topic Are you working for Cisco? in Network Access Control

Cisco ACS 5.4 patch 6

cciesec2011 — Mon, 11 Mar 2019 04:46:43 GMT

Hi Everyone,

I have a Primary Cisco ACS, called CiscoACS1, version 5.4 patch 6 with an IP address of 1.1.1.1/24 and a Secondary ACS, called CiscoACS2, version 5.4 patch 6 with an IP address of 1.1.1.2/24.

Connectivity between them is ok, same subnets. I register CiscoACS2 with CiscoACS1 and everything is working fine, including Active Directory. Both of these ACSes are used to authenticate my network devices.

Every time I use the webUI to log into the Secondary ACS (https://CiscoACS2), I can see that the CiscoACS2 is synced with CiscoACS1, the status is always "UPDATED"

However, if I webUI into the Primary ACS (https://CiscoACS1), I always see CiscoACS2 as "pending".

I've tried to do "full replication" and eventually it will show up as "UPDATED" but a few hours later, it will show up as "PENDING".

Anyone knows why? Is this a "bug"?

Thanks in advance.

Hi,If replication status on

abwahid — Fri, 13 Jun 2014 13:16:59 GMT

Hi,

If replication status on ACS1 GUI is showing pending then you know, full replication happens over the Sybase DB TCP port 2638, so your port need to be open in firewall.

Are you working for Cisco?

cciesec2011 — Sat, 14 Jun 2014 10:15:16 GMT

Are you working for Cisco? What do you mean by "port need to be open in firewall"?

Both CiscoACS1 and CiscoACS2 are sitting on the SAME subnet. Why do I need to open ports on the firewall?