AAA, NAC, Guest Access & BYOD

How the Virtual IP(VIP) works in Clearpass Cluster?

Aruba Employee
Question How the Virtual IP works in Clearpass Cluster?
Environment This configuration applies to Clearpass cluster where we have 2 nodes, Primary and Secondary sharing a Virtual IP address for redundancy.

 

 

Virtual IP address is shared between two nodes in a cluster and the behavior of the Virtual IP(VIP) address is as follows:

-Virtual IP(VIP) stays with the configured Primary node until it fails. This failure can be simulated by stopping the VIP service.
-Upon failure of the configured Primary, the configured Secondary takes over the VIP. It does a gratuitous ARP to update ARP caches and emits system events to indicate the takeover.
-When the primary is back on line – this can be simulated by starting VIP service on the primary, it takes back the VIP. It does a gratuitous ARP to update ARP caches and emits system events to indicate the takeover.

 
The only exception to this is when you have publisher redundancy configured. In this case, if you shutdown the publisher long enough, the configured standby promotes itself as publisher. The original publisher is dropped from cluster during this promotion. Since the original publisher is now out of cluster, any VIPs for which it was configured as the primary are NOT released back to it even if you bring up that machine again. The VIP service on the original publisher will be stopped and it will refuse to start if you try to start it manually.

 
To get the original publisher back into the cluster, you have to reset its DB and join it back to the cluster. After this joining, you can manually start the VIP service on this node, and it will take back ownership of any VIPs for which it was configured as master.

Version history
Revision #:
1 of 1
Last update:
‎07-11-2014 02:27 PM
 
Labels (1)
Contributors
Comments
Andrew Winford

When you configure a VIP do the Publisher and Subscriber still respond to auth requests on their real IPs?  I see this being a condition during migration of an 802.1x wired implemenation and having to go and touch switches to reconfigure the AAA settings in the event no DNS is being used.

Yes, they will. The virtual IP is generally only used for an HA guest URL.
Andrew Winford

Your the best as always Tim.

 

Thanks.

 

Andy

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: