Table Of Contents

Replication and High Availability

Setting Up Replication

Configuring Provisioning

Replication Status

Recovering from Failures

Network Connectivity

Device Failure

Deployment Considerations

Connectivity

Load Balancing

Web Interface

RADIUS Interface

Data Replicated

Replication and High Availability

---

To provide high availability, the Cisco NAC Guest Server solution can be configured so that a pair of units synchronize their databases between one another. This provides the ability for the solution to carry on working in the event of loss of connectivity or failure to a single unit.

High availability is provided in an active/active scenario, where both Cisco NAC Guest Servers can service requests from sponsors or network devices at the same time. This capability also allows you to load balance the requests between the boxes.

---

Note Not all system settings are replicated. Refer to Data Replicated to review which settings are not replicated.

---

---

Note For load balancing external load balancers must be used to load balance the web interface. RADIUS requests can also be load balanced via external load balancers or by configuration.

---

This chapter includes the following sections:

•Setting Up Replication

•Configuring Provisioning

•Replication Status

•Recovering from Failures

•Deployment Considerations

Setting Up Replication

Initial replication is configured by setting one of the Cisco NAC Guest Servers to copy all of the data from the other Guest Server. The Guest Server that is configured to copy the data from the other device will be first set to delete all its own data. This ensures that no conflicts exist. Cisco recommends setting up replication at initial install time of Cisco NAC Guest Server, or when adding a new Guest Server to an existing implementation.

---

Warning All Data on one of the Guest Servers will be overwritten. If you have data that is needed on both Guest Servers then you should not configure replication as you will loose data.

---

Once one of the Guest Servers has received a copy of the data from the other device they are synchronized and replication is turned on. Any data that is updated on one Guest Server is then automatically replicated to the other Guest Server.

All communication between the Cisco NAC Guest Servers is encrypted using SSL and runs over TCP destination port 5432.

---

Step 1 Create a backup of the Cisco NAC Guest Server before starting by following the Taking a snapshot instructions in Configuring Backup Settings, page 11-2.

Step 2 From the administration interface select Authentication > Replication Settings from the left hand menu (Figure 12-1).

Figure 12-1 Replication Settings

Step 3 Enter the Remote Guest Server address. This is the address of the Cisco NAC Guest Server that you want to enable replication with.

Step 4 Enter a Shared Secret and confirm it. The shared secret is used to authenticate with the other Cisco NAC Guest Server. The shared secret must be identical on both Guest Servers.

Step 5 Set the Replication Mode to be On.

---

Note Setting a servers Replication Mode to be Off removes it from the replication process. There is no method of re-synchronizing a Server without starting the process from the beginning and by doing this you will loose non-replicated data on one of the Servers. Only turn Replication off if you are making a standalone system.

---

Step 6 Turning on replication enables you to specify whether this server is the one that contains the current data or will copy data from the other server. Choose This node contains the data if you want to keep the data from this server. Choose This node will copy data from other node if you want to erase all data on this server and copy the data from the other server.

---

Warning Make sure you set these correctly on each server otherwise you will loose data. It is advised to take a backup before running this procedure.

---

Step 7 Click Save Settings to save the settings and turn on the replication process.

Step 8 Repeat Step 1 through Step 7 to set up replication on the other Cisco NAC Guest Server.

---

Configuring Provisioning

When the Cisco NAC Guest Server provisions accounts in other systems, such as the Clean Access Manager, only one of the Guest Servers should be performing the provisioning at any one time.

One Cisco NAC Guest Server should be defined as the primary and the other as the secondary. The server set to primary will perform the provisioning by default. If a server is set to secondary it will check the status of the primary server, if it fails to contact the primary server three times then it will perform the provisioning. This process happens every minute when the provisioning service runs.

---

Step 1 From the administration interface select Authentication > Replication Settings from the left hand menu (Figure 12-2).

Figure 12-2 Configuring Provisioning Order

Step 2 Select the Provisioning to be Primary if you want this server to perform the provisioning under normal conditions. Select Secondary if you want this server to only perform provisioning if the Primary cannot be contacted.

Step 3 Click the Save Settings button.

---

Note Only one of the servers should be set to Primary otherwise you may get errors when creating or deleting accounts twice.

