8-13
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Chapter 8 Establishing Cisco Secure ACS System Configuration
CiscoSecure Database Replication
2.
After the primary Cisco Secure ACS has determined which components to
send to the secondary Cisco Secure ACS, the replication process continues on
the primary Cisco Secure ACS as follows:
a.
The primary Cisco Secure ACS stops its authentication and creates a
copy of the CiscoSecure database components that it is configured to
replicate. During this step, if AAA clients are configured properly, those
that usually use the primary Cisco Secure ACS failover to another
Cisco Secure ACS.
b.
The primary Cisco Secure ACS resumes its authentication service. It also
compresses and encrypts the copy of its database components for
transmission to the secondary Cisco Secure ACS.
c.
The primary Cisco Secure ACS transmits the compressed, encrypted
copy of its database components to the secondary Cisco Secure ACS.
This transmission occurs over a TCP connection, using port 2000. The
TCP session uses a 128-bit encrypted, Cisco-proprietary protocol.
3.
After the preceding events on the primary Cisco Secure ACS, the database
replication process continues on the secondary Cisco Secure ACS as follows:
a.
The secondary Cisco Secure ACS receives the compressed, encrypted
copy of the CiscoSecure database components from the primary
Cisco Secure ACS. After transmission of the database components is
complete, the secondary Cisco Secure ACS uncompresses the database
components.
b.
The secondary Cisco Secure ACS stops its authentication service and
replaces its database components with the database components it
received from the primary Cisco Secure ACS. During this step, if AAA
clients are configured properly, those that usually use the secondary
Cisco Secure ACS failover to another Cisco Secure ACS.
c.
The secondary Cisco Secure ACS resumes its authentication service.
Cisco Secure ACS can act as both a primary Cisco Secure ACS and a secondary
Cisco Secure ACS.
Figure 8-1
shows a cascading replication scenario. Server 1
acts only as a primary Cisco Secure ACS, replicating to servers 2 and 3, which act
as secondary Cisco Secure ACSes. After replication from server 1 to server 2 has
completed, server 2 acts as a primary Cisco Secure ACS while replicating to
servers 4 and 5. Similarly, server 3 acts as a primary Cisco Secure ACS while
replicating to servers 6 and 7.