Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

SPLIT ACS CONFIGURATION

     Hi all. in cisco's documentation, I found somthing about split acs deployment where both acs boxes can act as primary in their zones and then secondary for the other zone respectively, but I don't seem to understand how this can be done on the two acs boxes.  My concern is this:

Is there a place where you can configure on each machine that machine "A" is the primary for this zone and machine "B" the other zone and vice visa?

I also want to believe that on each aaa client, the first tacacs server configured would be default aaa server less its on available, the client checks the next server just like the behaviour of acl.

Are there any docs that explain the replication of this database, and configurations required?

Regards all.

Thanks.

  • AAA Identity and NAC
7 REPLIES

Re: SPLIT ACS CONFIGURATION

Hi

Split ACS Configuration is the concept of dividing the AAA load.

As per Cisco :  In split ACS deployment, you use primary and secondary servers as in a small ACS deployment, but the AAA load is split between the two servers to optimize AAA flow. Each server handles the full workload of both servers in the event of a AAA connectivity problem, but during normal operations neither server carries the full load of authentication requests. This property of the servers allows for less stress on each ACS system, provides better loading, and makes you aware of the functional status of the secondary server through normal operations

If you want to Split the Load then you have to change the way of AAA deployment.

For Example : You have 2000 Decives  & 2 ACS Then you can divide the load.

You can configure the 1000 Devices with  : ACS 1  - Primary  IP address

                                                               ACS 2 - Secondary IP address

& Other 1000 Devices with : ACS 2  - Secondary IP address

                                         ACS 1 -  Primary   IP Address

In this way the Load of 2000 devices will be split between 2 ACS Server.

Regards

Chetan Kumar

http://chetanress.blogspot.com

New Member

Re: SPLIT ACS CONFIGURATION

Hello,

I'm interested in this topic, too.

I was wondering if with this split ACS configuration, replication is possible. And if it is, then how it would be in the ACS configuration, if the system allows to be secondary server and also primary server at the same time. I've taken a look at the user guide and it seemed to me like this wasn't possible, and it doesnt explain how to do a split acs configuration...it is only mentioned in the installation and upgrade guide.

I appreaciate your comments. Regards.

New Member

Hello ,

Hello ,

Can anyone please tell me if we can implement Split ACS deployment in two different geographical locations?

My requirement is to have one ACS server at one location and other at some other location and the AAA load has to be shared between the two.Kindly suggest , which would be the best deployment plan.

Thanks in advance,

Prabir

Cisco Employee

yes you can as you have only

yes you can as you have only 2 ACS. In split ACS deployment, you use primary and secondary servers as in a small ACS deployment, but the AAA load is split between the two servers to optimize AAA flow. Each server handles the full workload of both servers in the event of a AAA connectivity problem, but during normal operations neither server carries the full load of authentication requests. This property of the servers allows for less stress on each ACS system, provides better loading, and makes you aware of the functional status of the secondary server through normal operations.

http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-1/installation/guide/acs5_1_install_guide/csacs_deploy.html#wp1104113

- Jatin

~BR Jatin Katyal **Do rate helpful posts**
New Member

Hi Jatin ,

Hi Jatin ,

Thank You for your update.

But I have not got any document from Cisco site, which confirms about the locations where the primary and secondary are to be placed.As confirmed by you, i take it that, they can be implemented in two different geographical locations.

Kindly share if you have any design & configuration document regarding Cisco Secure ACS 5.8.

Regards,

Prabir

Cisco Employee

Re: SPLIT ACS CONFIGURATION

You normally just have to have one primary ACS and one secondary ACS both synchronized, and on some devices you will add secondary as first AAA server and primary as second, and on other device you'll make the contrary.

SPLIT ACS CONFIGURATION

Have anyone tried this method.

Regards,

Pandi

1442
Views
0
Helpful
7
Replies