Active Administrator E-BOOK Windows Server 2008 R2: Top Tips & Tricks Learn best practices for failover clusters, get Active Directory management tips and find out how to master Windows Server 2008 backup basics in this free guide! Windows Server 2008 R2: Networking in Failover Clusters .................. 1 Managing Active Directory Password Policies ...................................... 4 Backup Basics in Windows Server 2008 R2 .......................... 9 SPONSORED BY I got this many AD tasks done today. Active Administrator 6 What about You? Download a FREE copy of Active Administrator at: WWW.SCRIPTLOGIC.COM/AA6 © 2011 ScriptLogic Corporation. All rights reserved. The ScriptLogic logo is a registered trademark of ScriptLogic Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. ACTIVE ADMINISTRATOR E-BOOK BY JOHN MARLIN Windows Server 2008 R2: Networking in Failover Clusters When failure isn’t an option, configuring failover clusters in Windows Server can help ensure high availability. he networking model in E Support for IPv6 nication or iSCSI—not both. Windows Server 2008 and E Support for locating cluster nodes When designing the network Windows Server 2008 R2 on separate, routed subnets infrastructure to connect your cluster T Failover Clustering provides E More fine-grained control over nodes, it’s essential to avoid single more robust and reliable communica- network failure detection points of failure. There are many ways tion among all cluster nodes, which You’ll need to use network hardware you can accomplish this. You can greatly improves the efficiency and marked as “Certified for Windows connect your cluster nodes with dependability of failover clustering. Server 2008.” Any other component of multiple, distinct networks. You could There are also several new features, your failover cluster solution must also also connect your cluster nodes with including: be similarly certified. If you use iSCSI, one network built with teamed E More reliable communication your network adapters need to be network adapters, redundant switches, using TCP and UDP unicast dedicated for either network commu- redundant routers or similar hardware 1 ACTIVE ADMINISTRATOR E-BOOK that remove single points of failure. a UDP broadcast health-checking sequence number. If any of the These architectural requirements mechanism to a UDP unicast commu- heartbeat sequences are dropped or differ from server clusters in Windows nication. It’s similar to a ping in that it not received, it’s considered a “missed” Server 2003, which required two uses a Request-Reply process, but it heartbeat. By default, if any five of distinct networks. includes more sophisticated features these sequences are missed, the node such as security and sequence is considered down or inactive. Cluster Communications numbering. You can change these settings to Windows Server 2008 Failover The default behavior has also increase the delay or threshold, but you Clustering now uses a virtual network changed in terms of how many replies can only work around any network adapter called Microsoft Failover Clus- are needed before the node is problems. If there are any network ter Virtual Adapter to communicate considered unreachable, initiating a latency issues, this could get around it, between nodes in the cluster. You’ll Regroup to obtain a new view of the but it won’t fix the problem. So keep in also see this in Device Manager under cluster membership. The cluster mind that making changes to the delay Network Adapters (select Show heartbeats let all nodes know which is or threshold settings isn’t considered a hidden devices). You’ll also see it when up and down. As a default, the settings troubleshooting technique. issuing the command IPCONFIG / for this are controlled by: The heartbeats, by default, are going ALL. This network adapter handles all E SameSubnetDelay: heartbeat to use IPv6, as it’s a faster protocol packet routing over the proper frequency for nodes in the same than IPv4. If IPv6 has been disabled, networks for communication, joins subnet it will instead use IPv4. A failover and so on. E SameSubnetThreshold: threshold cluster will not mix and match IPv6 This adapter will have an APIPA of the delays for nodes in the same and IPv4. It will use one or the other, address defined in the address block subnet but not both at the same time. 169.254.0.0/16. In IPv6, they’re E CrossSubnetDelay: heartbeat assigned with the fe80::/10 prefix. In frequency for nodes in different Cluster Creation some environments, when adapters subnets When you create a cluster in Windows have an APIPA address, those adapters E CrossSubnetThreshold: threshold of Server 2008 and Windows Server 2008 are disabled. If you disable the Cluster the delays for nodes in different subnets. R2, the cluster-networking driver Virtual Adapter, you’ll disable commu- These settings, and the method for detects and