NYSE Liffe Gateway Cold Failover
TT does not recommend configuring the same exchange credentials on redundant TT Gateways.
If you are configuring a redundant, secondary TT Gateway to use in the event of a complete hardware failure or Order Server failure on your primary gateway, one alternative is to configure the secondary TT Gateway with unique exchange credentials (i.e., NIC IP addresses, Member IDs, sessions IDs, etc.). If you configure the secondary TT Gateway with the same exchange credentials and exchange-flavor (e.g., both primary and secondary are TT Gateway-A), you need to be aware of the impact on TT Gateway functionality when switching over to the secondary gateway.
The TT Gateway can be set up in a cold standby configuration using the same exchange credentials. This means that you can set up two TT Gateways with the same Exchange-Flavor name and IP Address, but only one of the gateways is connected to the network at a time. If the active TT Gateway shuts down, you need to take it off the network and add the back up TT Gateway to the network. Both of these TT Gateways must have identical configurations and trader login IDs.
Cold Failover Configurations
TT Gateways that make use of redundant configurations typically cannot be deployed in a hot failover cluster. If you decide to configure redundant gateways, you can choose from two configuration options. Both options require the customer to have at least two server machines. The two options are:
- Cold Standby
- Backup Flavor
These are not automatic failover solutions. You need to manually start the backup TT Gateway after a failure on the primary gateway. If you setup the Backup Flavor configuration, traders need to log in to the backup TT Gateway in order to continue trading.
Cold Standby Failover
In a cold standby configuration, two TT Gateways of the same exchange-flavor are installed on two separate server-class machines. Only one of the two TT Gateways is running at any time; the active TT Gateway is the primary gateway, and the backup TT Gateway is the secondary gateway.
If there is a loss of service on the primary TT Gateway, you must manually start the secondary TT Gateway. All X_TRADER® clients connected to the primary gateway automatically connect to the secondary gateway when it becomes active.
Configuring Cold Standby Failover
To Configure Cold Standby Redundancy
- Configure the TTChron service
or file (ttchron.ini)
on the secondary gateway in one of the following ways:
- Set the TTChron service to start manually.
- If you want TTChron to start automatically, then comment out all services in ttchron.ini other than the Guard Server and, optionally, the Price Server.
- If you do not want to edit the ttchron.ini file at start up, you can configure two TTChron files on the secondary gateway: One is the default ttchron.ini included in the install, and a second one you need to create that just contains the Guard Server and, optionally, the Price Server. If the primary gateway fails, you can swap out the default ttchron.ini for the Guardian Server-only ttchron.ini.
- Start and run the Guard Server on the secondary TT Gateway at all times to ensure that the secondary gateway always has the most up to date risk limits and license information.
- Optionally, configure the Price Server on the secondary TT Gateway to run on its normal schedule. The secondary Price Server will be in Standby mode (half yellow, half green in Guardian) until the primary TT Gateway fails, at which point it will become Active and all X_TRADER® clients will automatically switch over to it. If you choose to configure Price Server failover, the Price Server must be configured with a different Market Data ID than the primary Price Server.
- Configure identical Hostinfo.cfg files on the primary and secondary TT Gateways (i.e., order sessions and NIC IP Addresses).
- Set up user IDs to log in to both servers using Windows User Authentication, TT Login Server, or TT User Setup. Risk limits need to be set up for a single exchange-flavor only, but are used on both gateways.
TT Gateway Behavior during Cold Standby Failover
In the event of a shutdown or loss of service on the primary TT Gateway, the following occurs when connecting to the cold standby (secondary) gateway:
- Manually start the server machine with the secondary TT Gateway.
- You must manually start the servers on the secondary gateway
in one of the following ways depending on how the gateway is configured:
- Start the TTChron service, which in turn starts the Order, Price, and Fill Servers.
- If you commented-out all services in ttchron.ini, uncomment the order, price and fill server sections in this file and restart the TTChron service.
- If you configured two ttchron.ini files on the secondary TT Gateway, swap out the default TT Gateway ttchron.ini for the Guardian Server-only ttchron.ini and restart the TTChron service.
- When the servers are active, all X_TRADER® clients that had been connected to the primary TT Gateway automatically connect to the secondary TT Gateway.
- All working orders will be downloaded as incomplete or unknown orders. All fills that have been received will be double-counted and considered incomplete or unknown.
- Traders’ risk limits are still in effect and remain unchanged on the secondary gateway.
Backup Flavor Failover
In a Backup Flavor configuration, two TT Gateways of different exchange-flavors (e.g., Liffe-A and Liffe-B) are installed on two separate server machines. Both TT Gateways are in the Active state. If there is a service failure on Liffe-A, for example, traders can log in to Liffe-B and continue trading.
Optionally, both Liffe-A and Liffe-B can be primary TT Gateways for some or all traders. When both TT Gateways are used simultaneously, you can load balance trading activity between the two gateways.
Configuring Backup Flavor Failover
To Configure Backup Flavor Redundancy
- Configure trader IDs in one of
the following ways:
- Configure trader IDs through TT User Setup so that traders are always logged in to both gateways at all times.
- A second option is to give traders login permissions to both Liffe-A and Liffe-B at all times.
- A third option is to give traders login permissions to Liffe-A only. If Liffe-A fails, you have to manually give the trader permission to log in to Liffe-B. The trader can then manually log in to Liffe-B and continue trading. With this option, you have full control over which gateways the trader can log in to, and can control load balancing between gateways.
- Ensure both gateways run using the default TTChron configuration.
- Ensure that you have configured different session IDs in Hostinfo.cfg on Liffe-A and Liffe-B. In other words, ensure that traders will use different sessions on both gateways.
TT Gateway Behavior during Backup Flavor Failover
In the event of a loss of service or hardware failure on one of the exchange-flavor TT Gateways (e.g., Liffe-A), the following occurs depending on how you configured the redundant gateway.
- Traders connected to Liffe-A need to do the
following based on how you configured their user IDs:
- If you set up traders to be logged in to both gateways at all times, these traders just have to open the necessary X_TRADER® windows for their products on Liffe-B and continue trading.
- If you set up traders to have login permissions for both gateways, then these traders manually login to Liffe-B through Guardian when Liffe-A fails, then open the necessary X_TRADER® windows for their products on Liffe-B and continue trading.
- If you have only given traders login permissions to Liffe-A, you now have to manually give these traders permission to login to Liffe-B. Then, these traders manually login to Liffe-B and continue trading.
- Orders entered through Liffe-A may still be working at the exchange after the exchange failure. If these orders are filled after the traders connect to Liffe-B using X_TRADER®, traders will not receive the fills. Inform your traders to contact the exchange to check if they have any orders still working at the exchange.