Security

Reply
Contributor II
Posts: 61
Registered: ‎07-01-2013

Provision CP-VA-500 with heavy resources as a backup publisher to a CP-VA-5K

Today one of my customers came to me after attending an Aruba EBC and told me something very interesting.

 

Previously, him and I had discussed standing up a backup publisher in his new data center in case his normal publisher goes down or needs a reboot. He has 1 CP-VA-5K publisher and 6 CP-HW-500 subscribers deployed globally for a total of 8000 Policy Manager licenses in his cluster. His total license usage is about 1600, with about 1300 of these being consumed on the publisher according to Insight.

 

He has a very robust server infrastructure in his data centers, and as a result, he has the flexibility to stand up new virtual ClearPass server in his new data center spec'd out to the requirements of a CP-VA-5K, but licensed as a CP-VA-500. In his mind (and I agree with him), there is no need to pay for extra licensing since he is grossly underutilizing his current pool.

 

He brought this up in his EBC, and essentially was told by the Aruba respresentative conducting the EBC that software is hard limited in the code to only accept AAA 500 requests per day on a CP-VA-500.

 

First of all, I already know that phrasing is incorrect because their 5K publisher is already handling ~18,000 requests per day (I've seen 5Ks handle hundreds of thousands per day in some environments). Second of all, I've seen production environments which have gone above the license limit on the box (6,500 licenses consumed on a 5K) with no negative repercussions other than a warning message in the logs**. 

 

With that information, even if his 5K appliance were to go offline long term, the backup VM should be able to handle the load since 1) it is spec'd as a 5K and 2) there are still enough licenses in the pool even with the 5K publisher offline.

 

So it sounds like what the person at the EBC said is a bunch of BS. But can anyone confirm or deny with confidence what would happen if this was implemented as discussed and the publisher suddenly died?

 

Thanks in advance.

 

**There was some performance degredation as well in that case, but that was because the hardware was being slammed (it was a hardware appliance) - this wouldn't be the case in the situation I'm discussing now since they have basically unlimited hardware resources that can be provisioned for their server.

Tim Haynie, ACMX #508, ACDX #384, ACCP, CWSP, CWAP, CWDP, CCNP R/S, CCNP Wireless, CCNA Security, CCDA
Guru Elite
Posts: 20,822
Registered: ‎03-29-2007

Re: Provision CP-VA-500 with heavy resources as a backup publisher to a CP-VA-5K

The cp-va-500 can only handle 500 UNIQUE devices per day.  If this is exceeded, eventually the GUI will be locked out.  Beyond that, the customer should probably focus on the number of authentications per second from a CPU perspective.



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Moderator
Posts: 479
Registered: ‎11-09-2012

Re: Provision CP-VA-500 with heavy resources as a backup publisher to a CP-VA-5K

Tim,

 

I messaged you yesterday evening privately about this..... please contact me at danny@arubanetworks.com to discuss.

 

 


Best Regards
-d

Snr Tech Marketing Engineer - ClearPass

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Search Airheads
Showing results for 
Search instead for 
Did you mean: