topic Re: Enabling secondary MnT Role and Syncing in Network Access Control

Enabling secondary MnT Role and Syncing

Americo Massotti — Fri, 19 Feb 2021 10:33:28 GMT

Hello everybody.

At the moment I have a cluster with only a MnT Primary role on the secondary Pan.

I would enable it also on the Primary Pan as Secondary MnT.

I'm wondering if after enable it and the Primary Pan restarted the services, it sync automatically with the MnT Primary/Secondary Pan.

It's true?

Thanks a lot.

Americo

Re: Enabling secondary MnT Role and Syncing

Marcelo Morais — Fri, 19 Feb 2021 11:03:57 GMT

Hi @Americo Massotti

yes, you are correct, it syncs automatically.

You can use the following command:

show application status ise

and take a look at the following process when you activate the Sec MnT .. from disabled to running:

M&T Session Database

M&T Log Processor

Hope this helps !!!

Re: Enabling secondary MnT Role and Syncing

Americo Massotti — Fri, 19 Feb 2021 11:23:44 GMT

Hello Marcelo, thanks as usual.

Re: Enabling secondary MnT Role and Syncing

Americo Massotti — Fri, 19 Feb 2021 17:46:10 GMT

There is also a method to check if the sync it's over?

From the deployment status I'm not seeing anything about the sync process

Re: Enabling secondary MnT Role and Syncing

Marcelo Morais — Fri, 19 Feb 2021 18:55:50 GMT

Hi @Americo Massotti

yes, on Administration > System > Deployment, take a look at the Node Status icon and the icon marked bellow:

Hope this helps !!!

Re: Enabling secondary MnT Role and Syncing

Damien Miller — Fri, 19 Feb 2021 22:56:17 GMT

There are two things to consider here.

The primary PAN will coordinate and replicate configuration and endpoint attributes with all of the nodes in the deployment. This is the "Sync" status you see in the deployment view.
The two MNT nodes do not sync or replicate data between each other. Each MNT node maintains a unique copy of the RADIUS and TACACS logs sent to it. PSN nodes send two identical logs to each MNT for storage and reporting, these databases are not synced.

Enabling the MNT role on the other node starts the MNT log collection from zero. While you can backup the operation logs from the existing MNT, and restore them to the new MNT, I do not recommend doing this unless there is some specific need. By default the MNTs store 30 days of logs, after a month, both nodes will have the same 30 days of logs barring some kind of problem with the deployment.