Replacing a failed ACE appliance in failover pair


Dec 6, 2011 10:03 AM
Dec 6th, 2011


In Cisco ACE the redundancy feature provides seamless switchover in case an ACE becomes unresponsive or a critical host or interface fails. ACE has robust software and hardware that makes it possible to handle high volume of traffic at real time. Cisco ACE supports virtualized architecture to increase datacenter scalability. Two ACEs, properly configured, form a failover pair. Each appliance can contain one or more fault-tolerant  (FT) groups. Each FT group consists of one active context  and one standby context. Each FT group acts as an independent redundancy instance. When a switchover occurs, the active member in the FT group  becomes the standby member and the original standby member becomes the  active member. To achieve active-active redundancy, a minimum of two contexts and two FT groups are required on each ACE.

Core Issue

A failed ACE appliance is required to be replaced. The configuration should be preserved and the primary switchover need to happen.

Stateful Failover and Config sync

Cisco ACE replicates flows on the active FT group member to  the standby group member per connection for each context. The  replicated flows contain all the flow-state information necessary for  the standby member to take over the flow if the active member becomes  unresponsive. Note that ACE does not support the stateful failover of any  connections that are proxied. Such connections include Layer 7  connections (including SSL), inspection, and HTTP compression.

The ACE automatically replicates the active configuration on the standby member during config sync. This process automatically replicates any changes in the configuration from active to standby peer.

Network Diagram



Follow these steps to swap the failed device and get it back in sync with the primary:

a) Complete all the physical network connectivity.

b) Disable config auto-sync in the primary ACE.

c) Configure the management Vlan for basic network connectivity.

d) Make sure the new device has the same code as the primary; if not you'll need to upgrade it.

e) Install the license (if used).

f) Copy all the SSL files stored in the primary APP. (If any)

g) Copy the scripted keepalives (If any)

h) Configure the FT interface Vlan, FT peer, FT group for the Admin context. (Be careful about the priority you assign).

i) Re-enable config auto-sync on the primary APP in order to replicate the config to the standby.

Related Information

Configuring ACE 4710 appliance for High Availability

ACE module Failover pair in active/active situation

Average Rating: 0 (0 ratings)


Login or Register to take actions

This Document

Posted December 6, 2011 at 10:03 AM
Comments:0 Avg. Rating:0
Views:3339 Contributors:0

Related Content

Documents Leaderboard