Eurex Gateway Redundancy
TT does not recommend configuring the same exchange credentials on redundant Eurex Gateways.
If you are configuring a redundant, secondary Eurex Gateway to use in the event of a complete hardware failure or Order Server failure on your primary gateway, one alternative is to configure the secondary Eurex Gateway with unique exchange credentials (i.e., NIC IP addresses, Member IDs, sessions IDs, etc.). If you configure the secondary Eurex Gateway with the same exchange credentials and exchange-flavor (e.g., both primary and secondary are Eurex-A), you need to be aware of the impact on Eurex Gateway functionality when switching over to the secondary gateway.
The Eurex Gateway can be set up in a cold standby configuration using the same exchange credentials. This means that you can set up two Eurex Gateways with the same Exchange-Flavor name and IP Address, but only one of the gateways is connected to the network at a time. If the active Eurex Gateway shuts down, you need to take it off the network and add the back up Eurex Gateway to the network. Both of these Eurex Gateways must have identical configurations and trader login IDs.
Eurex Gateways that make use of redundant configurations typically cannot be deployed in a hot failover cluster. If you decide to configure redundant gateways, you can choose from two configuration options. Both options require the customer to have at least two server machines. The two options are:
- Cold Standby
- Backup Flavor
These are not automatic failover solutions. You need to manually start the backup Eurex Gateway after a failure on the primary gateway. If you setup the Backup Flavor configuration, traders need to log in to the backup Eurex Gateway in order to continue trading.
In a cold standby configuration, two Eurex Gateways of the same exchange-flavor are installed on two separate server-class machines. Only one of the two Eurex Gateways is running at any time; the active Eurex Gateway is the primary gateway, and the backup Eurex Gateway is the secondary gateway.
If there is a loss of service on the primary Eurex Gateway, you must manually start the secondary Eurex Gateway. All X_TRADER® clients connected to the primary gateway automatically connect to the secondary gateway when it becomes active.
Configuring Cold Standby Failover
To Configure Cold Standby Redundancy
- Configure the TTChron service
or file (ttchron.ini)
on the secondary gateway in one of the following ways:
- Set the TTChron service to start manually.
- If you want TTChron to start automatically, then comment out all services in ttchron.ini other than the Guard Server and, optionally, the Price Server.
- If you do not want to edit the ttchron.ini file at start up, you can configure two TTChron files on the secondary gateway: One is the default ttchron.ini included in the install, and a second one you need to create that just contains the Guard Server and, optionally, the Price Server. If the primary gateway fails, you can swap out the default ttchron.ini for the Guardian Server-only ttchron.ini.
- Start and run the Guard Server on the secondary Eurex Gateway at all times to ensure that the secondary gateway always has the most up to date risk limits and license information.
- Optionally, configure the Price Server on the secondary Eurex Gateway to run on its normal schedule. The secondary Price Server will be in Standby mode (half yellow, half green in Guardian) until the primary Eurex Gateway fails, at which point it will become Active and all X_TRADER® clients will automatically switch over to it. If you choose to configure Price Server failover, the Price Server must be configured with a different Market Data ID than the primary Price Server.
- Configure identical Hostinfo.cfg files on the primary and secondary Eurex Gateways (i.e., order sessions and NIC IP Addresses).
- Set up user IDs to log in to both servers using Windows User Authentication, TT Login Server, or TT User Setup. Risk limits need to be set up for a single exchange-flavor only, but are used on both gateways.
Gateway Behavior: Cold Standby
In the event of a shutdown or loss of service on the primary Eurex Gateway, the following occurs when connecting to the cold standby (secondary) gateway:
- Manually start the server machine with the secondary Eurex Gateway.
- You must manually start the servers on the secondary gateway
in one of the following ways depending on how the gateway is configured:
- Start the TTChron service, which in turn starts the Order, Price, and Fill Servers.
- If you commented-out all services in ttchron.ini, uncomment the order, price and fill server sections in this file and restart the TTChron service.
- If you configured two ttchron.ini files on the secondary Eurex Gateway, swap out the default Eurex Gateway ttchron.ini for the Guardian Server-only ttchron.ini and restart the TTChron service.
- When the servers are active, all X_TRADER® clients that had been connected to the primary Eurex Gateway automatically connect to the secondary Eurex Gateway.
