide service even though the messages cannot be forwarded out of the failed interface.

To solve this problem, you would assign both interfaces as redundancy interfaces, and specify the failover criteria as any-fail (refer to Specifying the Redundancy Failover Criteria ). Once configured, the active appliance will release activity to the standby if either LAG1 or LAG2 fails.

You must designate at least one interface as a redundancy interface on each appliance in order to enable redundancy.

To assign a redundancy interface, enter the following commands:

solace(configure)# redundancy
solace(configure/redundancy)# vrrp
solace(configure/redundancy/vrrp)# interface <phy-interface>

Where:

<phy-interface> is an ASCII string specifying the Ethernet interface port or LAG to be assigned. Valid values are eth<port> (for example, eth1); <cartridge>/<slot>/<port> (for example, 1/1/8); <cartridge>/<slot>/lag<N> (for example, 1/1/lag1). There is no default value. You can assign a maximum of two redundancy interfaces.

Specifying the Redundancy Failover Criteria

By default, PubSub+ appliances release activity to the mate if any configured redundancy interface fails. You can instead specify that all redundancy interfaces must fail to trigger an activity switch. The decision to change the failover criteria should depend on your intended network topology.

For example, suppose your network had an HA pair of appliances deployed in a demilitarized zone, each with separate north and southbound interfaces assigned as redundancy interfaces (refer to Solace PubSub+ Appliance Deployed in a Demilitarized Zone). Since you want the active appliance to trigger an activity switch if either interface (north or southbound) were to fail, you would set the failover criteria to any-fail. If you had a different topology that demanded the opposite behavior, for example a dual network deployment, you would set the failover criteria to all-fail.

Solace PubSub+ Appliance in a Dual Network Deployment

Using PubSub+ appliances in dual network deployments is a Controlled Availability (CA) feature and should only be used under the supervision of Solace support.

To specify the failover criteria for an appliance, enter the following commands:

solace(configure)# redundancy
solace(configure/redundancy)# vrrp
solace(configure/redundancy/vrrp)# failover-criteria {any-fail | all-fail}

Where:

any-fail specifies to release activity to the mate if any configured redundancy interface fails. This is the default.

all-fail specifies to release activity to the mate if all configured redundancy interfaces fail.

Configuring a VRRP VRID

Assigning the Active/Standby Role

To set the event broker's redundancy role, enter the following CONFIG commands:

Redundancy must be disabled to change the active-standby-role. If AD is enabled, then the active-standby-role must be none, or match that of AD.

solace# configure
solace(configure)# redundancy
solace(configure/redundancy)# active-standby-role {primary | backup | none}

Where:

primary specifies that the event broker is acting as the primary virtual router in an active/standby redundancy model

backup specifies that the event broker is acting as the backup virtual router in an active/standby redundancy model.

none specifies that the event broker is using an active/active redundancy model, or that the event broker's active/standby role is being derived from other configuration settings. The none value is recommended only when using active/active redundancy.

Starting/Stopping Redundancy

To stop the redundancy facility on an appliance, enter the following CONFIG commands:

solace# configure
solace(configure)# redundancy
solace(configure/redundancy)# shutdown

When you stop redundancy on the appliance, the following occurs:

The appliance will be active for its VRID, but will not take activity for its mate VRID.
The appliance immediately announces its local VRID with the highest possible priority supported by VRRP and completely stops announcing its mate VRID. The same priority levels are also advertised through the CSPF protocol, to ensure that all appliances in the network recognize that the VRID mastership changes immediately.

To start the redundancy facility on an appliance, enter the following CONFIG commands:

solace# configure
solace(configure)# redundancy
solace(configure/redundancy)# no shutdown

The no shutdown command for redundancy can only be run successfully after the VRIDs for the primary and backup virtual routers have been configured.

Provide feedback