topic Re: MAR Cache Synchronization across large number of PSNs in Network Access Control

MAR Cache Synchronization across large number of PSNs

paul — Thu, 03 Jan 2019 13:50:01 GMT

I have a large deployment with 10 PSNs spread between two datacenters. The two datacenters are in the same city with very high speed low latency links (sub 10 ms) running between them. Functionally they can be considered the same LAN.

Current I have the 5 PSNs in each datacenter configured into their own node group with MAR cache sync turned on. All RADIUS authentication is sent to DC 1 with DC 2 as backup. This means DC1's MAR cache will be accurate, but in the event of a failover to DC2 it won't have an accurate MAR cache meaning any rules using MAR cache attribute would fail.

I am debating putting all 10 PSNs into the same node group and want to know the thoughts about doing this:

I know technically node groups aren't supposed to span sites, but honestly DCs in the same city with high speed/low latency interconnects is that really a problem?
Is 10 nodes in a node group with MAR cache synchronization a concern?

Thanks.

Re: MAR Cache Synchronization across large number of PSNs

Mohammed al Baqari — Thu, 03 Jan 2019 16:33:16 GMT

I don't see this a problem. I have PSN deployments between two countries
with 60 msec deployments and things are running smoothly.

The problem with MAR itself and its stability. I have seen MAR behaving
strange which finally made me move to EAP-FASTv2 which links user and
machine authentication natively.

I read many cisco articles and posts about same problems of MAR which I was
facing such as losing sync between user and machine auth that cause
intermittent loss of connection, users logoff but don't get connection
after login, etc

Re: MAR Cache Synchronization across large number of PSNs

paul — Thu, 03 Jan 2019 16:42:17 GMT

Do you have the PSNs all in one node group with MAR sync? How many PSNs total?

Re: MAR Cache Synchronization across large number of PSNs

Mohammed al Baqari — Thu, 03 Jan 2019 17:28:16 GMT

Hi, yes I have all PSNs in same group. In total they are 4

Re: MAR Cache Synchronization across large number of PSNs

hslai — Fri, 04 Jan 2019 16:40:00 GMT

On 1. With high speed and low latency, it's technically LAN speed so I would not expect any issue other than potentially physical disconnects.

On 2. With 10 in the same node group appears too much. I would suggest 2 in each group, as it could contribute to more time to authenticate an endpoint when ISE tries querying the other PSNs in the group if the cache not found locally.

Re: MAR Cache Synchronization across large number of PSNs

paul — Fri, 04 Jan 2019 16:51:16 GMT

Thx for the response. The issue is the MAR cache sync. It only works in the same node group. So in your mind 10 is no good.

Re: MAR Cache Synchronization across large number of PSNs

Mohammed al Baqari — Fri, 04 Jan 2019 18:16:16 GMT

Yes, that's true