Enabling secondary MnT Role and Syncing

[Americo Massotti]

Hello everybody.

At the moment I have a cluster with only a MnT Primary role on the secondary Pan.

I would enable it also on the Primary Pan as Secondary MnT.

I'm wondering if after enable it and the Primary Pan restarted the services, it sync automatically with the MnT Primary/Secondary Pan.

It's true?

Thanks a lot.

Americo

[Marcelo Morais]

Hi @Americo Massotti 

 yes, you are correct, it syncs automatically.

 You can use the following command:

show application status ise

and take a look at the following process when you activate the Sec MnT .. from disabled to running:

M&T Session Database

M&T Log Processor

Hope this helps !!!

[Americo Massotti]

Hello Marcelo, thanks as usual.

[Americo Massotti]

There is also a method to check if the sync it's over?

From the deployment status I'm not seeing anything about the sync process

[Marcelo Morais]

Hi @Americo Massotti 

 yes, on Administration > System > Deployment, take a look at the Node Status icon and the icon marked bellow:

Hope this helps !!!

[Damien Miller]

There are two things to consider here.

1. The primary PAN will coordinate and replicate configuration and endpoint attributes with all of the nodes in the deployment. This is the "Sync" status you see in the deployment view. 
2. The two MNT nodes do not sync or replicate data between each other. Each MNT node maintains a unique copy of the RADIUS and TACACS logs sent to it. PSN nodes send two identical logs to each MNT for storage and reporting, these databases are not synced. 

Enabling the MNT role on the other node starts the MNT log collection from zero. While you can backup the operation logs from the existing MNT, and restore them to the new MNT, I do not recommend doing this unless there is some specific need. By default the MNTs store 30 days of logs, after a month, both nodes will have the same 30 days of logs barring some kind of problem with the deployment.