<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>
<div dir="auto">
<div dir="auto">Ah, and yes, it is for iptables, not for nft or firewalld. Could be easily fixed though. </div><div dir="auto">And RA expects target chains to be pre-created.</div><div dir='auto'><br></div>
<div id="aqm-original" style="color: black;">
<div dir="auto">Vladislav Bogdanov <bubble@hoster-ok.com> 5 апреля 2023 г. 14:53:35 написал:</div>
<div><br></div>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #808080; padding-left: 0.75ex;">
<div dir="auto">Please find attached.</div>
<div dir="auto">I use it the following way:</div>
<div dir="auto"><br></div>
<div dir="auto">primitive vip-10-5-4-235 ocf:my-org:IPaddr2 \</div>
<div dir="auto"> params ip="10.5.4.235" cidr_netmask="24" \</div>
<div dir="auto"> op start interval="0" timeout="20" \</div>
<div dir="auto"> op stop interval="0" timeout="20" \</div>
<div dir="auto"> op monitor interval="30" timeout="20"</div>
<div dir="auto">primitive vip-10-5-4-235-fw ocf:my-org:VIPfirewall \</div>
<div dir="auto"> params vip="10.5.4.235" allow_action="pass" \</div>
<div dir="auto"> input_chain="_ISCSI_INPUT" output_chain="_ISCSI_OUTPUT" \</div>
<div dir="auto"> op start interval="0" timeout="30" \</div>
<div dir="auto"> op stop interval="0" timeout="60" \</div>
<div dir="auto"> op monitor interval="30" timeout="10" role="Master" \</div>
<div dir="auto"> op monitor interval="15" timeout="10" role="Slave"</div>
<div dir="auto">primitive vip-10-5-4-236 ocf:my-org:IPaddr2 \</div>
<div dir="auto"> params ip="10.5.4.236" cidr_netmask="24" \</div>
<div dir="auto"> op start interval="0" timeout="20" \</div>
<div dir="auto"> op stop interval="0" timeout="20" \</div>
<div dir="auto"> op monitor interval="30" timeout="20"</div>
<div dir="auto">primitive vip-10-5-4-236-fw ocf:my-org:VIPfirewall \</div>
<div dir="auto"> params vip="10.5.4.236" allow_action="pass" \</div>
<div dir="auto"> input_chain="_ISCSI_INPUT" output_chain="_ISCSI_OUTPUT" \</div>
<div dir="auto"> op start interval="0" timeout="30" \</div>
<div dir="auto"> op stop interval="0" timeout="60" \</div>
<div dir="auto"> op monitor interval="30" timeout="10" role="Master" \</div>
<div dir="auto"> op monitor interval="15" timeout="10" role="Slave"</div>
<div dir="auto">group c01-pool-0-iscsi-vips vip-10-5-4-235 vip-10-5-4-236</div>
<div dir="auto">group c01-pool-0-iscsi-vips-fw vip-10-5-4-235-fw vip-10-5-4-236-fw</div>
<div dir="auto">ms ms-c01-pool-0-iscsi-vips-fw c01-pool-0-iscsi-vips-fw \</div>
<div dir="auto"> meta master-max="1" master-node-max="1" clone-max="2" \</div>
<div dir="auto"> clone-node-max="1" notify="false" interleave="true" \</div>
<div dir="auto"> target-role="Master"</div>
<div dir="auto">colocation c01-pool-0-iscsi-vips-fw-with-vips inf: \</div>
<div dir="auto"> ms-c01-pool-0-iscsi-vips-fw:Master \</div>
<div dir="auto"> c01-pool-0-iscsi-vips:Started</div>
<div dir="auto">order c01-pool-0-iscsi-vips-fw-after-target inf: iscsi-export:start \</div>
<div dir="auto"> ms-c01-pool-0-iscsi-vips-fw:promote</div>
<div dir="auto">order c01-pool-0-iscsi-vips-fw-after-vips inf: \</div>
<div dir="auto"> c01-pool-0-iscsi-vips:start \</div>
<div dir="auto"> ms-c01-pool-0-iscsi-vips-fw:promote</div>
<div dir="auto"><br></div>
<div dir="auto">On Wed, 2023-04-05 at 07:17 +0300, Александр via Users wrote:</div>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #0099CC; padding-left: 0.75ex;">
<div dir="auto">What is this agent? For iscsitarget, I only found portblock RA, in</div>
<div dir="auto">the linstor manual. Can you share the agent and setup instructions?></div>
<div dir="auto">Среда, 5 апреля 2023, 6:09 +10:00 от Vladislav Bogdanov</div>
<div dir="auto"><bubble@hoster-ok.com>:</div>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #9933CC; padding-left: 0.75ex;">
<div dir="auto"> </div>
<div dir="auto">I know that uscsi initiators are very sensible to connection drops.</div>
<div dir="auto">That's why in all my setups with iscsi I use a special m/s resource</div>
<div dir="auto">agent which in a slave mode drops all packets to/from portals. That</div>
<div dir="auto">prevents initiators from receiving FIN packets from the target when</div>
<div dir="auto">it migrates, and they usually behave much better. I can share that</div>
<div dir="auto">RA and setup instructions if that is interesting to someone.</div>
</blockquote>
<div dir="auto"> </div>
<div dir="auto"> </div>
<div dir="auto">--</div>
<div dir="auto">С уважением,</div>
<div dir="auto">Александр Волков</div>
<div dir="auto"> </div>
<div dir="auto">_______________________________________________</div>
<div dir="auto">Manage your subscription:</div>
<div dir="auto">https://lists.clusterlabs.org/mailman/listinfo/users</div>
<div dir="auto"><br></div>
<div dir="auto">ClusterLabs home: https://www.clusterlabs.org/</div>
</blockquote>
<div dir="auto"><br></div>
<div dir="auto"><br></div>
<div dir="auto"><br></div>
<div dir="auto"><br></div>
<div dir="auto">----------</div>
<div dir="auto">_______________________________________________</div>
<div dir="auto">Manage your subscription:</div>
<div dir="auto">https://lists.clusterlabs.org/mailman/listinfo/users</div>
<div dir="auto"><br></div>
<div dir="auto">ClusterLabs home: https://www.clusterlabs.org/</div>
</blockquote>
</div><div dir="auto"><br></div>
</div></body>
</html>