Did you double checked the

faheeemarshad22 · ‎12-29-2014

Hi All,

I have 4 TACACS servers (1,2,3,4). 1 being the primary and the other 3 are secondary. The issue is 2 and 3 are syncing but the 4 is not syncing when i made changes in 1. I can see the all the AAA clients in 2 and 3. But when i search AAA clients in 4 the search couldn't find anything. I reboot the server and restarted as well through console but it didn't work. I checked the IP address of the server and it is good. Time is also same on all the four servers.

Any help would be appreciated. Thanks

Faheem

Jagdeep Gambhir · ‎12-30-2014

Faheem,

What you do see in the replication logs of primary and non-working secondary?

Regards,

~JG

faheeemarshad22 · ‎12-30-2014

Hi Jagdeep, thanks for responding. This is what i see in the logs. Although I am getting replication denied for Server 2 and 3 but i can see the clients in network configuration but in server 4 i cannot see clients replicated. I have to add them manually

Primary Logs:

12/30/2014	14:50:16	server1	INFO	Outbound replication cycle completed
12/30/2014	14:50:16	server1	ERROR	ACS 'server 4' has denied replication request
12/30/2014	14:50:15	server1	ERROR	ACS 'server 3' has denied replication request
12/30/2014	14:50:14	server1	ERROR	ACS 'server 2' has denied replication request
12/30/2014	14:50:12	server1	INFO	Outbound replication cycle starting...

Secondary Log:

12/30/2014	14:50:39	server 4	INFO	Outbound replication not configured (no components selected for sending) - cycle completed
12/30/2014	14:50:39	server 4	INFO	Outbound replication cycle starting...
12/30/2014	14:50:16	server 4	ERROR	Inbound database replication from ACS 'server1' denied

Jagdeep Gambhir · ‎12-30-2014

Server 4 shows outbound replication not configured. Can you check it system config --->database replication ---> select receive components.

Also it seems all server 2,3,4 denied replication.

Regards,

~JG

Jagdeep Gambhir · ‎12-30-2014

1) Make sure that you are not replicating over NAT. Replication over NAT
does not work because the IP is used as part of the server authentication

2) Next, check to make sure that you are not sending or receiving the
distribution table. On the primary server, the distribution table should not
be checked in the send list, and on the secondary, the distribution table should not be checked for receive.

3) Then I would like you to check in the secondary server's partner list, to
make sure that the primary is not listed. You should not enter the primary
server into the partner list on the secondary server. However, the primary
server should have all secondary servers listed in its partner list.

4) Ensure that the secondary server has it's replication scheduling set to
"manual".

5) Please verify that your servers are all running exactly the same ACS
version and build.

6) Also let me know if we have any firewall in between two acs servers.

7) Make sure we don't have any AAA-server IP listed as 127.0.0.1

faheeemarshad22 · ‎12-31-2014

I did all the above changes but no luck

Jagdeep Gambhir · ‎01-16-2015

Did you double checked the secret key?

faheeemarshad22 · ‎12-30-2014

Yes, I just checked it. Primary is set to send

Component	Send	Receive
User and Group Database Checked
Group Database only
Network Configuration Device tables Checked
Distribution Table Checked
Interface Configuration Checked
Interface Security Settings Checked
Password validation settings Checked
EAP-FAST master keys and policies
Network Access Profiles

Secondary is receiving:

Component	Send	Receive
User and Group Database Checked
Group Database only
Network Configuration Device tables Checked
Distribution Table Checked
Interface Configuration Checked
Interface Security Settings Checked
Password validation settings Checked
EAP-FAST master keys and policies
Network Access Profiles

CISCO ACA 4.1 synchornization issue