creates the networks nication between the nodes. changing them, are defined on the based on whether a default gateway is The goal is to sustain TCP/IP “Configure Heartbeat and DNS on the adapter. If it detects a default connectivity between two or more Settings in a Multi-Site Failover gateway, that network is set to allow systems, despite the failure of any Cluster” TechNet Library page. clients to connect and use it for cluster component in the network path. So There’s a “heartbeat” sent across with communications. there has to be an alternate physical a sequence number, say from Node1 to This lets cluster IP addresses and path. In other words, a network Node2. Node2 responds with the same client access points (network names) component failure (whether it’s an sequence number. Node1 again sends use the network. It also gives it a NIC, router, switch or hub) shouldn’t the same sequence number to Node2, metric value starting at 10,000. If a cause a communication breakdown. and Node2 returns it one last time. network doesn’t have a default Communication should continue in Node1 would then determine this gateway, it will be given a metric value a timely manner. There might be a heartbeat sequence complete and start starting at 1,000. Then it will only be slower response, but communication the process again with another selected for Cluster Communications. will persist as long as there’s an alternate physical route or link. This NAME METRIC really comes into play when you talk iSCSI Network 1000 about having nodes in separate sites or Backup Network 1100 subnets. Host Access 10000 <<-- has default gateway Another change in Windows Server CSV Network 1200 2008 Failover Clustering is the cluster heartbeat mechanism. While it still Live Migration Network 1300 uses port 3343, it has transitioned from 2 ACTIVE ADMINISTRATOR E-BOOK Each network it detects increases the metric increment by 100. NAME METRIC One thing about the way it works iSCSI Network 1100 now is that there’s no more concept of Backup Network 1000 a “public” and “private” network. Host Access 10000 <<-- has default gateway Therefore, the old “Recommended CSV Network 800 Private ‘Heartbeat’ Configuration on a Live Migration Network 900 Cluster Server” article for Windows Server 2003 clustering is invalid. Cluster communications are still going migrations will go over the network used The CSV cluster network is set for to go through all networks. for backups. When taking a backup of metric 800. Adding any new network In previous versions, you defined the VMs, the Cluster Shared Volumes that doesn’t have a default gateway which network you wanted to use for will go into a redirected mode access. would be higher. Now with properly cluster communications. As long as This is going to interfere with the ISCSI configured metrics, you can take that network was available, the cluster connections and could lead to disk backups or live migrate VMs without would use only that network. Windows failures. A data backup on the local drive any conflicts on the networks. Server 2008 and Windows Server 2008 of Node1 and a Live Migration would The last thing to mention is cluster R2 use all networks. If there’s an issue interfere with each other. validation. You can run some network with one network, it will automatically You need to reconfigure the validation tests to determine connec- switch between networks. networks to get everything you need. tivity issues, network configurations There’s an internal metric the Cluster For the Live Migration network, you and so on. You can run these tests at Network driver uses. It doesn’t use the can change this by bringing up the any time without affecting production. general TCPIP metric value. You can see properties of one of the VMs. On the The cluster validation tests include: the metric values with the following Live Migration tab, change it to the E Cluster Configuration Windows PowerShell command: LM Cluster network. For this, you only E List Cluster Network Information need to do it on a single VM because E Network Get-ClusterNetwork | FT Name, this is a global setting for all VMs. E List Network Binding Order Metric For the CSV network, you can only E Validate Cluster Network affect this change through Windows Configuration The metric values really come into PowerShell. To order the networks E Validate IP Configuration play when talking about having a from Low to High, use the following E Validate Multiple Subnet cluster with highly available virtual commands: Properties machines (VMs) and using Cluster E Validate Network Communication Shared Volumes. Get-ClusterNetwork “CSV Cluster” | You can find the details of the Cluster For example, say you want to run %{$_.Metric=800} Validation tests on the “Understanding this command with these networks Get-ClusterNetwork “LM Cluster” | Cluster Validation Tests” TechNet configured in the chart on page 2.