cannot reach isolation address

[Mike_Deardurff]

Im just looking for alitle clarification here. Ive checked the forums, but there seems to be several views and configurations for setting redundancy for HA with isolations addresses.

I have configured a second service console PG on my VMotion vswitch and assigned a 172.16.10.x address to each host. The vmkernel addresss is 172 as wel with 172.16.10.254 as the DG

I have put in the das.isolationaddress2 = 172.16.10.254 for the cluster as well and reconfigured, but i then get the warning that neither host can reach that IP. Of course i cant ping the gateway either from the COS. Is the vmkernel DG ever supposed to be pingable???

Should i maybe change it to the production nework DG and change the vmkernel and isolation addresses. would that help? Im a little confused.

thanks

-Mike

[jbsengineer]

Mike,

If you are using 2 seperate SC's I find it works best when you have the second SC on a seperate network. I found when on the same network and the first SC was disconnected I could not communicate to the isolationaddress from the secondary SC. I would check the communication to your DG as it sounds like something is wrong. The COS should be able to ping your gateway if the gateway allows it.

[Mike_Deardurff]

hello,

Are you saying i should be able to ping the vmkernel gateway? I can of course ping the vswif0 Service Console gateway, but i am just unable to hit the vmkernel private network default gateway. If the network is a private network, what config should be made to the vmkernel gateway so i can ping it? In reality, the vmkernel gatway does not go anywhere since its just a network for vmotion.

[jbsengineer]

Sorry I thought you were referring the DG on the SC. My VMkernel PG's don't have gateways set as I use a fiber SAN. If it's only being used for Vmotion then there is absuletly no reason for a gateway. You would only use a gateway for iSCSI and NFS situations. There is a warning when you don't have it set but I just ignore the warning.

Pinging the gateway from the COS will be using the Service Console vswitch for communication. You should be able to ping the gateway.

[Mike_Deardurff]

Ok, i think we are both on the same page as far as that and im actually in the same situation, as im using a fiber san here too. However, in this case, for redundancy on the mgmt network (for HA reasons) i added a 2nd service console portgroup to the private vmkernel network, with an ip of the private net. Would this function properly even if the vmotion network is private? Im assuming if the vmkernel gatway isnt pingable, it wont do any good when it comes to isolation unless its just the ESX hosts talking to eachother through it. does that make sense?

thanks

-mike

[jbsengineer]

In the event your network goes down on the vswif0 (first service console) you dont want the Host to become isolated. So having a second service console setup on a private network is a good idea. This prevents the Host from falling into isolation mode and following the isolation response. The key here is to set your isolationaddress2 to a pingable IP on your second service console network (which in your case is would not be the gateway of the VMkernel PG network). Other than the gateway on the VMkernel network is there an always on network device or such that you can use?

Have you thought about adding a second PNIC that is uplinked to a seperate physical switch to your vswif0? This would add redundancy to your SC and you wouldn't ahve to have a second SC and such.

[Mike_Deardurff]

Thanks for staying with me through this.

You are right on with your analysis as well, that is exactly what im trying to do. Sadly i dont have any other devices on this network as its jsut a private network for vmotion. However, i actually already linked another vmnic to my vswif0 vswitch for service console (though its not on a seperate network switch) . I did it more for nic failure reasons, which is why i wanted to try setting up the second service console as well. Thought i mine as well do both methods, as long as it doesnt hurt anything. I had the extra nic any way for the standby on vswif0 too, why not...

Do you think i could use the IP of the actual vmkernel interface as the gateway in this situation? Techincally it would be pingable by the other host. I dont really have any other device IPs to use on that network. running out of options

-Mike

[jbsengineer]

"Do you think i could use the IP of the actual vmkernel interface as the gateway in this situation?"

When you say "as the gateway" your talking about the second isolation address correct? This would be the das.isolationaddress2 setting in advanced. Setting this to be another hosts VMkernel interface IP technically would work. Maybe someone else can chime in with any major problems with this configuration.

First glance you are already protected from a NIC failure on the vswif0. So the second SC would be useful in the event of losing your physical switch providing network uplink to the vswif0. Having a second SC with second isolation address set as an opposite Hosts VMkernel IP would prevent isolation as far as I can tell, :-).

On the private network you have setup for the VMkernel Vmotion network is the physical switch you are plugging into managable? Could you set an IP on it?

[Mike_Deardurff]

Yes, you are correct. Sorry, that is what i meant when referring to gateway i meant isolation address. I actually just tried changing the advanced settings to have isolationaddress2 and 3 pointing to the 2nd service console IPs and when i reconfigured HA it removed the warning (since those IPs are pingable). Hopefully this will actually provide redundancy in the case of an isolation.

The vmotion network connection are on a network switch houseing the rest of their production network. Unfortunately i cant assign an 172 private IP, but that was a good idea. Anyone else have some ideas or thoughtS?

-Mike

[abaum]

Just out of curiosity, did you tell HA to ignore the default gateway? das.usedefaultisolationaddress=false. I sem to recall that if you are going to add additional isolation addresses, you need to override the default behavior.

adam