Redundant gateways and load sharing: VRRP, ECMP, bonding
You build a network with no single point of failure using link bonding, VRRP with keepalived and ECMP, and verify every failover by measuring it.
Level 401 · 14 lessons · 12 practice labs
Lessons
Link redundancy
- Linux bonding modes: active-backup, 802.3ad
- Link aggregation with LACP
- Pulling the cable: measuring failover time
- Short task: give a server a redundant link
Gateway redundancy
- VRRP: virtual IP, master and backup
- Setting up VRRP with keepalived
- Smarter takeover with tracking scripts
- Split brain and how to prevent it
- Short task: run two Linux gateways as a redundant pair
Load sharing
- ECMP: equal-cost multipath
- Flow hashing and session stickiness
- Publishing services with anycast
- Short task: share the load across two links
Wrap-up
- Capstone: a branch network with no single point of failure
Practice labs
- The bond uses the slow card: Show a server’s active-backup bond using the slow interface instead of the fast one, set the primary interface and confirm it in the bond status file.
- The LACP bond will not form: Find a bond set to the wrong mode while the far end expects LACP, convert it to 802.3ad and show both members joining the aggregate in the status file.
- How many milliseconds is the outage?: Measure how many packets Oakmere Studios’s storage server bond loses when a cable is pulled, improve the monitoring settings and show the reduced loss with before-and-after measurements.
- The master came back, the address did not: Find in the priority and preempt settings why the master gateway does not take the virtual address back after maintenance, fix it and test the return.
- The gateway is up but has no internet: Solve the master gateway keeping the virtual address after its uplink dies by adding a tracking script, and test the takeover by cutting the uplink.
- Two masters at once: split brain: Find the causes (filtered VRRP packets, mismatched IDs) making both of Harborview Hospital’s gateways master at once, fix them and prove with ARP tables that only one master remains.
- The new link was added but sits idle: Show the second link is never used because its route has a different metric, turn it into an ECMP route with two next hops and prove it with interface counters.
- All traffic piles onto one link: Find in the hash policy why many flows from one source always take the same link, switch to layer-4 hashing and measure the spread.
- The same DNS address in two places: Announce a DNS service from two servers on the same anycast address, withdraw the route when the health check fails, and show clients moving to the other server.
- Find the single point of failure: Review Ekin Co-op’s branch diagram and configuration, list the points whose single failure would stop the whole branch, and confirm each by shutting it in the lab.
- A failure drill with a timing table: Run a drill on a branch with bonding, VRRP and ECMP that disables each component in turn, and record each failure’s outage time in a table.
- The failover caused a cascade: Investigate a branch where a VRRP takeover clashes with ECMP routes and blackholes traffic after a link failure, fix the issues and show traffic flowing through the same failure.
About this course
You build a network with no single point of failure using link bonding, VRRP with keepalived and ECMP, and verify every failover by measuring it.
What you will learn
- Link redundancy
- Gateway redundancy
- Load sharing
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.