Wireless Access

Doing some pre-production testing of AOS8 and thought I'd have a play with the cluster COA VIP functionality. I've already tested failover between controllers so I know how well that works.

To test COA after a failover my thinking was to reboot the UAC, then try issuing a COA from clearpass. However it looks like the controller terminated the authentication session as it went down. So although I flipped across to the other controller and remained connected, Clearpass thinks the session has ended, so I can't issue a COA. 

After a short time Clearpass receives some accounting data from the second controller.  The accounting tab then shows the user session as active again, but the summary tab shows the user is offline. Eventually the online status becomes "not available". By this stage the original UAC is back online. I can then issue a COA, which gets no response from the network device - which makes sense because that VIP is back with the controller that no longer has that user.

This would appear not to be the expected behaviour, given all the thought that's gone into setting up the COA VIP, so the question is: have I got something configured incorrectly?

Is that the setting within each radius server entry?

You need to configure a VRRP IP for each node in the Cluster ProfileNeed to add the controller mgmt IPs and VRRPs in ClearPass

Ok, now I'm confused... Should the radius client address be the VIP or the 'real' address?

Turns out I'd also missed something else quite important too (hadn't assigned the rfc 3576 servers to the AAA profile). However it still doesn't work. I see the same behaviour in clearpass. As soon as I reboot the UAC it sends a RADIUS termination to to Clearpass, so COA is then no longer available.

I've tested two scenarios. Rudely disconnecting the UAC and rebooting it. Rebooting is as above.

If I just disconnect it (down the switch ports) everything works perfectly. My user session fails across to the other controller, and that controller takes the COA VIP, and a COA from Clearpass works. Hopefully the most likely scenario for a controller going down is a planned reboot for upgrade etc. In this scenario things don't currently work for me.

Just want to confirm that in the above controllers advanced RADIUS section that the IP used in the example are the managment IP and not the VRRP.    The exaple shows 192.168.1.141 for the RADIUS Client.

Thanks

Chris