Keepalived - Floating IP between 2 hosts

Creating a floating IP between 2 hosts is very handy when dealing with High Availability in dependency of one or more services. I'll use a floating IP between 2 IPA Servers in Order to create an HA-DNS Endpoint so that servers can be upgraded independently.

Here's a short description:

ipa01.archyslife.lan:

  - ip: 172.31.10.5

  - service: named-pkcs11

  - keepalived-state: MASTER

ipa02.archyslife.lan

  - ip: 172.31.10.6

  - service: named-pkcs11

  - keepalived-state: BACKUP

First of all, install the 'keepalived' package on all servers:

 [archy@ipa01 ~]$ sudo yum -y install keepalived  
 [archy@ipa02 ~]$ sudo yum -y install keepalived  

Now, create the configuration for the main Instance first:

 [archy@ipa01 ~]$ sudo vim /etc/keepalived/keepalived.conf  

 ! Configuration File for keepalived  
 global_defs {  
   notification_email {  
     admins@archyslife.lan  
   }  
   notification_email_from root@ipa01.archyslife.lan  
   smtp_server 127.0.0.1  
   smtp_connect_timeout 30  
 }  
 vrrp_script chk_named {  
   script "/usr/sbin/pidof named-pkcs11"  
   interval 2  
 }  
 vrrp_instance VI_1 {  
   state MASTER  
   interface eth0  
   priority 100  
   virtual_router_id 51  
   unicast_src_ip 172.31.10.5  
   unicast_peer {  
     172.31.10.6  
   }  
   authentication {  
     auth_type PASS  
     auth_pass C3iQ2q6GhlavkXMBUzFL8tpuibK2vPRG  
   }  
   track_script {  
     chk_named  
   }  
   virtual_ipaddress {  
     172.31.10.4  
   }  
 }  

With the main instance configured, let's configure the backup instance:

 [archy@ipa02 ~]$ sudo vim /etc/keepalived/keepalived.conf  

 ! Configuration File for keepalived  
 global_defs {  
   notification_email {  
     admins@archyslife.lan  
   }  
   notification_email_from root@ipa02.archyslife.lan  
   smtp_server 127.0.0.1  
   smtp_connect_timeout 30  
 }  
 vrrp_script chk_named {  
   script "/usr/sbin/pidof named-pkcs11"  
   interval 2  
 }  
 vrrp_instance VI_1 {  
   state BACKUP  
   interface eth0  
   priority 100  
   virtual_router_id 51  
   unicast_src_ip 172.31.10.6  
   unicast_peer {  
     172.31.10.5  
   }  
   authentication {  
     auth_type PASS  
     auth_pass C3iQ2q6GhlavkXMBUzFL8tpuibK2vPRG  
   }  
   track_script {  
     chk_named  
   }  
   virtual_ipaddress {  
     172.31.10.4  
   }  
 }  

Now that both instances are configured, restart the 'keepalived' service on each host and once the services are back up, the virtual ip should be assigned on the specified interface:

 [archy@ipa01 ~]$ sudo systemctl restart keepalived.service  
 [archy@ipa02 ~]$ sudo systemctl restart keepalived.service  

Check for the Virtual-IP:

 [archy@ipa01 ~]$ ip -c -4 addr show eth0  

 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000  
   inet 172.31.10.5/24 brd 172.31.10.255 scope global noprefixroute eth0  
     valid_lft forever preferred_lft forever  
   inet 172.31.10.4/32 scope global eth0  
     valid_lft forever preferred_lft forever  

 [archy@ipa02 ~]$ ip -c -4 addr show eth0  

 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000  
   inet 172.31.10.6/24 brd 172.31.10.255 scope global noprefixroute eth0  
     valid_lft forever preferred_lft forever  

Okay, so the startup works as expected now let's check if the failover works as expected:

 [archy@ipa01 ~]$ sudo ipactl stop  
 [archy@ipa01 ~]$ ip -c -4 addr show eth0  

 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000  
   inet 172.31.10.5/24 brd 172.31.10.255 scope global noprefixroute eth0  
     valid_lft forever preferred_lft forever  

 [archy@ipa02 ~]$ ip -c -4 addr show eth0  

 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000  
   inet 172.31.10.6/24 brd 172.31.10.255 scope global noprefixroute eth0  
     valid_lft forever preferred_lft forever  
   inet 172.31.10.4/32 scope global eth0  
     valid_lft forever preferred_lft forever  

The Failover works as expected. Once the named-pkcs11 fails, keepalived will trigger a failover to the peer-node. 

Feel free to comment and / or suggest a topic.