14. IBM Cloud: VMware as a Service（VMWaaS) - 検証: VIP切り替えによる高可用性構成の確認（手動切替）

# 1. はじめに
一般的には、高可用性構成を実現するために、VIPを使った切り替えを利用しているアプリケーションは今でも非常に多いと思われます。今回は、`192.168.100.100/24`というVIPを`WEB01(192.168.100.3/24)`/`WEB02(192.168.100.4/24)`というVM間で付け替えることで、`WEB01`障害時にVDC内部からもVDC外部からもVIPが構成されているVMにアクセスできることを確認したいと思います。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/cda4b50e-e91f-19a8-682f-75176fe9cb00.png)


過去の記事はこちら。

- [01. IBM Cloud: VMware as a Service（VMWaaS)の概要](https://qiita.com/testnin2/items/d39ba856f70fc14ea719) 
- [02. IBM Cloud: VMware as a Service（VMWaaS) - VDCの注文](https://qiita.com/testnin2/items/a3630d5a532a6ce48720)
- [03. IBM Cloud: VMware as a Service（VMWaaS) - VDCの追加注文](https://qiita.com/testnin2/items/666a8a03db85f983f56a) 
- [04. IBM Cloud: VMware as a Service（VMWaaS) - 外部接続のためのネットワークとNAT/Firewallを構成する](https://qiita.com/testnin2/items/3575b27c2ec2b6242ee6) 
- [05. IBM Cloud: VMware as a Service（VMWaaS) - RHELをプロビジョニングして疎通確認を行う](https://qiita.com/testnin2/items/56901ef332ee060fcf2f) 
- [06. IBM Cloud: VMware as a Service（VMWaaS) - 検証: IBM Cloud private networkへの通信におけるSNATの必要性](https://qiita.com/testnin2/items/5add312256d1e264e31f)
- [07. IBM Cloud: VMware as a Service（VMWaaS) - 検証: isolated networkとの通信](https://qiita.com/testnin2/items/9bc1b57b9636071b7239)
- [08. IBM Cloud: VMware as a Service（VMWaaS) - 検証: routed network間の通信](https://qiita.com/testnin2/items/fa9426df262368ddc2ef) 
- [09. IBM Cloud: VMware as a Service（VMWaaS) - Data Center Groupの構成](https://qiita.com/testnin2/items/f940550d7564db526531) 
- [10. IBM Cloud: VMware as a Service（VMWaaS) - Distributed Firewallの構成](https://qiita.com/testnin2/items/26dd06d28effbd83ff9e) 
- [11. IBM Cloud: VMware as a Service（VMWaaS) - VDC間のVM/vApp Migration](https://qiita.com/testnin2/items/381c5e6db4fdd7ed64d6)
- [12. IBM Cloud: VMware as a Service（VMWaaS) - VMWaaS APIの実行例](https://qiita.com/testnin2/items/3e0e86a25bfd06a165bf)
- [13. IBM Cloud: VMware as a Service（VMWaaS) - VMware Cloud Director OpenAPIの実行例](https://qiita.com/testnin2/items/420e55a06255d626a471) 
- [14. IBM Cloud: VMware as a Service（VMWaaS) - 検証: VIP切り替えによる高可用性構成の確認（手動切替）](https://qiita.com/testnin2/items/fead2339a999242ecae9) 
- [15. IBM Cloud: VMware as a Service（VMWaaS) - 検証: VIP切り替えによる高可用性構成の確認（keepalived）](https://qiita.com/testnin2/items/2a5c9660ccfab74faa49) 
- [16. IBM Cloud: VMware as a Service（VMWaaS) - Transit Gateway接続](https://qiita.com/testnin2/items/1ec6223b6713eb58e156) 
- [17. IBM Cloud: VMware as a Service（VMWaaS) - Veeam Backup and Replication service連携](https://qiita.com/testnin2/items/69fd29db9f8cc313e353) 


# 2. NW構成

- WEB01/WEB02にそれぞれ`192.168.100.3`/`192.168.100.4`を割り当てます。なお、WEB01/WEB02にはHTTPサーバーが構成されており、適切なFirewall制御がされているとします（この構成手順を書くのは本稿の本来の目的とズレるため省略）。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/690fea36-d600-d2e6-8782-1be1ee193afc.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/ab4860a2-ce46-f833-7461-bf3c25c91b94.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/91d35a59-a799-708a-bc8f-cfb8cd8a3908.png)

