Cisco NAC3350-PROF-K9 - NAC Profiler Server Installation Manual page 140

Installing a Clean Access Server High Availability Pair
Figure 4-9
Service IP
(untrusted-side)
Untrusted
10.201.50.243
network
Note "Primary/Secondary" denotes the server mode when it is configured for HA. "Active/Standby" denotes
the runtime status of the server.
When first configuring the HA peers, you must specify an HA-Primary CAS and HA-Secondary CAS.
Initially, the HA-Primary is the active CAS, and the HA-Secondary is the standby (passive) CAS. If a
failover event occurs, such as the active CAS shuts down or stops responding to the peer's heartbeat
signal, the standby assumes the role of the active CAS.
If both the HA-Primary and HA-Secondary CASs in your HA deployment lose their configuration, you
Note
can restore the system using the guidelines in the "Restoring Configuration from CAM Snapshot In HA
Deployment" section in the
Release 4.8(3).
When the CAS starts up again, it checks to see if its peer is active. If the peer is active, the starting CAS
becomes the standby. If the peer is not active, then the starting CAS assumes the active role.
Typically, Clean Access Servers are configured as an HA pair at the same time, but you can add a new
Clean Access Server to an existing standalone CAS to create a high-availability pair. In order for the pair
to appear to the network and to the Clean Access Manager as one entity, you must specify a Service IP
Address for the trusted interface (eth0) and a Service IP address for untrusted interface (eth1) of the pair.
Use the Service IP of the CASs to add the CAS to the CAM.
a high-availability pair is displayed in brackets next to the Service IP for the pair in the List of Servers
in the CAM web console. In addition, either the trusted or untrusted interface Service IP address should
be used to generate the SSL certificate.
Cisco NAC Appliance Hardware Installation Guide
4-20
Clean Access Server Example High-Availability Configuration
Primary
CAS
(rjcas_1)
eth1
(10.201.50.240)
link detect
(icmp req)
Secondary
CAS
(rjcas_2)
eth1
(10.201.50.241)
link detect
(icmp req)
Cisco NAC Appliance - Clean Access Manager Configuration Guide,
Chapter 4
Heartbeat UDP Interface 1
eth0
(10.201.2.111)
(Optional)
Heartbeat UDP
Interface 2 or 3
(trusted-side)
10.201.2.112
(Optional)
Heartbeat UDP
Interface 2 or 3
Heartbeat UDP Interface 1
eth0
(10.201.2.110)
Figure 4-10
Configuring High Availability (HA)
Service IP
Trusted network
shows how the active CAS of
OL-20326-01