Juniper NETWORK AND SECURITY MANAGER 2010.4 - REV1, Руководство по установке

Страница: 98 / 244

The Device Server receives SSP or SSH connections from each device it manages. All
managed devices are configured with both primary and secondary Device Server IP
addresses. During failover, the device connection with the primary Device Server will time
out. The managed device will retry the connection, and then attempt connection to the
secondary Device Server.
The Device Server also has a connection to the active GUI Server. Like the managed
devices in your network, the Device Server is configured with the primary and secondary
IP address of the GUI Server. Whenever a Device Server starts it will try to connect to the
primary GUI Server, then to the secondary, then back to the primary until it is successful.
Using a Shared Disk
On systems which contain a Device Server cluster, it is strongly recommended that you
use a shared disk (although this is not a minimum requirement). This is an additional
server, often optimized for data storage. Since the management system refers to this
store simply as a path (specified during installation) the mechanism of communication
to the store (for example, NFS relationship, SAN driver) and the type of media used is
not relevant. It is also recommended that you create and test the shared disk prior to
installation.
If an additional server is used as the shared data storage, a single point of failure is
introduced. If you are using a shared disk setup, you need to ensure sufficient redundancy
within the shared disk machine (for example, RAID, dual power supplies).
NOTE: In a Simple HA installation using a shared disk, ensure that the data
directories of both the GUI Server and the Device Server are on the same disk.
NOTE: If you are installing the management system for HA and you are using
a shared disk, you must activate the primary server before activating the
secondary server after the installation process.
Creating a Trust Relationship Between Servers
Rsync is run automatically by the HA Server and should not require any manual interaction.
Under normal circumstances when connecting via SSH to a server, you are required to
authenticate. The need for authentication is obviated by creating a trust relationship
between the two servers. You do this by creating a public/private RSA key on each server
and copying the public key to the peer. For more information, see “Establishing an SSH
Trust Relationship” on page 85.
Server Authentication
Communication between the Device Server and GUI Server uses a proprietary TCP based
protocol called SSP. This uses AES encryption and is similar to an IPSEC VPN tunnel.
The authentication is achieved via certificates. Each side of the SSP tunnel has a private
and public key. The public keys are exchanged during the first time the Device Server
connects to the GUI Server. This initial connection makes use of a OTP (one time
password) which is configured on both Device Server and GUI Server during installation.
Copyright © 2010, Juniper Networks, Inc. 76
Network and Security Manager Installation Guide