- Firewall構成。VDC外部からHTTP/HTTPSを許可します。VDC内部の通信はDistributed Routingが有効になっており、DFWを構成していないため、任意の通信が許可されています。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/fea55a5e-c16c-b278-d926-7efe7e90e802.png)

- NAT構成。VDC外部から`150.xxx.xx.xx``192.168.100.100`へのDNAT構成を追加します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/48859616-e3e7-01e2-09a6-d97badddf9b3.png)


# 3. VIPが割り振られていない状態でのアクセス検証

```
[root@jumpserver ~]# curl http://192.168.100.3
This is web01

[root@jumpserver ~]# curl http://192.168.100.4
This is web02

[root@jumpserver ~]# curl http://192.168.100.100
curl: (7) Failed to connect to 192.168.100.100 port 80: No route to host

syasuda@MacBook-Pro ~ % curl http://150.xxx.xx.xx
（応答なし）
```

:::note warn
pingで疎通が確認でき、Web Serverが起動しているにも関わらず、curl実行時に`No route to host`というエラーが出る場合は、OS firewallがフィルタリングしていないかどうかを疑ってみてください。

```
[root@jumpserver ~]# ping 192.168.100.3
PING 192.168.100.3 (192.168.100.3) 56(84) bytes of data.
64 bytes from 192.168.100.3: icmp_seq=1 ttl=64 time=0.334 ms
64 bytes from 192.168.100.3: icmp_seq=2 ttl=64 time=0.297 ms
64 bytes from 192.168.100.3: icmp_seq=3 ttl=64 time=0.309 ms
64 bytes from 192.168.100.3: icmp_seq=4 ttl=64 time=0.283 ms
^C
--- 192.168.100.3 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3089ms
rtt min/avg/max/mdev = 0.283/0.305/0.334/0.018 ms

[root@jumpserver ~]# curl http://192.168.100.3
curl: (7) Failed to connect to 192.168.100.3 port 80: No route to host
```
:::


# 4. WEB01にVIPを割り振った状態でのアクセス検証

```
[root@web01 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:14:01:b8 brd ff:ff:ff:ff:ff:ff
    altname enp11s0
    inet 192.168.100.3/24 brd 192.168.100.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe14:1b8/64 scope link
       valid_lft forever preferred_lft forever

[root@web01 ~]# ip a add 192.168.100.100/24 dev ens192

[root@web01 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:14:01:b8 brd ff:ff:ff:ff:ff:ff
    altname enp11s0
    inet 192.168.100.3/24 brd 192.168.100.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet 192.168.100.100/24 scope global secondary ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe14:1b8/64 scope link
       valid_lft forever preferred_lft forever
```

```
[root@jumpserver ~]# curl http://192.168.100.3
This is web01

[root@jumpserver ~]# curl http://192.168.100.4
This is web02

[root@web01 ~]# curl http://192.168.100.100
This is web01

syasuda@MacBook-Pro ~ % curl http://150.xxx.xx.xx
This is web01
```


# 5. WEB02にVIPを割り振った状態でのアクセス検証

WEB01の電源を強制停止（WEB01に障害が発生したという想定）。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/dc42b24e-8790-0399-8e6b-d513e9cc1e08.png)


```
[root@web02 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:14:01:ba brd ff:ff:ff:ff:ff:ff
    altname enp11s0
    inet 192.168.100.4/24 brd 192.168.100.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe14:1ba/64 scope link
       valid_lft forever preferred_lft forever
       
[root@web02 ~]# ip a add 192.168.100.100/24 dev ens192

[root@web02 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:14:01:ba brd ff:ff:ff:ff:ff:ff
    altname enp11s0
    inet 192.168.100.4/24 brd 192.168.100.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet 192.168.100.100/24 scope global secondary ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe14:1ba/64 scope link
       valid_lft forever preferred_lft forever
```

```
[root@jumpserver ~]# curl http://192.168.100.3
curl: (7) Failed to connect to 192.168.100.3 port 80: No route to host

[root@jumpserver ~]# curl http://192.168.100.4
This is web02

[root@web01 ~]# curl http://192.168.100.100
This is web02

syasuda@MacBook-Pro ~ % curl http://150.xxx.xx.xx
This is web02
```