DNAC Disaster Recovery

[jan.habicht]

We are currently in the planning phase for a new SDA project. and our customer would like to use the new DR feature from DNAC 2.2.2.x in the long term.

His plans go in the direction of building a 1:1 DR with a Witness Node. Is it possible to build a single DNAC appliance in the first step and add the DR in a later step with an additional DNAC appliance (+ Witness Node)?

The same question goes in the direction of a 3:3 DR. Is it supported there also in a first step to build a 3 node cluster in the main site and add the DR site later with a 3 node cluster (plus witness node)?

It is clear that we have to use hardware parity for DNAC appliance in both scenarios.

[balaji.bandi]

I am in the path of the same ..yes you need to have 3 node clusters each DC, Active, and Standby.

good presentation cisco Live  BRKSDN-1029

[x00008037]

Hey mate, did you build the DR site,

My question is did you have both DNAC ent interface in separate subnets ? Also what subnet is the floating VIP advertised via BGP in?

were implementing this now and Cisco documentation is not great on how-to set it up. are both DNAC in separate subnets? 

[gianfranco DI SANTO]

Hi,

I've the same question around the 1+1+1 setup, I guess the 2 sites (Main and recovery) are on differents subnet and routed through the Enterprise Network with Ipsec tunnel  made between 2 appliances.

So could you confirm this ? 

thx

[JAMES WEST]

Hi Guys, 

Did you manage to deploy 1+1+1, or get an answer to your queries above? We are looking at a similar deployment, and wondering the exact same question of address for DNA Server at site 1, followed by addressing at site 2 and Witness site.

Looking at the documentation is this done by advertising the VIP address by iBGP or eBGP.

Thanks,

James

[x00008037]

Hey Mate

Yes i have just deployed this setup. One DNAC at DC1 One DNAC at DC2 and witness VM at another Remote location.

to address a DNAC we used the following.

Ent IP address
Ent VIP Address

Cluster IP address
Cluster VIP Address

Both separate subnets.

Then you need a dedicated /32 for the DR VIP. This is the VIP the DNAC will advertise once BGP comes up. We used IBGP

Also you will need to name the both DNAC the same hostname. Also the FQDN has to be the CN in the certificate along with all the other IP addressing and the DR VIP IP address in the SAN also.

If you dont put the DR vip IP in the SAN in the certificate LAN automation will not work. We also added in the ip address of our WLC's as i read it may need this for some telemetery stuff.