Cluster across VPN?

[mylesw]

We have two data centers - about 2,000 miles apart. They are linked together with a Net-to-Net IPSEC configuration, and have their own subnet addresses for the internal networks. Each can see the other. I can ping from either data center to the other without issue.

I have a cluster operational at one data center with 5 nodes connected and working just fine. I'm trying to add another node that is at the 2nd data center, on a different sub-net address.

When I attempt to add the node from the remote location, using pvecm add <ip address of master>

it goes through the motions just fine, but when it gets to quorum, it goes into a perpetual wait state. Like this:

pvecm add xxx.xxx.xxx.xxx
The authenticity of host 'xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)' can't be established.
ECDSA key fingerprint is 56:94:e5:be:64:76:09:f6:5c:xx:xx:xx:aa:36:f4:ee.
Are you sure you want to continue connecting (yes/no)? yes
root@xxx.xxx.xxx.xxx's password:
copy corosync auth key
stopping pve-cluster service
Stopping pve cluster filesystem: pve-cluster.
backup old database
Starting pve cluster filesystem : pve-cluster.
Starting cluster:
Checking if cluster has been disabled at boot... [ OK ]
Checking Network Manager... [ OK ]
Global setup... [ OK ]
Loading kernel modules... [ OK ]
Mounting configfs... [ OK ]
Starting cman... [ OK ]
Waiting for quorum... Timed-out waiting for cluster
[FAILED]
waiting for quorum...

I read a lot about multicast issues, etc. but this is a VPN and should behave as if the communications is local. The difference, however, is that they are on different subnets.

Since we use VPNs to maintain a perpetual connection between data centers (common practice), how do you to a cluster between then through the VPN? We've had this working fine before with PM 1.8 but ever since the updates from v2+ the whole clustering thing has become an over complicated mess to deal with. That said, I'd really like to get this back to a working state again.

Can what we are trying to do be done? Can anyone who has done this before, give me some pointers?

Thanks
Myles

 

[ebony]

http://www.nedproductions.biz/wiki/...uster-running-over-an-openvpn-intranet-part-1

Take some pointers from this I say its your hosts file you need to set the vpn ip as pveloclhost I have the same setup running fine 3 datacentres and home servers.

 

[mylesw]

http://www.nedproductions.biz/wiki/...uster-running-over-an-openvpn-intranet-part-1

Take some pointers from this I say its your hosts file you need to set the vpn ip as pveloclhost I have the same setup running fine 3 datacentres and home servers.

Thanks for the information. It certainly sounds like what you are saying is correct, but your instructions are specific to OpenVPN. We are using IPSec for this, through IPCop v2 firewalls with a Net-to-Net link. I'm not sure how to translate your OpenVPN instructions to an IPSec VPN setup. Would they translate?

 

[ebony]

Thanks for the information. It certainly sounds like what you are saying is correct, but your instructions are specific to OpenVPN. We are using IPSec for this, through IPCop v2 firewalls with a Net-to-Net link. I'm not sure how to translate your OpenVPN instructions to an IPSec VPN setup. Would they translate?

just skip the open vpn stuff take the bits you need and the bits you don't need.

1st you need to make sure multicast is working. (thats part 4) [FONT=Arial, FreeSans, sans-serif]ssmping.[/FONT]
[FONT=Arial, FreeSans, sans-serif]The hosts file bit will be needed as well.[/FONT]

[FONT=Arial, FreeSans, sans-serif]as long as the Host file is setup to your local vpn network not using the public ip and you have multicast working in both ends then it should join fine.[/FONT]