Warm Standby Redundancy

To provide redundancy, the network operator can maintain a secondary Skylight orchestrator system that is ready to take charge if the primary Skylight orchestrator system fails.

Skylight orchestrator supports two redundancy methods:

• Warm Standby Redundancy (covered in this section). In a warm standby setup, data is mirrored to the secondary system at regular intervals. Failover is initiated manually.
• Hot Standby Redundancy. In a hot standby setup, data is replicated on the standby system continuously. Failover is triggered automatically. See Hot Standby Redundancy.

Introduction

This article explains how the Skylight orchestrator Warm Standby Redundancy feature works and covers the requirements and limitations of the feature.

Initial Setup

The initial setup for Warm Standby Redundancy is the following:

• The primary appliance normally manages Skylight devices. It periodically sends a backup of its data store to the secondary appliance.
• The secondary appliance is in standby mode, ready to replace the primary appliance in case of failure.

The following figure shows the initial setup for warm standby.

Manual Failover

For warm standby, failing over to the standby appliance requires human intervention. The failover scenario for warm standby is the following:

• If the primary appliance fails, the operator manually activates the secondary appliance with the latest configuration from the primary.
• When the failure on the primary appliance has been corrected, the operator can fall back to the primary appliance. After the fallback procedure, the primary appliance is back in charge of managing Skylight devices.

The following figure shows the failover scenario for warm standby. Failover is the secondary appliance.

Recommendations

For a warm standby setup, we recommend:

• Increasing the number of allowed CLI sessions on Skylight devices to the maximum value of 5. This ensures the fastest possible switchover and avoids the need to wait for network element CLI session to time out if the primary server fails.

This change can be done on all Skylight devices using a configuration job or a configuration flow. For more information about configuration jobs and flows, see Commissioning.

Limitations

The limitations of a warm standby setup are the following:

• Failover requires manual intervention.
• The last backup of the primary server that is present on the secondary appliance is at least 30 minutes old. Any changes to the configuration of the primary appliance during the last 30 minute period may be lost if a failure occurs.
• If the primary appliance remains unrecoverable, some performance monitoring data may be lost in the un-transmitted CSV files that contain the data.