Phone Lines icon GFI Support Home

Articles in this section

Increasing reliability of Kerio Control for HA

Author: Vladyslav Velychko Updated

Overview

While facing stability issues with HA mode, the Master and Slave appliances might be showing in Disabled status. The intermittent configuration glitches might result in duplicated Traffic rules for VRRP service.

This article provides details on the HA general workflow and file transfer mechanisms together with best-practices for Hardware boxes.

Information

General workflow

  • When HA setup is completed, Master gets virtual IP. The slave is a passive device and all traffic is served by the master. If there is any change in configuration on the master, it is synced to slave within a 10-sec delay.
  • When the Master gets down, the slave takes the virtual IP and starts serving all traffic. At the same time, the slave clears all its statistics.
  • When the master comes back, it receives a virtual IP and starts to serve traffic again. Slave reports back all statistics it recorded while the master was down.

Screen_Shot_2020-12-28_at_4.43.23_PM.png

The corrupted Master or Slave statistics may lead to unreliable HA functioning.

Every 30 seconds, you may receive the following output in Error logs:

  [23/Sep/2020 14:50:35] (335544721) DB: unable to connect to database, Firebird DB error message follows:

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: *** IBPP::SQLException ***

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: Context: Database::Connect

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: Message: isc_attach_database failed

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: SQL Message : -902

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: Unsuccessful execution caused by a system error that precludes successful execution of subsequent statements

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: Engine Code : 335544721

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: Unable to complete network request to host "localhost".

  [23/Sep/2020 14:50:35] (335544721) Firebird DB: Failed to establish a connection.

To fix these errors, please refer to Resolving Firebird Database errors.

HA File transfer

Control transfers files for two cases:

  • If there is a configuration change in master, it is synced to slave
  • If the master is back from failure, slave transfer statistics DB to master

For these 2 cases, the sending part needs a token provided by the peer which is obtained in a handshake stage.

Screen_Shot_2020-12-28_at_4.55.51_PM.png

To improve the performance of HA transfers, make sure to review all redundant log generation.

  1. disable all Debug log options: in Messages > Logging Messages screen, right-click and select "Uncheck All"
    Screen_Shot_2020-12-28_at_5.37.18_PM.png
  2. review the content filter and traffic rules and disable unnecessary Accounting options:
    Screen_Shot_2020-12-28_at_5.38.25_PM.png
    Screen_Shot_2020-12-28_at_5.39.41_PM.png

Traffic Rules dupes

To overcome additional VRRP traffic rules being constantly added, disable automatic rule creation on both Master and Slave devices.

  1. Login to Kerio Control using SSH.

  2. Execute the following command: ./tinydbclient "update HaConfig set AutoCreateRule=0"

For more information please refer to HA Special cases.

 

Tip: If the hardware devices were used previously in the production environment, make sure to factory reset both Master and Slave boxes before enabling HA mode. This way the old configuration will not overlap with additional HA settings.

Related articles