---

---

Replication Status

At any moment in time you can check the replication status of the Cisco NAC Guest Servers. This is useful to make sure replication is happening as you want it to.

---

Step 1 From the administration interface select Authentication > Replication Settings from the left hand menu (Figure 12-3).

Figure 12-3 Replication Status

At the bottom of the page is the Replication Status. You can check the status of replication and how many changes need to be replicated between each device.

---

Recovering from Failures

Network Connectivity

When the network connectivity between two Cisco NAC Guest Servers fails the Cisco NAC Guest Servers will store up to 1GB of changes. When connectivity is restored if the amount of changes is less than 1GB they will synchronize with each other. If more than 1GB of changes are stored the Cisco NAC Guest Server will stop the replication process and you will need to setup replication again.

Device Failure

If one of the Cisco NAC Guest Servers in a replication pair fails and needs to be replaced, you should set up replication with the working server and the data will be re-synchronized to the device.

---

Warning Do not restore the failed unit from a backup. Restoring from a backup onto one unit in a replication pair will result in not having an exact replica of the data on both servers.

---

---

Step 1 From the administration interface select Authentication > Replication Settings from the left hand menu (Figure 12-4).

Figure 12-4 Resetting Replication

Step 2 Set Replication Mode to Off on both of the Guest Servers.

Step 3 Follow the instructions in Setting Up Replication and ensure that you set the working server as the one with the data.

---

Deployment Considerations

Connectivity

The Cisco NAC Guest Servers need to be provided with IP connectivity between the units. Cisco recommends making the network path between the devices resilient so that synchronization can always be performed. However if the devices become disconnected they will continue to function and store changes until they are connected back together and can re-establish communication. At that point they will re-synchronize databases.

Depending on the amount of activity that your Cisco NAC Guest Server performs you need to make sure that there is enough bandwidth between the server to enable synchronization to occur as rapidly as possible.

You can test connectivity by creating a large amount of accounts and watching how quickly the appliances synchronize by watching the status on the replication screen (Figure 12-3).

Load Balancing

Web Interface

Sponsor and Administration sessions can be services by both Cisco NAC Guest Servers when configured for replication. The Cisco NAC Guest Server however does not perform any redirection or automatic load balancing of requests.

To enable requests to both Cisco NAC Guest Servers concurrently, you must implement an external load balancing mechanism. Options include:

•Network based Load Balancing—such as the Cisco CSS, GSS, CSM or ACE platforms. The only requirement for the load balancing is that clients are services by the same Cisco NAC Guest Server for their entire session. Individual requests cannot be load balanced between servers as the Cisco NAC Guest Server doesn't replicate sponsor/admin session information to reduce bandwidth requirements. The most common method of achieving this is sticking connections to the same Cisco NAC Guest Server based upon source IP address.

•DNS Round robin—Using your DNS server, configure the domain name of the Cisco NAC Guest Server to return both IP addresses for the Cisco NAC Guest Server in a round-robin configuration. This method does not provide failover between appliances in the event of a failure.

•Publishing multiple URLs—This allows each user to choose which server they would like to use.

RADIUS Interface

The RADIUS interface on either Cisco NAC Guest Server can take requests at the same time.

Cisco recommends configuring one Cisco NAC Guest Server to be the primary for some RADIUS clients and the other Cisco NAC Guest Server to be the primary for the other RADIUS clients. For failover the RADIUS clients can have secondary RADIUS servers defined as the other Cisco NAC Guest Server if they support configuration of two servers.

Data Replicated

Cisco NAC Guest Server Replication replicates data that is stored in the database between replication pairs. The information in Table 12-1 is not replicated and is locally defined on each Cisco NAC Guest Server.

Table 12-1 Data Not Replicated Between Cisco NAC Guest Server Replication Pairs

Email settings	•SMTP server
Templates	•Logo
Network settings	•Domain name •Hostname •IP address •Subnet mask •Default gateway •Nameserver 1 •Nameserver 2
Date/time settings	•Date •Time •Locale •NTP server 1 •NTP server 2
SSL settings	•SSL certificate •Root CA certificate •Private key
Backup	•Max number of backups •Frequency •FTP settings
Licensing	•License file