jad.jabali
In my deployments, I take this philosophy:
I think you need more than two network interfaces for effective command and control, (but we can do this economically on two physical nic's)
one for outward facing services,
one for inward facing services
one for syncing
one for management
and one for layer two for redfone if using it
The outward facing should be off on boot in ifcfg-eth0 , this interface will be controlled by IPaddr2 (not IPaddr for many reasons) in hareresources and another script that will give it a gateway when Primary. This interface will carry all VSP and external extension registrations, your IMAP/POP3/SMTP servers if appropriate, http services like fax and user portal and anything else you need access to (ssh on a port other than 22 for example, but we will argue about that elsewhere). The advantage here is that it exposes just one IP to protect/stroke, firewall, IDS and QOS/TOS wise (it can be either real or natted) Lets call it eth0.
The rest are all on the other interface, first off the Redfone stuff is layer two and needs roughly 2 Mb/s for each of its E1/T1 interfaces, It is important to not "crowd" this traffic with a modern 100mb/s or better a giga switch you probably wont. Lets call this guy eth1.
The rest are virtualized on eth1,
IP phones should be on a VLAN (/dev/eth1.512 by Cisco convention). This is just my preference but allows traffic shaping really quite easily, and most good phones have this built in complete with their own QOS/TOS (not soft-phones on Windows of course, but that is obvious)
The drbd/heartbeat sync processes are pretty low impact while everything is working, but limit the syncer rate to something reasonable like 3M on a 100mb/s network in /etc/drbd.conf (that's MegaBytes, be careful) for when and if drbd needs to do a big resync. you can leave that on eth1 if you want or add another VLAN for that process if you are security paranoid (not a bad thing).
Management, is IMHO yet another VLAN, this is my recommended way to get into both machines from the LAN, but of course you will probably precluded from using windowboxes here, but maybe they learnt how to do VLAN's since I last looked.
None of these interface on eth1 should have a gateway and the cluster itself should not try and forward (route ) IP traffic for security reasons, THIS IS IMPORTANT.
I recommend you let an external router handle the hosts plugged into the back of the phones on the untagged port (or tag it as appropriate and avail youRself of the routers's QOS EFFECTIVELY) which will be just bridged through eth1 for those hosts, but I guess you can see that you also have a perfect "node" here if you wanted to do a one(two) piece, router/firewall appliance type thingy for a smaller client.
So what we have here is system that while working is fully manageable from the inside but looks exactly like one machine from the outside. (there is a caveat as some routers will screw you up if you don't also alias the MAC address with IPaddr2, and the ARP tables get messed up.)
Also don't forget to do another IPaddr2 call in hareresources for the internal voip vlan eth1.512, extensions and services, and for the host machines if using FOP/user portal etc.
Further you need to edit /etc/amportal.conf and replace any references to the symlinks with the real locations if you want the FreePBX backup/restore process to continue to work (not doing so will definitely bite you in the ass sooner or later
).
dicko
p.s. 2 or 4 E1/T1's on a redfone might well stretch your atom machines especially if transcoding , but after doing the standard dimensioning thingy, only experience will show you how that puppy stands up to "real world" situation.
p.p.s
Rafael, I know, but that would make me have to use formatting and such.
, Look at bob and mbit's (and the rest) stuff, I could never make it look that pretty.
Search
2568 users online
.
