PBX — High Availability (HA) Setup and Failover

Overview

The SipLive PBX supports active/passive high availability with two nodes (ha1 and ha2). If the primary node fails, the secondary takes over the service IP within seconds, maintaining uninterrupted phone service.

Architecture

• Active node (ha1) — Handles all calls and web traffic.
• Passive node (ha2) — Stays in standby, continuously synchronized.
• Service VIP — A virtual IP that floats between nodes. SIP clients and carriers always use this IP.
• Database replication — MariaDB is replicated between nodes; PJSIP config is always current on both.
• Filesystem sync — Voicemail, recordings, and config files replicated via DRBD or rsync.

Failover Process

1. Cluster monitoring (Corosync/Pacemaker or keepalived) detects ha1 is unreachable.
2. ha2 promotes itself to active.
3. The service VIP is brought up on ha2's NIC.
4. Asterisk starts on ha2.
5. SIP carriers detect the change via OPTIONS polling or re-registration and resume sending calls.

Note: Active calls at the moment of failover are dropped — this is expected in active/passive HA.

Health Checks

Monitor HA health in System → HA Status:

• Sync status — Both nodes should show "in-sync".
• Active node — Confirms which node holds the VIP.
• Replication lag — Should be near zero. Lag > 5 seconds indicates a network or I/O issue.

Planned Switchover

1. Confirm ha2 is fully in-sync.
2. Run crm resource move pbx-vip ha2 or equivalent keepalived command.
3. Verify VIP is live on ha2: ip addr show.
4. After maintenance, move VIP back to ha1 and verify sync resumes.

Testing HA (Quarterly)

1. Place a test call on ha1 to confirm service.
2. Simulate ha1 failure: systemctl stop corosync.
3. Confirm ha2 takes over within 30 seconds.
4. Restore ha1 and verify it rejoins as passive without disrupting active calls.