IJ15128: REMOVING ALIAS IP LEAVES TCP SOCKETS IN ESTABLISHED STATE

APAR status

• Closed as fixed if next.

Error description

• When an alias IP address was removed from the interface
  layer then TCP sockets in ESTABLISHED state using this
  removed IP as local address survive.
  If the sockets have data in the send buffer then the
  socket
  goes into retransmit state and RTO will kill the socket
  after about 10mins.
  When using PowerHA this can confuse the external ethernet
  switch and lead to port flapping.
  

Local fix

• after removing the alias IP address activate an ipsec
  kernel filter to drop all outgoing packets that use
  this IP as source IP address.
  

Problem summary

• In PowerHA environment, Cisco ACI v2 switch may not learn
  secondary node MAC address, due to retransmission packet
  from primary node.
  

Problem conclusion

• A new network option (ip_ifdelete_no_retrans) has been
  introduce to stop retransmission once ip address is removed.
  In order to activate the fix for this problem two network
  options need to be enabled:
  .
  # no -p -o ip_ifdelete_notify=1
  # no -p -o ip_ifdelete_no_retrans=1
  .
  With the activated fix surviving TCP sessions will be canceled.
  This makes it impossible that packets are sent to the external
  network with the removed IP alias address as source address.
  

Temporary fix

Comments

• This APAR is being closed FIN. This means that a solution to
  this APAR is expected to be delivered from IBM in a release
  (if any) to be available within the next 24 months.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IJ14259

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels