IBM Support

ICMP Port unreachable sent when Load Balancer high availability packet received

Troubleshooting


Problem

"ICMP port unreachable" packets occur in the IBM WebSphere Edge Load Balancer for IPv6 and IPv4. The "ICMP port unreachable" packet does not cause any problems to the users but appear problematic to a network analyst or software.

Cause

High Availability (HA) is maintained by using the actual IP addresses of the Load Balancer machines (not cluster addresses). Both the Load Balancer for IPv4 and IPv6 and the operating system receive notification of traffic received on the actual IP addresses. The Load Balancer receives traffic directly off the interface, processes the packet, and responds back to the partner Load Balancer. The operating system is unaware of the load balancer actions on the packet and attempt to process the packet. The operating system does not find an application listening on the HA port.  An ICMP error (Destination Port unreachable) is sent back in response to the packet (to the partner Load Balancer).

Resolving The Problem

This traffic can be ignored and causes no side-effects. If you would like to eliminate the error, you can use iptables (for Linux™ operating system) or similar firewall features for other operating systems. This filtering needs to be made on both Load Balancer machines.

The iptables syntax for use with Linux™ is:


# iptables -t filter -A INPUT -p udp --destination-port <port> -j DROP
The <port> is the port number for the heartbeat.

[{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Edge Component","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"9.0;8.5.5;8.5;8.0;7.0;6.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
07 February 2020

UID

swg21269065