Cisco NAC3350-PROF-K9 Hardware Installation Guide - Page 138

CAS High Availability Overview

Get Cisco NAC3350-PROF-K9 - NAC Profiler Server PDF manuals and user guides View all Cisco NAC3350-PROF-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 138 highlights

Installing a Clean Access Server High Availability Pair Chapter 4 Configuring High Availability (HA) Note You must use identical appliances (e.g. NAC-3350 and NAC-3350 or NAC-3315 and NAC-3315) in order to configure High Availability (HA) pairs of Clean Access Managers (CAMs) or Clean Access Servers (CASs). CAS High Availability Overview Caution CAM-CAS communication and HA-CAM and/or HA-CAS peer communication can break down and adversely affect network functionality when SSL certificates expire. Refer to the caveat CSCtb43264 in Release Notes for Cisco NAC Appliance, Version 4.8. For more information, see the "HA Active-Active Situation Due to Expired SSL Certificates" section of the Cisco NAC Appliance - Clean Access Server Configuration Guide, Release 4.8(3). Note Cisco NAC network modules installed in Cisco Integrated Services Routers (ISRs) do not support high availability. The following key points provide a high-level overview of HA-CAS operation: • The Clean Access Server high-availability mode is an Active/Passive two-server configuration in which a standby CAS machine acts as a backup to an active CAS machine. • The active CAS performs all tasks for the system. Since most of the CAS configuration is stored on the CAM, when CAS failover occurs, the CAM pushes the configuration to the newly-active CAS. Note If you use the Authorization feature in a CAS HA-pair, follow the guidelines in "Backing Up and Restoring CAM/CAS Authorization Settings" in the Cisco NAC Appliance - Clean Access Manager Configuration Guide, Release 4.8 to ensure you are able to exactly duplicate your Authorization settings from one CAS to its high availability counterpart. • Clean Access Managers and Clean Access Servers use a local master secret password to encrypt and protect important data, like other system passwords. The master secret password needs to be the same for a CAM-HA pair. Cisco recommends keeping very accurate records of assigned master secret passwords to ensure that you are able to fail over to the HA peer CAM/CAS in HA deployments. (HA-Secondary CAMs/CASs are not able to assume the "active" role following a failover event when the master secret passwords are different.) • The standby CAS does not forward any packets between its interfaces. • The standby CAS monitors the health of the active CAS via heartbeat interface (serial and one or more UDP interfaces). Heartbeat packets can be sent on the dedicated eth2 interface, dedicated eth3 interface, or eth0/eth1 interface (if no eth2 or eth3 interface is available). • The primary and secondary CAS machines exchange UDP heartbeat packets every 2 seconds. If the heartbeat timer expires, stateful failover occurs. • In addition to heartbeat-based failover, the CAS also provides link-based failover based on eth0 or eth1 link failure. The CAS sends ICMP ping packets to an external IP address via the eth0 and/or eth1 interface. Failover will occur if only one CAS can ping the external addresses. 4-18 Cisco NAC Appliance Hardware Installation Guide OL-20326-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
4-18
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 4
Configuring High Availability (HA)
Installing a Clean Access Server High Availability Pair
Note
You must use identical appliances (e.g. NAC-3350 and NAC-3350 or NAC-3315 and NAC-3315) in
order to configure High Availability (HA) pairs of Clean Access Managers (CAMs) or Clean Access
Servers (CASs).
CAS High Availability Overview
Caution
CAM-CAS communication and HA-CAM and/or HA-CAS peer communication can break down and
adversely affect network functionality when SSL certificates expire. Refer to the caveat CSCtb43264 in
Release Notes for Cisco NAC Appliance, Version 4.8
.
For more information, see the “HA Active-Active Situation Due to Expired SSL Certificates” section of
the
Cisco NAC Appliance - Clean Access Server Configuration Guide, Release 4.8(3)
.
Note
Cisco NAC network modules installed in Cisco Integrated Services Routers (ISRs) do not support high
availability.
The following key points provide a high-level overview of HA-CAS operation:
•
The Clean Access Server high-availability mode is an Active/Passive two-server configuration in
which a standby CAS machine acts as a backup to an active CAS machine.
•
The active CAS performs all tasks for the system. Since most of the CAS configuration is stored on
the CAM, when CAS failover occurs, the CAM pushes the configuration to the newly-active CAS.
Note
If you use the Authorization feature in a CAS HA-pair, follow the guidelines in “Backing
Up and Restoring CAM/CAS Authorization Settings” in the
Cisco NAC Appliance - Clean
Access Manager Configuration Guide, Release 4.8
to ensure you are able to exactly
duplicate your Authorization settings from one CAS to its high availability counterpart.
•
Clean Access Managers and Clean Access Servers use a local master secret password to encrypt and
protect important data, like other system passwords. The master secret password needs to be the
same for a CAM-HA pair. Cisco recommends keeping very accurate records of assigned master
secret passwords to ensure that you are able to fail over to the HA peer CAM/CAS in HA
deployments. (HA-Secondary CAMs/CASs are not able to assume the “active” role following a
failover event when the master secret passwords are different.)
•
The standby CAS does not forward any packets between its interfaces.
•
The standby CAS monitors the health of the active CAS via heartbeat interface (serial and one or
more UDP interfaces). Heartbeat packets can be sent on the dedicated eth2 interface, dedicated eth3
interface, or eth0/eth1 interface (if no eth2 or eth3 interface is available).
•
The primary and secondary CAS machines exchange UDP heartbeat packets every 2 seconds. If the
heartbeat timer expires, stateful failover occurs.
•
In addition to heartbeat-based failover, the CAS also provides link-based failover based on eth0 or
eth1 link failure. The CAS sends ICMP ping packets to an external IP address via the eth0 and/or
eth1 interface. Failover will occur if only one CAS can ping the external addresses.