corosync prioritization

[guletz]

Hi to all,

Because I have some troubles with corosync traffic in the backup time of my VM, I think that I could do some kind of prioritization of corosync traffic using DSCP. All my switches can do DSCP, and I guess that also the Proxmox kernel/iptables can do that.
In the end I will hope that any corosync traffic to be improved (for latency point of view).

My question for is that kind of setup was make by any others Proxmox users, and maybe someone have some experience with this.
As a side note, I know that for ospf traffic, linux kernel know to use by default DSCP. In my humble opinion I think that the same it will be nice also for corosync / Proxmox.

Thx. in advance for any ideea about this subject.

 

[wolfgang]

Hi,

I think the best and easiest solution is to separate the networks physically.

 

[guletz]

I think the best and easiest solution is to separate the networks physically.

I know this, but I can not do it. So I must find a solution for my case(without separate networks )

Thx.

 

[latosec]

vlan? Usually switches support vlan priority

 

[guletz]

vlan? Usually switches support vlan priority

Thx.

I solved in my case with DSCP. Now when I make backup, corosync is not affected.

 

[latosec]

Goodbye. Cancella gli explain how?

 

[guletz]

Goodbye. Cancella gli explain how?

Bon jorno,

I guess you ask how I do it. In my case I make backup of my VMs using 2 different tools (be wary then sorry ), zfs send/recive and old rsync.
On the each node I mark corosync traffic with a higher DSCP priority compared with rsync(iptables). All my network switches are also DSCP capable.
After that, I do not see any messages who tell that corosync was lost the communication with the rest of the Proxmox nodes.


Ciao

 

[TwiX]

Hi,

Are you using iptables/netfilter to do it ?
What kind of rules you created ?

Thanks,

 

[guletz]

.... like this?

$IPT -t mangle -N dscp-mark48
$IPT -t mangle -A dscp-mark48 -j DSCP --set-dscp 48
$IPT -t mangle -A PREROUTING -p udp -m udp --dport 5404:5405 -j dscp-mark48
$IPT -t mangle -A INPUT -p udp -m udp --dport 5404:5405 -j dscp-mark48
$IPT -t mangle -A OUTPUT -p udp -m udp --dport 5404:5405 -j dscp-mark48

 

[TwiX]

Thanks !

So I guess you don't use proxmox firewall ?

 

[guletz]

So I guess you don't use proxmox firewall ?

No. For me, it is too complicated! I use a custom iptables firewall(KISS) + a hardware firewall

 

[LnxBil]

So I guess you don't use proxmox firewall ?

The rules do not interfere with the PVE firewall, it is not using the mangle table. You just need to set them somewhere else.