The points of potential systems failure when using the ICE Gateway include the ICE Gateway, the exchange host, and all network devices in-between. This chapter’s discussion is restricted to total software and/or hardware failure, its specific impact on ICE Gateways, and available options for disaster recovery.

There are three types of scenarios associated with disaster recovery for a ICE Gateway failure:

• Single ICE Gateway
• Redundant ICE Gateway
• Standby ICE Gateway

Due to limitations from the ICE Host, ICE Gateways Version 7.3 and higher no longer support Order Server failover. If the TT Gateway experiences an Order Server disconnect, the exchange deletes all working non-GTC orders. These orders are greyed out (if all sessions are disconnected) or remain in their last known state in the X_TRADER® order book (any actions on these orders is rejected by the Gateway while the Gateway is disconnected).

When traders log into the alternate ICE Gateway, they will not have access to working orders or previous fills. This information remains on the failed ICE Gateway. Once the Order Server reconnects on the failed gateway, the orders appear as Hold in the X_TRADER® order book and you can use X_TRADER® to resubmit the held orders as new orders to the exchange.

In WebICE (the exchange’s front-end trading screen), the resubmitted orders appear as New while the original orders remain deleted. If necessary, you can log into WebIce with an administrator login and delete working orders for traders.