Cisco NAC3350-PROF-K9 Hardware Installation Guide - Page 142

Choosing External IPs for Link-Based Failover, CAS High Availability Requirements, Physical Connection

Get Cisco NAC3350-PROF-K9 - NAC Profiler Server PDF manuals and user guides View all Cisco NAC3350-PROF-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 142 highlights

Installing a Clean Access Server High Availability Pair Chapter 4 Configuring High Availability (HA) Choosing External IPs for Link-Based Failover • Keep in mind that when the CAS initiates traffic, it will always send packets out of its untrusted (eth1) interface except for packets destined to its default gateway. Therefore, when choosing an external IP on trusted network for CAS to ping via the eth0 interface, choose any IP belonging to a subnet other than the CAS subnet. • The external IP addresses should be different for the trusted and untrusted interfaces. • When choosing an external IP on the untrusted network for CAS to ping via the eth1 interface: - This IP has to exist on the CAS management subnet. - It cannot be the default gateway of the CAS. - The CAS will send these ping packets out of the eth1 interface. - Verify whether Set Management VLAN ID is enabled for the eth1 interface. If this option is not enabled, CAS will send traffic out untagged on the eth1 interface. The switch will determine whether these packets should be received on its native VLAN. Therefore, on the untrusted interface, ensure that the native VLAN is being forwarded. - The external IP address will be in the CAS management subnet, but on the untrusted side, the traffic will be going out from the CAS in the native VLAN; hence ensure the native VLAN is being forwarded towards the external IP device. Refer to c. Configure HA-Primary Mode and Update, page 4-28 and c. Configure HA-Secondary Mode and Update, page 4-34 for additional configuration details. CAS High Availability Requirements This section describes addition planning considerations when implementing high availability. Note In a CAS HA deployment using NAT on the trusted (eth0) side, you must ensure that the -Dperfigo.nat.serviceip=

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
4-22
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 4
Configuring High Availability (HA)
Installing a Clean Access Server High Availability Pair
Choosing External IPs for Link-Based Failover
•
Keep in mind that when the CAS initiates traffic, it will always send packets out of its untrusted
(eth1) interface except for packets destined to its default gateway. Therefore, when choosing an
external IP on trusted network for CAS to ping via the eth0 interface, choose any IP belonging to a
subnet other than the CAS subnet.
•
The external IP addresses should be different for the trusted and untrusted interfaces.
•
When choosing an external IP on the untrusted network for CAS to ping via the eth1 interface:
–
This IP has to exist on the CAS management subnet.
–
It cannot be the default gateway of the CAS.
–
The CAS will send these ping packets out of the eth1 interface.
–
Verify whether
Set Management VLAN ID
is enabled for the eth1 interface. If this option is
not enabled, CAS will send traffic out untagged on the eth1 interface. The switch will determine
whether these packets should be received on its native VLAN. Therefore, on the untrusted
interface, ensure that the native VLAN is being forwarded.
–
The external IP address will be in the CAS management subnet, but on the untrusted side, the
traffic will be going out from the CAS in the native VLAN; hence ensure the native VLAN is
being forwarded towards the external IP device.
Refer to
c. Configure HA-Primary Mode and Update, page 4-28
and
c. Configure HA-Secondary Mode
and Update, page 4-34
for additional configuration details.
CAS High Availability Requirements
This section describes addition planning considerations when implementing high availability.
Note
In a CAS HA deployment using NAT on the trusted (eth0) side, you must ensure that the
-Dperfigo.nat.serviceip=
<NAT'ed service IP or CAS service hostname>
property is set for the
starttomcat
and
restartweb
files on both the Primary and Secondary CAS.
For example,
-Dperfigo.nat.serviceip=172.10.20.100
.
Physical Connection
Cisco recommends using a
dedicated
connection for failover heartbeat on Clean Access Server
high-availability pairs. You can use:
•
A dedicated Ethernet NIC card, configured as the eth2 or eth3 interface of the CAS
Note
If a dedicated Ethernet interface (e.g. eth2 or eth3) is not available on the server machine,
eth0 and eth1 are supported for the Heartbeat UDP interface. (This function does not apply,
however, if you have deployed your CASs in Virtual Gateway mode
and
the eth0 and eth1
interfaces have the
same
IP address.) See
Selecting and Configuring the Heartbeat UDP
Interface, page 4-25
.