Coyote Point Systems E350GX, Installation And Administration Manual

Page: 248 / 344

Chapter 9: Administering GeoClusters
244 Equalizer Installation and Administration Guide
To ensure that you have properly configured DNS for Envoy, you can use the nslookup command (supported on
most OS platforms) to confirm that the DNS server is returning appropriate records, as in this example:
nslookup www.coyotepoint.com
Server: ns1.coyotepoint.com
Address:
ns1-IP-address
Name: www.coyotepoint.com
Address: 192.168.2.44
Using Envoy with Firewalled Networks
Envoy sites communicate with each other using Coyote Point’s UDP-based Geographic Query Protocol (GQP).
Similarly, Envoy sites communicate with clients using the DNS protocol. If you protect one or more of your Envoy
sites with a network firewall, you must configure the firewall to permit the Envoy packets to pass through.
To use Envoy with firewalled networks, you need to configure the firewalls so that the following actions occur:
• Envoy sites communicate with each other on UDP ports 5300 and 5301. The firewall must allow traffic on
these ports to pass between Equalizer/Envoy sites.
• Envoy sites and clients can exchange packets on UDP port 53. The firewall must allow traffic on this port
to flow freely between an Envoy site and any Internet clients so that clients trying to resolve hostnames via
the Envoy DNS server can exchange packets with the Envoy sites.
• Envoy sites can send ICMP echo request packets out through the firewall and receive ICMP echo response
packets from clients outside the firewall. When a client attempts a DNS resolution, Envoy sites send an
ICMP echo request (ping) packet to the client and the client might respond with an ICMP echo response
packet.
Using Envoy with NAT Devices
If an Envoy site is located behind a device (such as a firewall) that is performing Network Address Translation
(NAT) on incoming IP addresses, then you must specify the public (non-translated) IP as the Site IP, and use the
translated IP (the non-public IP) as the resource (cluster) IP in the Envoy configuration.
This is because Envoy must return the public cluster IP to a requesting client in order for the client to be able to
contact that cluster -- since the request goes through the NAT device before it reaches Equalizer. The NAT device
translates the public cluster IP in the request to the non-public cluster IP that is defined on Equalizer, and then
forwards the packet to Equalizer.
The non-public cluster IP must still be specified as the resource IP for the site, as this is the IP that Envoy will use
internally to probe the availability of the resource (cluster) on the site.
Upgrading a Version 7 GeoCluster to Version 8
Envoy in Version 8 is designed to work with existing sites running Version 7. You can upgrade a Version 7 site in-
place to Version 8, and it will continue to operate seamlessly with other Version 7 sites in the GeoCluster. In order to
work with resources located on other Version 8 sites, however, the configuration must be updated with the cluster
name, as noted below:
1. Upgrade sites one at a time, starting with the non-default sites. Test thoroughly before upgrading the next site.
2. The resource (cluster) name for any resource that is located on a site running Version 7 of the Equalizer
software must be left blank. Specify the cluster IP and port instead.
3. The resource (cluster) IP and port for any resource that is located on a site running Version 8 of the Equalizer
software must be left blank. Specify the cluster name instead.