Combining ACS administration vs ACS user services

[jdevoll]

I'd like to hear your thoughts on whether AAA services for device administration (routers, switches, etc) should be mixed with AAA services for user services (like 802.1x) on the same server(s), or whether you think it's best to separate the two functions on different servers.

I'm on the fence on which is the best approach because I can make compelling arguments for either method. I'm hoping somebody can provide me with some thoughts that will push me in one direction or the either.

[darpotter]

I would (cost permitting) keep them separate.

The demands of each are quite different, but 802.1x is a complex and often "cutting edge" (read flakey) protocol, or rather the sub-protocols being constantly developed inside it.

Not only that but typically there are many more network "end users" than admins. This puts the ACSs under more strain. If you're going to get problems with resiliance its here.

I've seen one Aironet AP gone mad bring down both primary and secondary ACSs before.

So if you can afford it, I would always put admins on their own ACS.