×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

ACS appliance failover( High Availibility) documentation

Unanswered Question
May 30th, 2012
User Badges:

Hi


I have to configure Cisco ACS for Active/Passive role. I am looking for some documentation on that on cisco website but can not find it.


Can anyone suggest me proper best practice documentation ?


Thank you,

Nilay

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mauzamor Wed, 05/30/2012 - 09:23
User Badges:
  • Bronze, 100 points or more

Hi there,


The ACS doesn't work like an ASA where you can have one active and the other standby. What you can do is to have one primary and another as the secondary, where depending on your TACACS+/Radius commands the authentication server role will change, for example:


tacacs-server host 10.0.0.1 key xxx

tacacs-server host 20.0.0.1 key xxx


This configuration means that the router will try to contact 10.0.0.1 always, but if this server goes down, the router will try to contact 20.0.0.1 until the 10.0.0.1 is up again.


So as you can see the ACS servers doesn't have control about which will be the active server, only which is the primary and which is the secondary (primary and secondary is important because you configure the settings in the primary and this one replicates those changes to the secondary).


Documentation:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/admin_operations.html#wp1066095

Eduardo Aliaga Wed, 05/30/2012 - 15:04
User Badges:
  • Silver, 250 points or more

Hello Nilay.


Mauricio is right. To expand his answer, if you have several  ACS appliances only one of them is primary and all the other ones are  secondary.


"Primary" and "secondary" concepts are different from "active" and "standby" concepts. All ACS are "active".


The  switch configuration tells the switch which ACS to talk to. It can be  one, two, three, any number of ACS. Also if there are more than one ACS,  the switch configuration gives the preference to the first ACS declared  in the configuration. Only if the first ACS doesn't respond at all  then the switch will try to talk to the second ACS declared. Only if the  second ACS doesn't respond at all then the switch will try to talk to  the third ACS and so on.


here's an example of switch configuration with three ACS


radius-server host 192.168.1.10 key MYPASSWORD

radius-server host 192.168.1.11 key MYPASSWORD

radius-server host 192.168.1.12 key MYPASSWORD

radius-server vsa send authentication


aaa new-model

!

aaa group server radius ACS

server 192.168.1.10

server 192.168.1.11

server 192.168.1.12

!

aaa authentication dot1x default group ACS

aaa authorization network default group ACS

aaa accounting dot1x default start-stop group ACS

Nilaykumar Patel Fri, 06/01/2012 - 12:05
User Badges:

I configured distributed deployment explained in above document and it works fire. Thank you for your help.


-Nilay

Actions

This Discussion

Related Content