Cisco NAC3350-PROF-K9 Hardware Installation Guide - Page 146

Serial Port High-Availability Connection, Con High Availability

Get Cisco NAC3350-PROF-K9 - NAC Profiler Server PDF manuals and user guides View all Cisco NAC3350-PROF-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 146 highlights

Installing a Clean Access Server High Availability Pair Chapter 4 Configuring High Availability (HA) Note If using eth0 as the UDP heartbeat interface, make sure that the management interfaces on the CAS are in their own VLAN, not on a VLAN with other user traffic. This is a general best practice that allows you to segment and protect management traffic when running the failover heartbeat over the same physical interface. Serial Port High-Availability Connection By default, the first serial connector detected on the server is configured for console input/output (to facilitate installation and other types of administrative access). Warning When connecting high availability (failover) pairs via serial cable, BIOS redirection to the serial port must be disabled for Cisco NAC Appliance CAMs/CASs and any other server hardware platform that supports the BIOS redirection to serial port functionality. See Supported Hardware and System Requirements for Cisco NAC Appliance (Cisco Clean Access) for more information. Caution To help prevent a potential network security threat, Cisco strongly recommends physically disconnecting from the Cisco NAC console management port when you are not using it. For more details, see http://seclists.org/fulldisclosure/2011/Apr/55, which applies to the Cisco ISE, Cisco NAC Appliance, and Cisco Secure ACS hardware platforms. When high-availability mode is selected, the serial console login (ttyS0) is automatically disabled to free the serial port for HA mode. To re-enable ttyS0 as the console login, deselect the Disable Serial Login checkbox on the Failover > General tab after clicking Update and before clicking Reboot. For details, see steps c. Configure HA-Primary Mode and Update, page 4-28 and c. Configure HA-Secondary Mode and Update, page 4-34. Configure High Availability Note Cisco NAC network modules installed in Cisco Integrated Services Routers (ISRs) do not support high availability. The following sections describe how to set up high availability in four general procedures: • Step 1: Configure the HA-Primary Clean Access Server, page 4-27 • Step 2: Configure the HA-Secondary Clean Access Server, page 4-34 • Step 3: Connect the Clean Access Servers and Complete the Configuration, page 4-38 • Step 4: Failing Over an HA-CAS Pair, page 4-39 Note "Primary/Secondary" denotes the server mode when it is configured for HA. "Active/Standby" denotes the runtime status of the server. 4-26 Cisco NAC Appliance Hardware Installation Guide OL-20326-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
4-26
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 4
Configuring High Availability (HA)
Installing a Clean Access Server High Availability Pair
Note
If using eth0 as the UDP heartbeat interface, make sure that the management interfaces on the CAS are
in their own VLAN, not on a VLAN with other user traffic. This is a general best practice that allows
you to segment and protect management traffic when running the failover heartbeat over the same
physical interface.
Serial Port High-Availability Connection
By default, the first serial connector detected on the server is configured for console input/output (to
facilitate installation and other types of administrative access).
Warning
When connecting high availability (failover) pairs via serial cable, BIOS redirection to the serial port
must be disabled for Cisco NAC Appliance CAMs/CASs and any other server hardware platform that
supports the BIOS redirection to serial port functionality. See
Supported Hardware and System
Requirements for Cisco NAC Appliance (Cisco Clean Access)
for more information.
Caution
To help prevent a potential network security threat, Cisco strongly recommends physically disconnecting
from the Cisco NAC console management port when you are not using it. For more details, see
http://seclists.org/fulldisclosure/2011/Apr/55
, which applies to the Cisco ISE, Cisco NAC Appliance,
and Cisco Secure ACS hardware platforms.
When high-availability mode is selected, the serial console login (ttyS0) is automatically disabled to free
the serial port for HA mode. To re-enable ttyS0 as the console login, deselect the
Disable Serial Login
checkbox on the
Failover > General
tab after clicking
Update
and before clicking
Reboot
. For details,
see steps
c. Configure HA-Primary Mode and Update, page 4-28
and
c. Configure HA-Secondary Mode
and Update, page 4-34
.
Configure High Availability
Note
Cisco NAC network modules installed in Cisco Integrated Services Routers (ISRs) do not support high
availability.
The following sections describe how to set up high availability in four general procedures:
•
Step 1:
Configure the HA-Primary Clean Access Server, page 4-27
•
Step 2:
Configure the HA-Secondary Clean Access Server, page 4-34
•
Step 3:
Connect the Clean Access Servers and Complete the Configuration, page 4-38
•
Step 4:
Failing Over an HA-CAS Pair, page 4-39
Note
“Primary/Secondary” denotes the server mode when it is configured for HA.
“Active/Standby” denotes the runtime status of the server.