Wireless Access

Reply
4me
Contributor I

user table is not switching for primary controller to standby controller r

User table is not forwarding from Primary master controller to secondary standby controller when primary master controller failed and vice versa, In this setup we are running HA and VRRP

 

 

4me
Contributor I

Re: user table is not switching for primary controller to standby controller r

AP's are failing over from master to standby and vice verse when there a failure on controller. only user table was not forward from active to standby  and client disconnects and need to reauthenticate

Valued Contributor II

Re: user table is not switching for primary controller to standby controller r

Hi,

 

It is very unusual, need to diagnose , usually user table should be updated periodically, verify the following areas,

 

BTW what is the image version you are using ?

 

1. Is the database sync enabled and time is specified ? if not enable and specify the period.

Red1.png

2. Check the communication statistics by using "show vrrp <id> statistics "

 

Please feel free for any further help on this

 

 

Cheers,
Venu Puduchery,
[Is my post helped you ? Give Kudos :) ]
Guru Elite

Re: user table is not switching for primary controller to standby controller r


Venuprasad wrote:

User table is not forwarding from Primary master controller to secondary standby controller when primary master controller failed and vice versa, In this setup we are running HA and VRRP

 

 


Do you have client state sync enabled?  http://www.arubanetworks.com/techdocs/ArubaOS_64_Web_Help/Web_Help_Index.htm#ArubaFrameStyles/VRRP/HighAvStateSynch.htm

 

The client state sync does not synchronize users in the user table, rather when doing 802.1x it synchronizes PMK and cache key entries to minimize reconnect times.   Please read the link above to also see the limitations of state sync.  "Database Synchronization" has nothing to do with state sync - It only synchronizes the internal databases of the controller, NOT the user tables.

 



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Valued Contributor II

Re: user table is not switching for primary controller to standby controller r

Hi Colin,

So the User table will be pushed to the standby along with the database or not ?

 

Please through some light on this.

 

Cheers,
Venu Puduchery,
[Is my post helped you ? Give Kudos :) ]
Guru Elite

Re: user table is not switching for primary controller to standby controller r

Venu,

 

Please see the link above.  Only PMK and key cache entries are synchronized to avoid a full radius authentication for 802.1x clients upon failover.



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Valued Contributor II

Re: user table is not switching for primary controller to standby controller r

Hi Colin,
I'm clear with "client state sync". my point is, how and when the user table will be updated to Standby controller ? as you said user table will bot be updated through database sync. I want to know what is the mechanism behind updating the usertable.
Thanks in advance. 
Cheers,
Venu Puduchery,
[Is my post helped you ? Give Kudos :) ]
Valued Contributor II

Re: user table is not switching for primary controller to standby controller r

Hi Colin,

 

I got it now. correct me if I'm wrong. user table will not be pushed to the standby rather new entry will be created after 11i 4 way handshake. Here reauthentication is avoided due to sharing PMK through OKC.

 

 

Cheers,
Venu Puduchery,
[Is my post helped you ? Give Kudos :) ]
Super Contributor I

Re: user table is not switching for primary controller to standby controller r

 

This mystifies me as well.  On the standby, the user table does not contain users from the active.

 

An OKC 4-way handshake can't restore server-derived AAA roles.

 

An SSL fast-reauth session restore to the RADIUS server would allow a reload of role,

but not of the enforce-dhcp state.

 

And most clients will not re-dhcp after an OKC roam or even after a fast-reauth.

 

But I don't remember having to kick dhclient on my linux box when I tested this way back when.

 

So... ?    Something must be stored somewhere.  Or I didn't have Enforce-DHCP on when I tested.

 

Valued Contributor II

Re: user table is not switching for primary controller to standby controller r

HI 

 

 

The State Synchronization not only synchronizes PMK and Key cache values between the active and standby controllers , it allows clients to authenticate on the standby without having to do a full 802.1X auth.

 

This is the trick. :)

Cheers,
Venu Puduchery,
[Is my post helped you ? Give Kudos :) ]
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: