Fault Tolerance Scenarios

For iLink, Fault Tolerance is managed at the gateway application level. iLink has a designated host that is primary and another that is designated backup.

Customers must Negotiate and Establish with the designated primary order entry gateway before attempting to Negotiate and Establish with the backup order entry gateway.
- If a session Negotiates or Establishes with the backup gateway before Negotiating or Establishing with the primary gateway, CME Globex will send a https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457227444 or Establishment Reject, with tag 39012-ErrorCodes = 27 - DesignatedBackup - Using Designated backup before designated primary not allowed.
Customers can only trade through primary connections.
Customers can connect to the backup, but can send only https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/716144694 messages. Application messages sent to a backup gateway are rejected.
Disconnecting or Terminating from the primary gateway—either client- or exchange-initiated—will trigger an automatic disconnect or Terminate from the backup gateway as well, except in the Primary gateway failure scenario.
- A https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457327359, with tag 39012-ErrorCodes = 26 - DisconnectOrTerminateFromPrimary: Backup session will be terminated as well will be sent from CME Globex to the customer.
If the primary gateway fails, failover occurs by promoting the backup gateway to assume the primary role.
- During the designated primary instance failure condition, CME Group may keep the designated backup instance as primary gateway.
- Customers who experience log on issues with their primary iLink sessions must rely on the error code (tag 39012) to detect if they are connecting to primary gateway, which could be different than the primary host IP address.
- To re-establish connection successfully, customer must log on to their backup iLink sessions.

Client systems must examine tag 39012-ErrorCodes of the Terminatemessage to successfully reestablish connection to the newly promoted primary.

Scenarios	Given Primary Gateway State	Given Backup Gateway State	When	Then Primary Connection State	Then Backup Connection State	Result

Scenarios	Given Primary Gateway State	Given Backup Gateway State	When	Then Primary Connection State	Then Backup Connection State	Result
Initialization and Binding to Primary Session	Not connected	Not connected	Negotiate/Establish with primary followed by Establish with backup	Negotiated/Established	Established	Client system uses the fault tolerance feature. Client system must send a Negotiate or Establish message to primary gateway first
Initialization and Binding to Primary Session	Not connected	Not connected	Negotiate/Establish with backup		Negotiated/Established	Client system sends a Negotiate or Estalish with backup gateway first. CME Globex send a https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457227444 or Establishment Reject with tag 39012-ErrorCodes = 27 - DesignatedBackup - Using Designated backup before designated primary not allowed.
Primary Session Disconnect	Negotiated/Established	Established	Disconnect from primary	Disconnected	Terminated	Client system is disconnected from primary gateway, the backup connection is terminated as well. All resting orders are cancelled for all Cancel on Disconnect registered iLink sessions. All resting quotes are cancelled on behalf of the Mass Quote customers.
Backup Session Disconnect	Negotiated/Established	Established	Disconnect from backup	Negotiated/Established	Disconnected	A TCP disconnection from backup gateway does not affect primary connection. Resting orders and quotes are not cancelled.
Terminate from Primary Session	Negotiated/Established	Established	Terminate from primary	Terminated	Terminated	Client system is terminated from primary gateway, the backup connection is terminated as well. If the Termination is exchange initiated, all resting orders are cancelled for all Cancel on Disconnect registered gateway sessions. All resting quotes are cancelled on behalf of the Mass Quote customers.
Terminated from Backup Session	Negotiated/Established	Established	Terminate from backup	Negotiated/Established	Terminated	Termination from backup gateway does not affect primary connection. All resting orders and quotes are not cancelled.
Initialization and Binding with Fault Tolerance	Negotiated/Established	Established	Primary MSGW Failure	Disconnected	Backup connection becomes Primary	Newly promoted primary will send a heartbeat. Resting orders are not cancelled. All resting quotes are cancelled on behalf of Mass Quote customers.
Initialization and Binding with Fault Tolerance	Negotiated/Established	Not connected	Primary MSGW Failure	Disconnected	Session must connect and Negotiate/Establish to the new promoted primary.	All resting orders are cancelled for all Cancel on Disconnect registered iLink sessions. All resting quotes are cancelled on behalf of Mass Quote customers.
Initialization and Binding with Fault Tolerance	Negotiated/Established	Established	Backup MSGW Failure	Negotiated/Established	Session must connect and Negotiate/Establish to the restored backup.	The failed backup is restored. All resting orders and quotes are not cancelled.

A TCP disconnection or a FIX logout can be either client-initiated or Exchange-initiated.
A TCP disconnection or a FIX logout does not lead to failover; only gateway failure leads to failover.
When client systems are logged out or disconnected from the primary connection, they will be logged out from the backup connection as well, if applicable. (Does not apply to the Primary gateway failure scenario.)