Cisco NAC3350-PROF-K9 Hardware Installation Guide - Page 150

Administration > Network Settings > DNS | Host Name - advantage

Get Cisco NAC3350-PROF-K9 - NAC Profiler Server PDF manuals and user guides View all Cisco NAC3350-PROF-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 150 highlights

Installing a Clean Access Server High Availability Pair Chapter 4 Configuring High Availability (HA) Note If your network topology restricts Link-detect functionality between your CAS HA pair appliances, you can also use the /etc/ha.d/linkdetect.conf file to enforce Link-detect behavior on your eth0 and/or eth1 interfaces. See Link-Detect Interfaces, page 4-45 for more details. • Link-detect Timeout (seconds): This configures the length of time the CAS attempts to ping the Trusted-side and/or Untrusted-side Link-detect IP address(es). Cisco recommends entering a time of at least 26 seconds. If the CAS cannot ping the node for the period of time specified, the node is not pingable. Note In addition to UDP Interface configuration, you can optionally configure the CAS to respond to link failures on the trusted and/or untrusted sides as failover events. The CAS attempts to ping the trusted and/or untrusted link-detect addresses specified, then counts the number of nodes it can reach: 0-for no addresses 1-for either trusted/untrusted 2-for both trusted/untrusted If the Standby CAS can reach more nodes than the Active CAS, the Standby CAS will take over and become the Active CAS. If both CASs can ping the same number of addresses (all addresses or only one address), no failover event occurs, since neither CAS has the advantage. To enable link-detect, enter at least one link-detect IP address on each CAS and a link-detect timeout. See also Choosing External IPs for Link-Based Failover, page 4-22 for further details. Note The standby CAS may still receive heartbeat packets from the active CAS via other available heartbeat interfaces (serial or eth2, for example) even though its eth0 and/or eth1 interface goes down. If the standby CAS relies only on heartbeat timers for stateful failover, the standby CAS would never assume the active role even though the active CAS becomes unable to perform its primary function. With link-based failover configured, the active and standby CAS exchange eth0 and eth1 status via the heartbeat interface, so if one of those two interfaces go down, the standby CAS can still assume the active role even if the heartbeat from the active CAS does not trigger a failover event. The CAS performs Heartbeat connection and (optionally) Link-detect according to the same interval, approximately every 1-2 seconds. • [Primary] Local Host Name: This is filled in by default for the HA-Primary CAS, as configured under Administration > Network Settings > DNS | Host Name ("rjcas_1" in Figure 4-12). • [Primary] Local Serial No: Filled in by default for the HA-Primary CAS. The local serial number identifies this CAS to the Clean Access Manager (and is composed of eth0/eth1 MAC addresses). In an HA-CAS pair, the serial number of the Primary CAS is the key used to associate all the configuration information specific to this CAS in the CAM database. • [Primary] Local MAC Address (trusted-side interface): Filled in by default; the MAC address of the eth0 interface for the HA-Primary CAS. 4-30 Cisco NAC Appliance Hardware Installation Guide OL-20326-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
4-30
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 4
Configuring High Availability (HA)
Installing a Clean Access Server High Availability Pair
Note
If your network topology restricts Link-detect functionality between your CAS HA pair
appliances, you can also use the
/etc/ha.d/linkdetect.conf
file to enforce Link-detect behavior
on your eth0 and/or eth1 interfaces. See
Link-Detect Interfaces, page 4-45
for more details.
•
Link-detect Timeout (seconds)
: This configures the length of time the CAS attempts to ping the
Trusted-side and/or Untrusted-side Link-detect IP address(es). Cisco recommends entering a time
of at least 26 seconds. If the CAS cannot ping the node for the period of time specified, the node is
not pingable.
Note
In addition to UDP Interface configuration, you can optionally configure the CAS to respond to
link failures on the trusted and/or untrusted sides as failover events. The CAS attempts to ping
the trusted and/or untrusted link-detect addresses specified, then counts the number of nodes it
can reach:
0-for no addresses
1-for either trusted/untrusted
2-for both trusted/untrusted
If the Standby CAS can reach more nodes than the Active CAS, the Standby CAS will take over
and become the Active CAS. If both CASs can ping the same number of addresses (all addresses
or only one address), no failover event occurs, since neither CAS has the advantage. To enable
link-detect, enter at least one link-detect IP address on each CAS and a link-detect timeout. See
also
Choosing External IPs for Link-Based Failover, page 4-22
for further details.
Note
The standby CAS may still receive heartbeat packets from the active CAS via other available
heartbeat interfaces (serial or eth2, for example) even though its eth0 and/or eth1 interface goes
down. If the standby CAS relies only on heartbeat timers for stateful failover, the standby CAS
would never assume the active role even though the active CAS becomes unable to perform its
primary function. With link-based failover configured, the active and standby CAS exchange
eth0 and eth1 status via the heartbeat interface, so if one of those two interfaces go down, the
standby CAS can still assume the active role even if the heartbeat from the active CAS does not
trigger a failover event.
The CAS performs Heartbeat connection and (optionally) Link-detect according to the same
interval, approximately every 1-2 seconds.
•
[Primary] Local Host Name
: This is filled in by default for the HA-Primary CAS, as configured
under
Administration > Network Settings > DNS | Host Name
(“rjcas_1” in
Figure 4-12
).
•
[Primary] Local Serial No
: Filled in by default for the HA-Primary CAS. The local serial number
identifies this CAS to the Clean Access Manager (and is composed of eth0/eth1 MAC addresses).
In an HA-CAS pair, the serial number of the Primary CAS is the key used to associate all the
configuration information specific to this CAS in the CAM database.
•
[Primary] Local MAC Address (trusted-side interface)
: Filled in by default; the MAC address of
the eth0 interface for the HA-Primary CAS.