Re: [EXTERNAL] CA gateway chaining

[Timo Korhonen via Core-talk <core-talk at aps.anl.gov>]

Hi,

Just a short follow-up. 
We found out that the delays are due to large arrays being monitored over the gateway. Not a surprise, even if we have tried to remind users about the effects with big arrays. 

We hope to move to PVA gateways as soon as the new version is released (and install some instances for testing before release.)

Thank you all for your feedback, it helped a lot.

Timo

On 2021-10-26, 09:55, "Zimoch Dirk (PSI)" <dirk.zimoch at psi.ch> wrote:

    On Mon, 2021-10-25 at 15:16 +0000, Hartman, Steven via Core-talk wrote:
    > 
    > 
    > > On Oct 25, 2021, at 4:35 AM, Timo Korhonen via Core-talk <core-talk at aps.anl.gov> wrote:
    > > 
    > > We at ESS are using CA gateways in a “chain” configuration, i.e., roughly in the following way:
    > > Machine (aka Technical) network -> gateway A-> internal DMZ -> gateway B-> office network.
    > >  
    > > Does any of you have any experience with such a configuration?
    > 
    > 
    > Hi Timo—
    > 
    > For the SNS beam lines, each beam line has a gateway, and then we have a gateway-of-gateways for office machine
    > clients to connect with . . .
    > 
    > bl1-gateway  }
    > bl2-gateway  }
    > bl3-gateway  }   -> aggregating-gateway -> office network clients
    > . . .                }
    > bln-gateway  }
    > 
    > 
    > There are nearly 30 gateways at the first level on separate private networks. Large arrays can impact performance, but
    > generally it has worked quite well. We do not see a 1 second delay. 
    
    The same for SLS, in fact. When I wrote 
    "Beamline Network -> gateway A -> Machine network -> gateway B -> office network"
    I meant:
    20 beamline networks -> 20 beamline gateways -> machine nework -> office gateway (readonly) -> office network
    No beamline access shows connection delays under normal circumstances. However we had the situation that badly
    implemented CA clients were spamming the BL networks with search requests (basically doing: while true; do caget xxx;
    done). In that case connecting degraded for everyone, including the GW. Checking the broadcast rate as provided by the
    CA gateway shows this problem quickly.
    
    Dirk