Re: CA gateway and CA beacons

[Dirk Zimoch <dirk.zimoch@psi.ch>]

Hi Carl,

The purpose of the beacons is to signal than a CA server (an IOC) is still 
alive. A burst of beacons shows that the server has just become alive. CA 
clients (e.g. medm) use this signal to restart the search for unconnected 
channels. A system may work fine without beacons as far as no IOC reboots. The 
symptom of missing beacons is usually that medm or other clients do not 
reconnect when an IOC comes back after being offline for more than about 10 minutes.

The major difference between search broadcasts and beacon broadcasts is that the 
beacons are sent by the server and the searches by the client. That means you 
should see the beacons on the network where your medm runs, not where your IOC 
runs. Try the epics extension casw to see beacons: casw -i 2

We use the gateway at several places. First we connect each beamline to the 
accelerator network with a pair of gateways (2 processes running on the same 
machine for traffic in either direction. Take care to avoid loops (see below)). 
Additionally, we connect the office networks to the machine with a read-only 
gateway. We have more than one office network. In order to forward the beacons 
to all potential clients, we have to list all office networks in 
EPICS_CAS_BEACON_ADDR_LIST of the gateway. Note that this only works if your 
network allows directed broadcasts. Some switches block them. Ask your network 
administrator.

Avoiding loops
When running bi-directional gateways, you must make sure that channels imported 
by one gateway are not re-exported by the other one. The easiest way is to block 
the gateway from accessing itself completely. Unfortunately this also blocks the 
statistics channels. If you want to have all gateway statistics in one network 
(e.g. where the archiver runs) and still want to avoid loops, you can use 
inverted regular expressions. I have added that feature to the latest gateway 
version.

Our setup looks like this:
Beamline export gateway
Replace <beamlineprefix> with an appropriate string. This gateway exports all 
beamline channels to the machine with full write access.

# allow 1024 threads (2GB / 2048kB = 1024)
ulimit -s 2048
export EPICS_CA_MAX_ARRAY_BYTES=4000000
export EPICS_CAS_BEACON_ADDR_LIST=<broadcast in machine network>
gateway -no_cache -archive -prefix <beamlineprefix>-EXPGW \
    -sip <ip in machine network>\
    -cip <broadcast in beamline network>\
    -pvlist GATEWAY.pvlist \
    -access GATEWAY.access \
    -log gateway.log

GATEWAY.access:
ASG(DEFAULT)
{
  RULE(1,WRITE)
}
ASG(READONLY)
{
  RULE(1,READ)
}

GATEWAY.pvlist:
EVALUATION ORDER ALLOW, DENY
<beamlineprefix>.*                     ALLOW
<all the readonly channels>            ALLOW READONLY
!<beamlineprefix>-EXPGW.*              DENY FROM <ip in machine network>

The last line prevents the loop because it blocks the reverse gateway (running 
on the same machine) from accessing any channel but the gateway statistics.

Simimilar for the beamline import gateway.

ulimit -s 2048
export EPICS_CA_MAX_ARRAY_BYTES=4000000
export EPICS_CAS_BEACON_ADDR_LIST=<broadcast in beamline network>
gateway -no_cache -archive -prefix <beamlineprefix>-IMPGW \
    -sip <ip in beamline network>\
    -cip <broadcast in machine network>\
    -pvlist GATEWAY.pvlist \
    -access GATEWAY.access \
    -log gateway.log

GATEWAY.access:
ASG(DEFAULT)
{
  RULE(1,READ)
}
ASG(WRITE)
{
  RULE(1,WRITE)
}

GATEWAY.pvlist:
EVALUATION ORDER ALLOW, DENY
!<beamlineprefix>.*		ALLOW
<channels with write access>    ALLOW WRITE
!<beamlineprefix>-IMPGW.*       DENY FROM <ip in beamline network>


Run each gateway in a separate direcory.

I hope this helps.
Dirk



Carl Schumann wrote:
> Carl Schumann wrote:
> > Hi,
> >
> > I am trying to get a CA gateway functioning so that we can have CA 
> > connectivity between two subnets.   So far no luck.   I am trying to 
> > understand the server beacons role.   When I startup the virtual linac 
> > demo's IOC I don't see the broadcast beacon with tcpdump looking for 
> > anything on port 5064/5065.   When I run caget for the cathodeTempM PV 
> > I do see the search broadcast on 5064.   Any explanations for why I do 
> > see the broadcast search but not the broadcast beacon?   I have not 
> > attempted to do anything to changes the standard ports used.
> >
> > Thanks,
> > Carl Schumann
> I should have added:  For the above scenario I simplified things as an 
> experiment.  caget, tcpdump, and the IOC are being run on machines on 
> the same subnet.
> Sorry for two emails.

--
Dr. Dirk Zimoch
Paul Scherrer Institut, WBGB/006
5232 Villigen PSI, Switzerland
Phone +41 56 310 5182