IPfilter
[Top] [All Lists]

Re: keep state "issue" / possible feature for the future?

To: <ipfilter@coombs.anu.edu.au>, <chrisj@ucia.gov>
Subject: Re: keep state "issue" / possible feature for the future?
From: "Stuart Remphrey" <stuart.remphrey@rmit.edu.au>
Date: Sat, 03 Mar 2007 01:05:43 +1100
Delivered-to: sp-com-lists@consult.net
Delivered-to: ipfilter-list@securepoint.com
Sender: owner-ipfilter@coombs.anu.edu.au
Quick comment on this before I crash - there was discussion
on an opensolaris.org forum (network-discuss? nov-dec'06?)
about similar (same?) issues, and adding the ability for a process
to require a specific ipaddr (or interface?) be used for outgoing
traffic (like a per connection sockopt for example).

As opposed to choosing any available route
back to the original source addr.

Don't recall the details off-hand nor the decision if any,
but if it's the same issue then it ain't in yet (I recall the
impression it would be regarded as a useful feature [RFE]
rather than a bugfix as such).


In (almost) all cases we now use IPMP with interfaces
marked as standby so only one is active at a time,
although it's not ideal. Trunking (aka Etherchannel)
might be another way around it - this is at MAC layer,
all interfaces in group have same MAC/ipaddr's,
but it has other restrictions (eg. can't group ether+atm,
which you can do with IPMP if you really want to).

Rgds, Stuart.


Stuart Remphrey
RMIT ITS Infrastructure Services - Unix Systems
Phone (03) 992 55 070  (or extension 55070)
>>> <chrisj@ucia.gov> 02/03/07 10:53 PM >>>
...
Solaris does indeed use the multiple interfaces
in a seemingly random way (well, it really isn't
random ... I'm sure there is a very logical approach
but to the occasional telnet, ssh, scp, or NFS
application it appears random :-).

Carson pointed out that it might be a solaris bug
for which a patch already exists.
...



<Prev in Thread] Current Thread [Next in Thread>