Cisco NAC3350-PROF-K9 Hardware Installation Guide - Page 139

Starting from release 4.51, when a standby CAS assumes the role of an active CAS that is

Get Cisco NAC3350-PROF-K9 - NAC Profiler Server PDF manuals and user guides View all Cisco NAC3350-PROF-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 139 highlights

Chapter 4 Configuring High Availability (HA) Installing a Clean Access Server High Availability Pair Note The standby CAS may still receive heartbeat packets from the active CAS via other available heartbeat interfaces (serial or eth2, for example) even though its eth0 and/or eth1 interface goes down. If the standby CAS relies only on heartbeat timers for stateful failover, the standby CAS would never assume the active role even though the active CAS becomes unable to perform its primary function. With link-based failover configured, the active and standby CAS exchange eth0 and eth1 status via the heartbeat interface, so if one of those two interfaces go down, the standby CAS can still assume the active role even if the heartbeat from the active CAS does not trigger a failover event. • Both Clean Access Servers share a virtual Service IP for the eth0 trusted interface and eth1 untrusted interface. The Service IP should be used for SSL certificates. • Cisco NAC-3310 CAMs/CASs feature a 160GB hard drive or 80GB hard drive. Both of these hard drive sizes support High Availability (HA) deployments, and you can safely deploy a 160GB model in an HA pair with an 80GB model. • HA CAMs/CASs automatically establish an IPSec tunnel to ensure all communications between the HA Pair appliances remains secure across the network. • Starting from release 4.5(1), when a standby CAS assumes the role of an active CAS that is performing DHCP address management and has gone into Fallback state, the new active CAS also assumes DHCP functions in addition to user login. Caution The connection between HA pairs must be extremely reliable, with communication between HA pairs unimpeded. The best practice is to use a dedicated Ethernet cable. Breaking communication between HA pairs will result in two active nodes, which can have serious negative operational consequences. A key aspect of the link between HA pairs is the ability to restore that link should it go down; restoration may be fundamental to network stability, depending on your design. Tip To avoid the HA pairs resulting in two active nodes, Cisco recommends to setup the eth2/eth3 interfaces on HA CASs for heartbeat. Figure 4-9 illustrates the basic connections in an example HA-CAS configuration. OL-20326-01 Cisco NAC Appliance Hardware Installation Guide 4-19

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
4-19
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 4
Configuring High Availability (HA)
Installing a Clean Access Server High Availability Pair
Note
The standby CAS may still receive heartbeat packets from the active CAS via other available
heartbeat interfaces (serial or eth2, for example) even though its eth0 and/or eth1 interface
goes down. If the standby CAS relies only on heartbeat timers for stateful failover, the
standby CAS would never assume the active role even though the active CAS becomes
unable to perform its primary function. With link-based failover configured, the active and
standby CAS exchange eth0 and eth1 status via the heartbeat interface, so if one of those two
interfaces go down, the standby CAS can still assume the active role even if the heartbeat
from the active CAS does not trigger a failover event.
•
Both Clean Access Servers share a virtual Service IP for the eth0 trusted interface and eth1 untrusted
interface. The Service IP should be used for SSL certificates.
•
Cisco NAC-3310 CAMs/CASs feature a 160GB hard drive or 80GB hard drive. Both of these hard
drive sizes support High Availability (HA) deployments, and you can safely deploy a 160GB model
in an HA pair with an 80GB model.
•
HA CAMs/CASs automatically establish an IPSec tunnel to ensure all communications between the
HA Pair appliances remains secure across the network.
•
Starting from release 4.5(1), when a standby CAS assumes the role of an active CAS that is
performing DHCP address management and has gone into Fallback state, the new active CAS also
assumes DHCP functions in addition to user login.
Caution
The connection between HA pairs must be extremely reliable, with communication between HA pairs
unimpeded. The best practice is to use a dedicated Ethernet cable. Breaking communication between HA
pairs will result in two active nodes, which can have serious negative operational consequences. A key
aspect of the link between HA pairs is the ability to restore that link should it go down; restoration may
be fundamental to network stability, depending on your design.
Tip
To avoid the HA pairs resulting in two active nodes, Cisco recommends to setup the eth2/eth3 interfaces
on HA CASs for heartbeat.
Figure 4-9
illustrates the basic connections in an example HA-CAS configuration.