- Traders’ risk limits are still in effect and remain unchanged on the secondary gateway.
In a Backup Flavor configuration, two Eurex Gateways of different exchange-flavors (e.g., Eurex-A and Eurex-B) are installed on two separate server machines. Both Eurex Gateways are in the Active state. If there is a service failure on Eurex-A, for example, traders can log in to Eurex-B and continue trading.
Optionally, both Eurex-A and Eurex-B can be primary Eurex Gateways for some or all traders. When both Eurex Gateways are used simultaneously, you can load balance trading activity between the two gateways.
Configuring Backup Flavor
To Configure Backup Flavor Redundancy
- Configure trader IDs in one of
the following ways:
- Configure trader IDs through TT User Setup so that traders are always logged in to both gateways at all times.
- A second option is to give traders login permissions to both Eurex-A and Eurex-B at all times.
- A third option is to give traders login permissions to Eurex-A only. If Eurex-A fails, you have to manually give the trader permission to log in to Eurex-B. The trader can then manually log in to Eurex-B and continue trading. With this option, you have full control over which gateways the trader can log in to, and can control load balancing between gateways.
- Ensure both gateways run using the default TTChron configuration.
- Ensure that you have configured different session IDs in Hostinfo.cfg on Eurex-A and Eurex-B. In other words, ensure that traders will use different sessions on both gateways.
Gateway Behavior: Backup Flavor
In the event of a loss of service or hardware failure on one of the exchange-flavor Eurex Gateways (e.g., Eurex-A), the following occurs depending on how you configured the redundant gateway.
- Traders connected to Eurex-A need to do the
following based on how you configured their user IDs:
- If you set up traders to be logged in to both gateways at all times, these traders just have to open the necessary X_TRADER® windows for their products on Eurex-B and continue trading.
- If you set up traders to have login permissions for both gateways, then these traders manually login to Eurex-B through Guardian when Eurex-A fails, then open the necessary X_TRADER® windows for their products on Eurex-B and continue trading.
- If you have only given traders login permissions to Eurex-A, you now have to manually give these traders permission to login to Eurex-B. Then, these traders manually login to Eurex-B and continue trading.
- Orders entered through Eurex-A may still be working at the exchange after the exchange failure. If these orders are filled after the traders connect to Eurex-B using X_TRADER®, traders will not receive the fills. Inform your traders to contact the exchange to check if they have any orders still working at the exchange.
Impact on GTC, GTD, and GTDate Orders
In the event of a failover to a redundant backup exchange-flavor Eurex Gateway (e.g., Eurex-A to Eurex-B); GTC, GTD, and GTDate orders submitted via ETI on the new trading architecture are impacted as follows:
- GTC and GTDate orders on LF sessions remain working at the exchange regardless if order persistence is set in TT User Setup for the user submitting the orders. The gateway sends these orders as persistent by default. GTC and GTDate orders cannot be submitted via HF sessions.
- GTD orders sent via HF and HF Light sessions are not persisted and are deleted by the exchange as soon as connectivity is lost to Eurex-A.
- GTC, GTD, and GTDate orders may have been filled while switching over to the redundant backup gateway (Eurex-B). If so, traders will not see the fills for these orders after logging in to Eurex-B and should contact the exchange for the missing fills.
To continue trading during on a Backup Flavor gateway, a trader can log in to the backup Eurex Gateway via Guardian or X_TRADER®. Traders on X_TRADER® 7.9.0 or higher will have to log in using their universal login defined in TT User Setup; the Trader Login option is not available in Guardian for these X_TRADER® versions.
After logging in to the backup exchange-flavor Eurex Gateway (e.g. Eurex-B), X_TRADER® converts the workspace to the different exchange-flavor automatically. Traders do not need to recreate grids or Autospreaders, etc., after they log in to the backup gateway.
Exchange conversion is a common built-in feature of X_TRADER® when opening workspaces, etc. For example, if a trader has a price window (e.g., Market Grid, MD Trader, Spread Matrix, Quote Board, etc.) in a workspace with contracts from Eurex-A but now has have to log in to Eurex-B because Eurex-A is shutdown, then X_TRADER® automatically converts those Exchange IDs and all X_TRADER® windows open without any issues.