topic Re: SSL Certs on Standby ACE module in Application Networking

SSL Certs on Standby ACE module

new_networker — Wed, 05 Nov 2008 07:32:56 GMT

hi,

I have imported the SSL keys/Certs to standby ACE module and the FT group status is now showing HOT_STANDBY instead of COLD.

However, I don't see key and cert under ssl-proxy service definition as well as the reference to ssl-proxy server in the policy map configuration on the redundant module. Is this normal ?

Would the above definitions be seen after successful failover ?

Re: SSL Certs on Standby ACE module

Gilles Dufour — Wed, 05 Nov 2008 07:51:40 GMT

No. You should see the correct config before failover.

Make sure to run the latest version and if the problem persist open a service request with the TAC.

Re: SSL Certs on Standby ACE module

new_networker — Wed, 05 Nov 2008 09:54:59 GMT

It is resolved. For some reason, the SSL related configurations got wiped off from the active module and I had to redo it.

Would you know of any reason for this behaviour. Scary...

Re: SSL Certs on Standby ACE module

Gilles Dufour — Wed, 05 Nov 2008 10:44:57 GMT

the ssl-proxy config on the standby could not be applied because of missing files.

If for some reason, the standby became active, it would do a synch to the other device which would result in both ACE having the wrong config.

Gilles.

Re: SSL Certs on Standby ACE module

new_networker — Fri, 14 Nov 2008 09:14:45 GMT

Yup. That was the reason. The failover occurred before configuration was fully synchronized.

Re: SSL Certs on Standby ACE module

chris.pomeroy — Sat, 15 Nov 2008 17:55:20 GMT

If you don't have the certs on both modules, they won't sync.

Also if you see that the ft group is in cold_standby,

You can do the following to get them to sync back up.

ft group 2

no inservice

inservice

This does not cause any issues. I have had to do it serveral time.