From the 8.2 User Guide
Configuring Layer-3 Redundancy The Layer-3 redundancy feature will support Active-Standby Model. The Layer-3 redundancy role is driven by user configuration at both the primary and secondary Mobility Master. Once the systems are setup for Layer-3 redundancy, the switchover event will take place when the primary Mobility Master goes down. The secondary Mobility Master will provide the Mobility Master functionality without any user intervention. Layer-3 redundancy determines if the user can make configuration changes and if the sync will be initiated.
Managed devices will have the management tunnel with only one Mobility Master at any given time. The managed device will try to connect to the secondary Mobility Master if it looses connectivity with the primary Mobility Master. The secondary Mobility Master will accept the management tunnel connections from a managed device only if its tunnel with primary Mobility Master is down. This will ensure that the Layer-3 switchover event is processed only if the primary Mobility Master is down and not due to flaky connectivity between the managed device and primary Mobility Master.
Listed below are the salient features of Layer-3 Redundancy:
- Configuration and database events are synced automatically from the primary to secondary Mobility Master.
- Managed devices detect a failure in the primary Mobility Master and automatically switch to the secondary Mobility Master.
- The switchover event in the managed device will have minimal service impact if any.
- Centralized licensing, a single license for both primary and secondary Mobility Masters.
- Layer-2 and Layer-3 redundancy will work together.
- When the primary Mobility Master comes back
Configuration changes cannot be made on the secondary Mobility Master. In a scenario where the primary Mobility Master is down and configuration changes need to be made on the secondary Mobility Master the user must change the sync state of the secondary Mobility Master to the primary Mobility Master. To preserve these configuration changes, a Layer-3 synchronization between the new primary Mobility Master and the old primary Mobility Master should take place. For the synchronization to take place the sync state of the old primary Mobility Master should be changed from primary to secondary state. When the L3 sync state of a Mobility Master is changed from primary to secondary, the Mobility Master reboots to ensure a proper cleanup of the Mobility Master before new configurations/data is pushed from the new primary Mobility Master. Once the roles of Mobility Masters are reversed, the user should ensure the managed devices point to the correct primary Mobility Master and secondary Mobility Master by changing the respective master IP address addresses. The change of master IP and secondary master IP adrdress that takes place on the primary Mobility Master from the managed device node should be done in the same write memory cycle. If this procedure is not done in same write memory cycle, the managed devices may point to the same IP as their primary and secondary Mobility Masters. If this happens reconfiguring the correct secondary masterip when the managed devices are up will fix the issue.