topic Yes we would distribute the in Wireless

Cisco Wireless HA box to box failover

Steven Williams — Mon, 05 Jul 2021 13:54:55 GMT

I am working on a design for wireless failover and I have an idea in my head and cant really see why it wouldnt work but im asking others.

If I have a WLC HA pair in two different geographically datacenters, Could I still set the IP of HA pair one at DC01 as primary and IP of HA pair one at DC02 as secondary so in the event the box to box failover doesnt work worse case scenario the APs will failover to the secondary HA pair in DC02? Yes I know clients and APs would see disruption but I am planning as last resort. In the interim the box to box failover would work and we could repair the previous active controller before the 90 days is up on the HA-SKU controller. I guess this would be a failover event for complete Datacenter failure or WAN connections broke to remote sites.

Steve,

Scott Fella — Fri, 21 Apr 2017 15:19:23 GMT

Steve,

You are talking about N+1 and not SSO I'm assuming since your separated via layer 3. This is a typical deployment and each controller would have interfaces/ip on subnets locally at that site. Now your AP high availability should be set to define your primary and secondary controllers.

You should not be using SSO as the RP has to be on the same subnet along with all the other interfaces.

-Scott

*** Please rate helpful posts ***

Guess I'm looking at a hybrid

Steven Williams — Fri, 21 Apr 2017 15:27:37 GMT

Guess I'm looking at a hybrid then.

AP will be connected to an HA Pair at site one and will have stateful failover to standby controller in a failed scenario. If the site goes down then HA pair site is irrelevant so then failover to the other HA pair at site 2.

Think of SSO like HSRP. Scoot

George Stefanick — Fri, 21 Apr 2017 18:45:13 GMT

Think of SSO like HSRP. Scoot is right you will want to consider N+ redundancy and set the high availability in your APs.

N+1 doesn't solve the issue

Steven Williams — Fri, 21 Apr 2017 18:52:47 GMT

N+1 doesn't solve the issue of client and AP interruption.

Thats correct there is no SSO

George Stefanick — Fri, 21 Apr 2017 19:01:32 GMT

Thats correct there is no SSO client or SSO ap in N+1. You are correct in your understanding. I know of one customer who stretched layer 2 across to the backup DC and their working fine.

Many environments can suffer a short drop because if the main goes down most times many other things have issues and wireless is lowest they worry about.

Ok so basic questions here:

Steven Williams — Fri, 21 Apr 2017 19:15:53 GMT

Ok so basic questions here:

traditionally you could set primary and secondary IPs of controllers on APs?

HA pair active/standby sync the configs which means IP addresses will carry to the standby controller.

so why could I not set my APs to that IP as primary and for the secondary IP set it to the IP of another HA pair? Seems simple enough but do the APs go into Simone other mode when HA pairs are configured that prevent them from having a primary and secondary controller IP?

You can but you still have a

George Stefanick — Fri, 21 Apr 2017 19:28:33 GMT

You can but you still have a break in the connection and thus a client ap interruption.

Now if the 2 controllers that are SSO - if one broke you would not.

Right. HA pair 1 would be

Steven Williams — Fri, 21 Apr 2017 19:35:06 GMT

Right. HA pair 1 would be AP01s primary controller(s). So if the active one failed in the HA pair, then stateful failover would happen and AP01 would never know. That is same site redundancy. Now if the that HA pair fails completely for AP01 because the ingress WAN link to the site with the HA pair failed then I could failover AP01 to HA pair 2 at a completely different site. Now yes in the case of a failover to another physical site separated via layer 3 boundry would cause AP01 to go through capwap again and clients to get new IPs etc etc...wireless wouldn't be completely down due to HA pair at the primary site going down.

Does that make sense? Kinda why I said N+1 hybrid. N+1 in a sense that an HA pair will be the "backup" pair for the other but SSO cause they are HA pairs.

yea 2 (SSO) pairs .. it would

George Stefanick — Fri, 21 Apr 2017 19:37:29 GMT

yea 2 (SSO) pairs .. it would work. You would likely add the high availability of the 3rd controller as the primary of HA pair #2.

What do you mean?

Steven Williams — Mon, 24 Apr 2017 13:11:44 GMT

What do you mean?

Each HA pair only has 1 IP

Steven Williams — Mon, 24 Apr 2017 13:45:40 GMT

Each HA pair only has 1 IP address correct?

So I would enter the IP of the HA pair to the APs primary controller

and the IP of the second HA pair to secondary controller so tertiary would just be blank

If your design is N+1, then

Scott Fella — Mon, 24 Apr 2017 14:28:41 GMT

If your design is N+1, then you would want to specify the primary and secondary controller and the tertiary would be blank. If your design is SSO, then you would only use the primary controller IP address and the secondary and tertiary would be left empty.

-Scott

*** Please rate helpful posts ***

But if I have 2 HA pairs then

Steven Williams — Mon, 24 Apr 2017 14:43:19 GMT

But if I have 2 HA pairs then I would use primary and secondary.

Each HA pair IP would fill both primary and secondary.

Specify what type of HA you

Scott Fella — Mon, 24 Apr 2017 14:47:37 GMT

Specify what type of HA you have, N+1, SSO or two pairs of SSO to make N+1? Better yet, put a drawing together so that we are clear on what you have and are trying to do. Still not clear as HA comes in two forms.

-Scott

*** Please rate helpful posts ***

Right! Two pairs of SSO to

Steven Williams — Mon, 24 Apr 2017 14:47:38 GMT

Right! Two pairs of SSO to make N+1 its a hybrid I am purposing it as.

Okay so with SSO, you have

Scott Fella — Mon, 24 Apr 2017 14:52:35 GMT

Okay so with SSO, you have two co trollers and only one valid IP address. So now if you have 4 controllers with two pairs in SSO, you have two primary IP address. That means you would configure the AP high availability using the primary and secondary and leave the tertiary empty. It's up to you to decide on what controller will be primary for a specific AP.

Example:

Site 1

primary controller: WLCSSO1

secondary controller: WLCSSO2

Site 2

primary controller: WLCSSO2

secondary controller: WLCSSO1

-Scott

*** Please rate helpful posts ***

Yes makes sense. So the only

Steven Williams — Mon, 24 Apr 2017 14:54:49 GMT

Yes makes sense. So the only way I get an interruption with APs and clients is if the site thats slated for the primary of the AP goes down.

I mean this seems to be a pretty sufficient design while providing the most uptime possible for all clients and sites.

That is correct as long as

Scott Fella — Mon, 24 Apr 2017 14:56:48 GMT

That is correct as long as things are working fine. Now if the second SSO pair is just for backup, do you really need that to be SSO? I can see if you will split the AP distribution between both, but it's up to how you want things designed.

-Scott

*** Please rate helpful posts ***

Yes we would distribute the

Steven Williams — Mon, 24 Apr 2017 15:04:32 GMT

Yes we would distribute the APs geographically to each HA pair. So we just need to make sure licensing on each can accommodate the load that the other would migrate in the even of failure.